Remediation Server Groups

Applies To: Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Vista

Remediation server groups are used to specify servers that are available to noncompliant NAP clients for the purpose of remediating their health state to comply with health requirements. The type of remediation servers that are required depend on your health requirements and network access methods.

Remediation servers do not only provide updates to noncompliant computers. They can also provide network services that noncompliant computers require in order to update their health, or to perform a limited set of tasks while they are in a restricted status. For example, a remediation server might provide DHCP services to computers that have been placed on a noncompliant VLAN. Remediation servers might also host Web sites that provide instructions users can follow to make their computers compliant.

Remediation servers can be accessible to both compliant and noncompliant computers or to noncompliant computers only. The methods for providing access to remediation servers depend on the NAP enforcement method.

IPsec enforcement

In an IPsec enforcement design, remediation servers should be placed in the IPsec logical boundary network. You must issue NAP exemption certificates to remediation servers and configure IPsec policy so that they can freely communicate with noncompliant computers. Placing remediation servers in a remediation servers group in the NPS console has no effect on access to these servers when you use NAP with IPsec enforcement.

802.1X enforcement

In an 802.1X enforcement design, the placement of remediation servers depends on whether VLANs or ACLs are used to restrict network access of noncompliant clients. NAP enforcement points might support both or only one of these methods.

• 802.1X enforcement with VLANs. Remediation servers must be placed on the noncompliant VLAN or access must be provided through inter-VLAN routing methods. If remediation servers must also be accessible to compliant NAP client computers, the remediation server is placed on a trunking port or dual-homed to provide access to multiple VLANs.

• 802.1X enforcement with ACLs. Access of noncompliant computers is restricted to the IP addresses and service port numbers of remediation servers only.

Placing remediation servers in a remediation servers group in the NPS console has no effect on access to these servers when you use NAP with 802.1X enforcement.

VPN enforcement

In a VPN enforcement design, two methods are available for providing access to remediation servers: remediation server groups and IP filters. Both of these methods can be used to provide noncompliant NAP clients with access to remediation servers. When you configure a remediation server group, noncompliant NAP client computers are automatically granted access to the IP address of each server in the list. IP filters have the added advantage of allowing you to specify that access is granted only to a specified service port number.

DHCP enforcement

In a DHCP enforcement design, noncompliant NAP client computers are provided with classless static host routes to each member device that is configured in a remediation servers group using the NPS console. If remediation servers are located on a subnet different from the subnet on which NAP clients appear, the DHCP server uses the 003 Router option from the default NAP class to provide noncompliant computers with static host routes to remediation servers. The routing device configured in this scope option must be capable of forwarding requests from noncompliant NAP clients to the remediation server. You can also configure classless static host routes to remediation servers by using scope option 121 in the default NAP class.