IPsec policy on DC

  • Thread starter Thread starter Bentley
  • Start date Start date
B

Bentley

I need to secure communications between my DC's and 1
domain member server. I configured identical policies on
both ends, using Kerboros authentication, but only the
policy from the DC to the server works. The server cannot
communicate with the DC at all until the DC initiates the
communication, then the server will respond and both are
fine.
What am I missing? Thanks
 
Ipsec negotiation policies between domain members and domain computers are not
supported by Microsoft and not recommended due to the problems they cause such as
those you mention. Usually if you try to implement, a user will find he can not logon
to the domain computer after a reboot. This is not well documented but there is a KB
below that references this problem and it is mentioned in the Windows 2003 Server
Deployment Kit ipsec domination. The last link is to a thread about this subject on
this newsgroup a while back --- Steve

http://support.microsoft.com/?kbid=254949

http://groups.google.com/groups?hl=...oller%20umbach&hl=en&lr=&ie=UTF-8&sa=N&tab=wg
http://tinyurl.com/5b3ne -- same link as above shorter, in case of wrap.
 
Back
Top