Deny Student access to Staff intranet

[kamikaze]

We have a Smoothwall UTM-1000 & two intranet servers (one for staff & one for students). I need to stop the students having access to the staff intranet server but cannot workout how to do this using the UTM or GPO.

 

Any ideas?

 

Thanks

Mike Taylor

St Leonards School

St Andrews

[hil]

You should be able to set the security on the staff folder to staff or something like that.

[kamikaze]

Thanks for the quick reply Peter. Tried that but because the Staff Intranet site has been setup to allow anonymous access in IIS this doesn't work.

 

Mike

[pete]

Tell us what (other than username + AD security groups) on your network can be used to determine "a student is using this machine" vs "a staff member is using this machine?"

 

If the IIS box has no means of determining that (ip ranges, reserved sections of ip range) and treating traffic appropriately, you'll have to do that another way. If it can distinguish the difference, you could simply modify the firewall.

 

Is turning on Windows Authentication for the staff intranet server an option?

 

Does traffic go through the SW box in order to reach either server, or do users go direct to anything on the local network (proxy exceptions)?

[kamikaze]

Due to nature of the beast - students & staff access the same pcs in the IT Labs so can't put in controls by IP Address. The only way to apply security is via AD Groups.

 

We have a Smoothwall UTM-1000 in place (which all traffic passes through Internal & External) but I can't find anything that seems to be able to do this.

 

Mike

[Domino]

Why not set IIS to use AD authentication instead?

[jdoyle]

on the intranet I inherited (IIS box with ASP/vbscript) we had the script in the home page checking for AD group membership and displaying different content/menus accordingly. Access rights on some of the staff only folders as extra security.

 

Now moved to Sharepoint 2007 and it's a similar approach.