I have an ISA Server setup. Firewall clients on all the PCs on my network. I have the ISA Server setup to deny internet access to any client who cannot provide Active Directory authentication. However, this presents the problem that system services on network member computers (Windows Update, for example) cannot access the internet since they can't authenticate via AD.

Help?

Hello Spike15, welcome back to the forum!

I will mark your thread as open so one of our great techs will be able to help you as soon as possible

Thanks for your patience!

Regards,

Smokeycheech

I can confirm that other processes are affected by this.

Outlook 2007, for example, will never connect to mail servers outside the firewall so long as I have internet access denied to all non-authenticated users.

Windows Update also fails.

The bizarre thing is that some, decidedly non-standard traffic, succeeds to authenticate itself. World of Warcraft, for example, works over this method.

Here are some pictures detailing the problem:





Any help would be appreciated, although given my history with this site I'm not remaining hopeful and am still searching for solutions manically...

EDIT: The following are not solutions:

Allowing access on a per-computer basis. I want to filter access based on the users who are logged into computers, not the computers themselves. I also have wireless et cetera and don't want uninvited/-authorized people accessing my internet connection by spoofing IP addresses.

Allowing blanket access to the internet. Not only does this run into problems as detailed above, but I also want to be able to apply access restrictions to certain users, users who, due to the nature of their computer use, have administrative rights on their PCs. If I allow blanket access to the internet, and then restrict access per user, these particular users can totally circumvent the scheme by just uninstalling the firewall client.

Unsurprisingly, I solved this myself.

Excellent Spike! i will mark this as resolved for you!

I am sorry we couldn't add any input for you, you were too quick for us this time!

Regards,

Smokeycheech