I have two contracters who need access to our SQL LOB application. They will be connecting via VPN to a router that authenitcates via RADIUS on the DC. Now, the two servers in question are DCs. The users created are members of on Security Group - VPN Users. The only security rights attached to this group is dialin access.
On paper, this should be a straightforward. The fly in the ointment is that maybe 75% of the share permissions on these servers include Full Access for Authenticated Users. Don't ask why and no there's no chance to correct this at the moment.
SQL lives on DC2 but the ODBC settings on the client software negate any need for domain authentication. So, all I need is to stop these VPN users from browsing the network for shares and accessing them.
I have tried setting "Deny access from network" in the DC Security Policy but this seemingly hasn't helped.
For info: Both servers are W2003 SP2 Standard. The clients will be using XP/Vista.