Isolation of domains on the MS Windows Server platforms and not only ;-).

For a better understanding about this technology I advise to address on the following references:

http://technet.microsoft.com/ru-ru/library/cc755490%28WS.10%29.aspx

http://technet.microsoft.com/ru-ru/library/cc755490%28WS.10%29.aspx


I want to add a little to this information.
In view of that there is a possibility of isolation not only domains, servers, the computers which are not entering into the domain. There is also a possibility on isolation of the computers entering into the existing MS Windows domain. Tell, and for what it can be necessary? For example, for isolation of the kopyyuter entering into the MS Windows domain which appeared are infected with a network virus (worm) but for which access to some resources of the domain is necessary. Not absolutely safely, truth? But, we will protect other computers of a network from direct interaction with the infected workplace. Besides, always there is a possibility to protect this computer and physically, having forced it to work through the allocated station of safety, for example, as through a lock which, in turn, will begin to block an undesirable traffic. All this quite flexibly can be adjusted for rainy day by means of AD (GPO) security policies, and then, as required, to add in this policy the hosts needing isolation. It is worth to remember also and about possibility of a filtration of a traffic on ports with IPSec use since it can protect from some types of network viruses which use not system ports for the work. But, unfortunately, such possibilities modern viruses leave ever less. And everywhere IT services divisions still use the NetBIOS protocol for the publication of the general resources in a network that harmful influences security of hosts in a local network. And it was possible to use AD possibilities for the publication in the AD catalog, then the quantity used system ports on hosts in a network was reduced a little, system resources from refusal of use of superfluous services would increase, there would be impossible an infection with some network viruses and would make impossible attacks to the NetBIOS protocol. Yes, for critics, in such policy of the organization of the domain it is possible to add and exceptions to the rules, for print servers, for example.
I will add from myself still that the present possibilities already were present from the MS Windows 2000 platform, but nobody paid to them attention, or didn’t want to study new possibilities on improvement of level of safety in the MS Windows network and whether a little still why. And still the present possibilities of very few people uses.
The author of these lines already used possibilities on isolation of domains in the work in 2004, but then to me the organizations which would like to improve information security didn’t meet and to simplify response to these or those инцинденты information security though offers were brought by me and I acquainted the management with this technology. And it is a pity! It is not necessary to mark time, it is necessary to develop infrastructure and completely to use the possibilities offered by the producer of these platforms – Microsoft, instead of to look for not certificated and doubtful decisions of foreign producers which, as a rule, aren’t free and demand additional financial allocations.
Small addition to this article. Isolation of domains can be realized with IPSec use, without installation of additional components as it advises Microsoft, will work without problems. It is a pity, what about it there is no mention on a site of technical support of Microsoft, probably, they and didn’t think of such possibility? Good luck!


https://nikitushkinandrey.wordpress.com/2012/07/17/isolation-of-domains-on-the-ms-windows-server-platforms-and-not-only/