 | This articlerelies excessively onreferences toprimary sources. Please improve this article by addingsecondary or tertiary sources. Find sources: "Network Access Protection" – news ·newspapers ·books ·scholar ·JSTOR(November 2012) (Learn how and when to remove this message) |
Network Access Protection (NAP) is a Microsoft technology for controlling network access of a computer, based on its health. It was first included inWindows Vista andWindows Server 2008 and backported toWindows XP Service Pack 3. With NAP, system administrators of an organization can define policies for system health requirements.[1] Examples of system health requirements are whether the computer has the most recent operating system updates installed, whether the computer has the latest version of theanti-virus software signature, or whether the computer has ahost-based firewall installed and enabled. Computers with a NAP client will have their health status evaluated upon establishing a network connection. NAP can restrict or deny network access to the computers that are not in compliance with the defined health requirements.
NAP wasdeprecated inWindows Server 2012 R2[2] and removed fromWindows Server 2016.[3]
Network Access Protection Client Agent makes it possible for clients that support NAP to evaluate software updates for their statement of health.[4] NAP clients are computers that report their system health to a NAP enforcement point. A NAP enforcement point is a computer or device that can evaluate a NAP client's health and optionally restrict network communications. NAP enforcement points can beIEEE 802.1X-capable switches orVPN servers,DHCP servers, or Health Registration Authorities (HRAs) that runWindows Server 2008 or later. The NAP health policy server is a computer running theNetwork Policy Server (NPS)service in Windows Server 2008 or later that stores health requirement policies and provides health evaluation for NAP clients. Health requirement policies are configured by administrators. They define criteria that clients must meet before they are allowed undeterred connection; these criteria may include the version of the operating system, apersonal firewall, or an up-to-date antivirus program.
When a NAP-capable client computer contacts a NAP enforcement point, it submits its current health state. The NAP enforcement point sends the NAP client's health state to the NAP health policy server for evaluation using theRADIUS protocol. The NAP health policy server can also act as a RADIUS-based authentication server for the NAP client.
The NAP health policy server can use a health requirement server to validate the health state of the NAP client or to determine the current version of software or updates that need to be installed on the NAP client. For example, a health requirement server might track the latest version of an antivirus signature file.
If the NAP enforcement point is an HRA, it obtains health certificates from acertification authority for NAP clients that it deems to be compliant with the relevant requirements. NAP clients can be placed on a restricted network if they are deemed non-compliant. The restricted network is a logical subset of the intranet and contains resources that allow a noncompliant NAP client to correct its system health. Servers that contain system health components or updates are known as remediation servers. A noncompliant NAP client on the restricted network can access remediation servers and install the necessary components and updates. After remediation is complete, the NAP client can perform a new health evaluation in conjunction with a new request for network access or communication.
A NAP client ships withWindows Vista,Windows 7,Windows 8 andWindows 8.1 but not withWindows 10.[3] A limited NAP client is also included inWindows XP Service Pack 3. It has noMMC snap-in and does not supportAuthIP-basedIPsec enforcement. As such, it can only be managed via a command-line tool callednetsh, and the IPsec enforcement isIKE-based only.[5][6]
Microsoft partners provide NAP clients for other operating systems such asmacOS andLinux.
