Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have some users connecting to a Windows Server 2008 box on our network, is there an easy way that I can prevent these users from accessing other computers on the LAN, such that they can only access files on the server. I'm not very familiar with server administration.

share|improve this question

3 Answers 3

My suggestion is to use network level isolation by firewall policy. Namely the design you should use is DMZ.

For instance, if you have a terminal server/remote desktop server that VPN users connect into, it would be best to isolate that terminal server to a subnet off an interface of a firewall where more restrictive policies can take place.

See this diagram, and read about the concept of a DMZ.

Put the dedicated firewall to the task it handles best, being a firewall; and leave your Windows to the task it does best, being a network operating system.

To do this correctly and securely, you have to educate yourself a little more. :)

share|improve this answer

While there are any number of ways to do this the most fundamental way is to simply ensure those users have appropriate permissions. i.e. Don't give them permissions which would allow them to access anything you don't want to access.

share|improve this answer

You can use Windows Firewall with Advanced Security to block all outbound traffic to your LAN. If you set this in a Group Policy or Local Policy, non-admin users shouldn't be able to change it.

Note that you'll have to allow, at a minimum, outbound traffic for your RDP sessions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.