ipsec

[browolf]

westfield setup ipsec on our servers so laptops can connect to sims on the admin network. laptops and dcs are in "secured" OUs. they have group policies with ip sec settings in.

 

some laptops are logging on uber slowly today but if i try and sniff the traffic it's all encrypted ESP. I've rememoved the laptop from the secured laptops and rebooted bou but the traffic is still being encrypted. is there anyway to get unencrypted traffic?

[Geoff]

No, thats the point.

[browolf]

so if i was to remove the DCs from the secured DCs OU then the traffic would become unencrypted?

[Geoff]

Depends if windows feels like it. I suspect you'd have to enforce unencypted traffic in your other OU(s).

[browolf]

normal computers dont have encrypted traffic so if i make a test OU and put the laptop in it and somehow....force encryption off for that OU the laptop traffic should become visible.

[_Bob_]

Depending on how its been set i'm pretty sure you would have to remove the policy from the server as well. There's some instructions here

 

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/ipsec_sec_pol_assign_domain_policy.mspx

 

but the last line may be appropriate for you

 

'If you need to disable IPSec for only a specific computer, you can disable the IPSEC Services service on that computer.'

[browolf]

we discovered that if we rename the laptops and remove them from the ipsec OU. logging on goes back to the normal speed.