Lesson 4: Examining Remote Access Policies

Remote access policies allow the assignment of a connection type to a user according to a set of conditions such as group membership. Understanding how policies are applied helps you to provide customized access to the various users and groups in your organization. It is likely that the default policy settings are adequate for your remote access needs. However, it is important that you become familiar with remote access policies because using them effectively provides you with a great deal of flexibility in granting remote access permissions and usage.

Windows 2000 RRAS and IAS both use remote access policies to accept connection attempts. Remote access policies are stored on the remote access server, not in the Active Directory database, so that policies can vary according to remote access server capabilities.

A remote access policy consists of three components that cooperate with Active Directory directory services to provide secure access to remote access servers. The three components of a remote access policy are its conditions, permissions, and profile.

This is a list of parameters such as the time of day, user groups, Caller IDs, or IP addresses that is matched to the parameters of the client connecting to the server. The first policy that matches the parameters of the incoming connection request is processed for access permission and configuration.

In Windows NT 3.5 and later, remote access was granted based on the Grant Dial-In Permission To User option in the User Manager tool or the Remote Access Administration tool. In Windows 2000, remote access connections are granted based on the dial-in properties of a user account and remote access policies.

The permission setting to allow or deny access on the remote access policy works together with the user's dial-in permissions in Active Directory directory services to create both positive and negative rules. For example, a policy could grant access to all users in Group A from 8 am-5 pm, but the permissions for User X in Group A could be set to deny access in Active Directory directory services. On the other hand, another policy could deny access to Group A from 5 pm-8 am, but the permissions for User Y in Group A could be set to allow access. As a result, Group A can gain access only from 8 am-5 pm, but User X is denied access completely, and User Y is granted 24-hour access.

Each policy includes a profile of settings that are applied to the connection. If the settings of the connection do not match the user's dial-in settings or the profile properties, Windows 2000 denies access to the connection.

Windows 2000 evaluates a connection attempt based on logic that incorporates user and remote access permissions, policy conditions, and profile settings. Using this logic, both mixed and native-mode networks can use Windows 2000 remote access servers.

If all of the conditions of a remote access policy are met, the user's dial-in permission is checked by Active Directory directory services and can override the policy's permission. However, when dial-in permission on a user account is set to the Control Access Through Remote Access Policy option, it is the policy's permission that determines whether the user is granted access.

Granting access through the user's permissions or the policy's permissions is only the first step in accepting a connection. The connection attempt is then matched to the settings of the user account and the policy profile. If the connection attempt does not match the settings of the user account or the profile, the connection attempt is rejected.

The default policy that is created when RRAS installs is named Allow Access If Dial-In Permission Is Enabled, meaning that the user's dial-in permission will control access. Table 9.1 describes the settings of the default policy.

Table 9.1 Default Policy Settings

Setting	Value
Conditions	Current date/time = any day, any time
Permissions	Deny Access
Profile	None

This default policy is designed to be sufficient for many organizations. However, you should be aware of the implications of the default policy on native- and mixed-mode domains.

If you set the dial-in permission on every user account to Control Access Through Remote Access Policy, and if you do not change the default remote access policy, all connection attempts will be rejected. However, if one user's dial-in permission is set to Allow Access, that user's connection attempts will be accepted. If you change the permission setting on the default policy to Grant Remote Access Permission, all connection attempts are accepted.

The default policy is always overridden in a mixed-mode domain, because the user's dial-in permission, Control Access Through Remote Access Policy, is not available on mixed-mode domain controllers. However, remote access policies are applied to users in a mixed-mode domain. If the user's dial-in permission is set to Allow Access, the user still must meet the conditions of a policy to gain access.

It is often necessary to administer remote access using multiple remote access policies. You should create these policies carefully. If a connection attempt does not match any of the remote access policies, the connection attempt is rejected, even when a user's dial-in permission is set to Allow Access. The requirement that at least one policy's conditions are matched also means that if the default policy is deleted and no other remote access policies exist, users will not be able to gain access to the network, regardless of their individual dial-in permission settings.

Remote access policies allow the assignment of a connection type to a user according to a set of conditions such as group membership. Both Windows 2000 RRAS and IAS use remote access policies to accept connection attempts. If a connection attempt does not match any of the remote access policies, the connection attempt is rejected, even when a user's dial-in permission is set to Allow Access. The requirement that at least one policy's conditions are matched also means that if the default policy is deleted and no other remote access policies exist, users will not be able to gain access to the network, regardless of their individual dial-in permission settings.

Remote access policies are stored on the remote access server, not in Active Directory directory services, so policies can vary according to remote access server capabilities. A remote access policy consists of three components that cooperate with Active Directory directory services to provide secure access to remote access servers. The three components of a remote access policy are its conditions, permissions, and profile.