how to do dhcp and isaserver

[browolf]

i had an idea on how you can control internet access when using DHCP. it's sort of an extension to the scripts i've written for controlling our own access in isa 2004. we only use dhcp on laptops.

 

make a hidden share on the isaserver, say logs$

in the login script make a line:

ipconfig | find "IP Address" > \\isaproxy\logs$\%computername%.txt

 

this will mean everytime someone logs on a file will be created containing the ip address. unfortunately what i've thought up isnt foolproof and will own work if the class is logged on.

 

basically combine the room management script i made in the scripts forum with the individual pc management.

 

i.e.

 

when you turn a room on, the script will have to add machines to a computerset dynamically before the computerset is added to the rule. You can find the machine names from the names of the log files if you use standard prefixes for machinenames. and then go thru the list and get the ipaddresses. add the computers to the set and add the set to the rule. it's a bit of a nightmare tbh and you could never do it manually. but asfaras i can see it's the only way. it could be made a bit easier if you can interrogate the dns server thru vbscript. it would be more foolproof then and no need to bother about log files. i expect it's possible somehow but i dont know.

[ChrisH]

This sounds like a lot of faffing! ISA doesnt work with DHCP? This doesnt sound good at all.

[browolf]

i dont know about isa 2000 but in 2004 access on a per computer basis is purely based on ipaddress. which obviously wouldnt work with dhcp :-\

[ChrisH]

That sounds awful! Surely it should work of MAC address if they are not keen on host names etc.

[browolf]

not as far as I can see. a computer set can contain either, a computer ip address, an ip range or a subnet.

 

our uncatered scenario is surely shortsightedness on the part of microsoft.

 

on the other hand if someone clever could make a plugin for isa that allowed easy room management a vast amount of money could be made

[MkII]

Maybe this should be it's own thread. But then it's a bit obscure... [mods - feel free to move me ]

 

Does anyone use loopback processing?

 

In case you don't know - designed for school locations where users typically can logon to any number of PC's - loopback processing allows your user to have the policies of many OU's apply to a user - OU's in seperate OU trees - so you can apply policies by user object AND computer object. In this way I redirect a start menu dependant on the room users log in to.

 

I presume this method could be used to deny Internet Access per room in the same way - by nobbling the proxy settings in the room OU policy??

[Geoff]

Problem with that is that any changes take a while to get done. You couldn't for example, have a room with internet access and be sure that it wouldn't next lesson. This is because it takes up to 90 minutes for changes in GPO's to propagate. If you reduce that time limit, you'll trash your network.

 

The ideal solution needs to be instant on/off and operable by a teacher.

[ChrisH]

I agree with Geoff Loppback policys especially I find are a little flakey when it comes to making changes. They are good for permanent stuff though.

You can use Lanvie or something to turn the Internet off for a room or get machine lists together and use psexec to write a dummy proxy in while they are logged on.