Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically, I don't want certain OSs on the network.

share|improve this question
up vote 5 down vote accepted

Use 802.1x on the switchport-level with client certificates and a credential challenge. This will make it so that only authorized computers and authorized uses have access to the network. Things like Cisco ISE/NAC extend this to allow other checks as well (like current AV definitions and Windows patches), but you can usually configure vanilla 802.1x auth on any managed switch that's worthwhile.

share|improve this answer
Client certificates might be a bit much. Any way in group policy? – MathewC Jul 23 '12 at 14:41
Group Policy only applies to domain-joined computers. How do you plan on applying a policy to a domain-joined machine telling it that it can't be connected to the network that the domain that it is joined to is on? If you don't use 802.1x, then anyone can bring in any laptop, plug it in, and have access to your network. Handling it at any layer above layer 2 (the switchport) would still allow there to be unauthorized access. Why are client certificates "a bit much" it's a fairly standard way of handling this. – MDMarra Jul 23 '12 at 14:42
Things like AD CS allow for automatic enrollment of client machine certificates for specified clients. An appliance like Cisco ISE or Cisco NAC simplifies this even further. You just install the NAC agent on the trusted computers, configure your AD to auth trusted users, and then put anything that isn't trusted by the NAC in a quarantine VLAN that has no access. – MDMarra Jul 23 '12 at 14:48
Okay gents. I understand what you mean, but lets say I have a network with 1000 computers, and those machines should have all been updated to Windows 7, but some people in the field are slacking and need to have some tough-disconnection-love. Trying to get certs on 1000 computers might be more of a chore. Don't get me wrong, it's not a bad chore, just a bigger one. – MathewC Jul 23 '12 at 14:56
@MathewC Use auto-enrollment or GPO to push the certs out and use WMI filters to control it. Doing anything manually to 1000 computers is a chore, that's why you leverage the automation tools that come with any technology. If you control the AD and just want to give people a nudge, you could always just do an LDAP query for computer objects with an OS attribute of "Windows XP" and then disable/delete those objects. – MDMarra Jul 23 '12 at 14:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.