Hi Greg,
We have tried it with Vista and Windows 7 client too. You are right WinXP has 6 complience values. Instead of WinXP log I put a Windows 7. Yesturday I experimented with Windows 7 and Windows XP and results are below.
Here is the a nap client state for Windows 7 with disabled antivirus
System health agent (SHA) state:
----------------------------------------------------
Id = 79744
Name = Windows Security Health Agent
Description = The Windows Security Health Agent monitors security settings on your computer.
Version = 1.0
Vendor name = Microsoft Corporation
Registration date =
Initialized = Yes
Failure category = None
Remediation state = Could not update
Remediation percentage = 0
Fixup Message = (3237937215) - The Windows Security Health Agent cannot update the security state of this computer.
Compliance results = (0x00000000) -
(0xC0FF0047) - A third-party system health component is not enabled.
(0x00000000) -
(0x00000000) -
(0x00000000) -
(0x00000000) -
(0x00000000) -
(0x00000000) -
Remediation results = (0xC0FF004A) - A third-party antivirus product is not enabled. Windows cannot enable the antivirus product automatically. An administrator must enable the antivirus product manually.
And this is a corresponding event on the NPS server for that client
"Network Policy Server granted full access to a user because the host met the defined health policy.
User:
Security ID: DVGD\IVC-PatrinDA$
Account Name: host/IVC-PatrinDA.dvgd.oao.rzd
Account Domain: DVGD
Fully Qualified Account Name: DVGD\IVC-PatrinDA$
Client Machine:
Security ID: NULL SID
Account Name: IVC-PatrinDA.dvgd.oao.rzd
Fully Qualified Account Name: DVGD\IVC-PatrinDA$
OS-Version: 6.1.7600 0.0 x86
Called Station Identifier: 00-0F-34-15-06-16
Calling Station Identifier: 00-30-05-AB-9C-38
NAS:
NAS IPv4 Address: 10.103.255.11
NAS IPv6 Address: -
NAS Identifier: -
NAS Port-Type: -
NAS Port: 50307
RADIUS Client:
Client Friendly Name: ivc-225-c6506
Client IP Address: 10.103.255.11
Authentication Details:
Proxy Policy Name: NAP 802.1X (Wired)
Network Policy Name: Stage1 IVC NAP 802.1X (Wired) Noncompliant
Authentication Provider: -
Authentication Server: DVGD-NAP-01.dvgd.oao.rzd
Authentication Type: PEAP
EAP Type: Microsoft: Secured password (EAP-MSCHAP v2)
Account Session Identifier: -
Quarantine Information:
Result: -
Extended-Result: -
Session Identifier: {267DFC68-0D33-48B0-93B7-AED4B8054FE0} - 2010-04-21 22:40:56.784Z
Help URL: -
System Health Validator Result(s):
Windows Security Health Validator
"
And this is a nap client state for Windows XP SP3 with disabled antivirus:
System health agent (SHA) state:
----------------------------------------------------
Id = 79744
Nae = Windows Security Health Agent
Description = The Windows Security Health Agent monitors security settings on your computer
Version = 1.0
Vendor name = Microsoft Corporation
Registration date =
Initialized = Да
Failure category = Отсутствует
Remediation state = Не удалось выполнить обновление
Remediation percentage = 0
Fixup Message = (3237937215) - The Windows Security Health Agent cannot update the security state of this computer.
Compliance results = (0x00000000) -
(0xC0FF0047) - A third-party system health component is not enabled.
(0xC0FF0048) - The signatures for a particular third-party system health component are not up to date.
(0x00000000) -
(0x00000000) -
(0x00000000) -
Remediation results = (0xC0FF004A) - A third-party antivirus product is not enabled. Windows cannot enable the antivirus product automatically. An administrator must enable the antivirus product manually.
(0xC0FF004C) - The signatures for a particular third-party antivirus product are not up to date. An administrator
must update the antiv
NPS Event log for Windows XP SP3:
"Network Policy Server granted full access to a user because the host met the defined health policy.
User:
Security ID: DVGD\IVC-VCL-MOBIL1$
Account Name: host/IVC-VCL-mobil1.dvgd.oao.rzd
Account Domain: DVGD
Fully Qualified Account Name: DVGD\IVC-VCL-MOBIL1$
Client Machine:
Security ID: NULL SID
Account Name: IVC-VCL-mobil1.dvgd.oao.rzd
Fully Qualified Account Name: DVGD\IVC-VCL-MOBIL1$
OS-Version: 5.1.2600 3.0 x86
Called Station Identifier: 00-0F-34-15-06-14
Calling Station Identifier: 00-16-36-5E-D1-62
NAS:
NAS IPv4 Address: 10.103.255.11
NAS IPv6 Address: -
NAS Identifier: -
NAS Port-Type: -
NAS Port: 50305
RADIUS Client:
Client Friendly Name: ivc-225-c6506
Client IP Address: 10.103.255.11
Authentication Details:
Proxy Policy Name: NAP 802.1X (Wired)
Network Policy Name: Stage1 IVC NAP 802.1X (Wired) Noncompliant
Authentication Provider: -
Authentication Server: DVGD-NAP-01.dvgd.oao.rzd
Authentication Type: PEAP
EAP Type: Microsoft: Secured password (EAP-MSCHAP v2)
Account Session Identifier: -
Quarantine Information:
Result: -
Extended-Result: -
Session Identifier: {049C2428-A212-4D14-9E9F-B15041F29071} - 2010-04-21 23:42:16.458Z
Help URL: -
System Health Validator Result(s):
Windows Security Health Validator
"
Is it possible to trace on the NPS server which Compliance Results are returned from nap agent in EAP session?
Regards, Dmitry.
