Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking to see how others deal with contractors/non-employee vpn access.

  • How do you provision/deactivate their accounts?
    • Are they in your AD or are they in another account silo?
  • How do you restrict them so they only have access to what they where hired to work on?
  • How do you manage passwords?
    • Are they forced to change their password?
    • How is the password provided to them?
  • Do you use any form of Network Access Control/security scanning of their computers?
share|improve this question

We make an account in a consultant OU that has specified logon hours unless for special circumstances they need access longer than that.

Their password is changed on first login just like everyone else.

The consultant laptop is put on a VLAN that only has restricted internet and no intranet access. To access anything on our LAN they use our SSL VPN and are restricted down to only being able to connect to servers used on whatever project they are on.

Typically a consultant will use a laptop provided by us, if not, they will get the AV software which we require or the VPN connection will fail.

share|improve this answer

we have a couple of pcf file that contain only specific server they are allowed to work on. They have accounts in AD that are normally disabled, when the need to use them we activate the accounts but set them to expire when they think they should have finished.

The accounts are only activated via an email from a valid source, and all the requests and actioned are in the helpdesk. Works quite well for us

share|improve this answer
I would highly recommend that you ditch pcf files. The encrypted password in said pcf, is very easy to break. I assume that you probably email these pcfs in an unencrypted email. – GregD Jul 10 '09 at 14:23
what would you use instead? – beakersoft Jul 12 '09 at 13:22

I would use two-factor authentication. One a physical device that they have to possess in addition to a username and password.

E-token/SafeWord devices from Aladdin work pretty well for the physical device portion and they're relatively inexpensive should they get lost or the contractor doesn't return theirs.

On the backend, I would use a radius server or TACACS server should they be doing any work on your firewall.

share|improve this answer

We require that contractors with outside equipment use SSL-VPN to access internal resources, period. In the office, no external equipment is allowed, except for a lab area where they can plug outside equipment into a network that gives them internet access for limited periods of time -- but there is no access to the internal network allowed.

If they are issued a laptop by us, they are subject to all of the same rules as any other employee, except that their accounts expire periodically and have to be reauthorized by an authorized manager.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.