Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to build a system where access to certain resources (file shares) in Windows Server, is limited not only by the username (in a Active Directory domain), but also by the client machine. So far, I haven't found a good way to do this; adding the computer account to the DACL is apparently not the way to do it.

Windows Server 2012 supports this with Dynamic Access Control, but this method requires all clients to be Windows 8, it seems, with no way to use this with Windows 7 clients.

Is there a supported way to do this? (or alternatively, add support for device authorization with Windows 7).

share|improve this question
Are all the client machines Windows 7? – i.h4d35 Nov 28 '12 at 22:38
Yes, except a few (for which I can make special arrangements) – Ori Shavit Nov 28 '12 at 22:41
I admit to not having to use this but here's what I found - it seems Dynamic Access Control is backward compatible atleast in a Test Lab environment. Might also want to check out here and… – i.h4d35 Nov 28 '12 at 22:51
It's 'backward compatible' in the sense that old Windows versions didn't have device-based authorization. But when using device conditions on a share in Windows 2012, the Windows 7 client cannot access it. – Ori Shavit Nov 29 '12 at 23:34

There's no built-in functionality to specifically do what you want prior to dynamic access control (DAC). The best that you're going to get would be to dedicate a file server and use some type of firewall functionality to limit access to that server to "authorized" machines (and, even then, you're really relying on the machine having the correct network address).

I suppose another, still network-layer method, would be to configure a dedicated file server for access only via IPSEC and use computer certificates, deployed to the "authorized" machines, to key the IPSEC communication.

Microsoft's answer is DAC. Given that, you're not going to find a very clean solution outside of DAC.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.