Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Now that we have applied an internal to external rule blocking all users access to the internet, other than those users in a whitelist, we have the obvious issue of non authenticated users, not on our domain, i.e.; domain-less guests not being able to access the internet. Other than configuring each machine to use our alternative gateway - which would require a member of IT to be onsite everytime a guest arrives - can this be done through ISA adn AD?

share|improve this question
Tell us a little about these "guests". Are they on their own machines plugging into your LAN using DHCP? Are they using your machines, and if so how are they logging into yours? – Bret Fisher Mar 1 '11 at 6:48
Are they on their own machines plugging into your LAN using DHCP - Yes or by wireless, but their own machines and own logins - no domain awareness. – Klaptrap Mar 1 '11 at 8:37

You can create a rule to allow unhautenticated users Internet access and give it a higher priority than the rule allowing only authenticated users; but then, users would simply be allowed Internet access without authentication, because the second rule would never kick in.

You can create a guest account to be used by guest users, with very restricted domain access (or even only as a local non-admin user on the ISA Server computer) and only use it for Internet access.

share|improve this answer
This means that the guest machine will need to be domain aware which relies on a member of IT to be available and to configure each guest device? – Klaptrap Mar 1 '11 at 6:19
No, the user will be asked for credentials when accessing the web and; there is no need for the machine to be joined to the domain for this to work. – Massimo Mar 1 '11 at 10:04
Nice - I understand, okay & thanks. I'll trial this later – Klaptrap Mar 1 '11 at 12:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.