Ubani Ongangena Ngocingo? Ukuhlolwa kwe-msNPAllowDialin Ngaphambi Kokufinyelela kwi-VPN

Iphasiwedi ilungile, i-akhawunti iseqenjini le-VPN, kodwa ukuxhumana kusalelwa ngomlayezo ongasho noma yimuphi umgomo. Lapho lokhu kwenzeka kuseva yokufinyelela kude ye-Windows, indawo yokuqala engiyibukayo akuwona umthetho we-NPS, kodwa isici esisodwa se-Active Directory okungekho muntu osivulayo: msNPAllowDialin, okungukuthi inani elingemva kwethebhu ye-Dial-in. Inezimo ezintathu, futhi eyesithathu inikeza isinqumo buthule kwenye indawo. Ezikhathini eziningi akekho umuntu owasishintsha ngenhloso: i-akhawunti yayikopishwe kusifanekiso, noma yenziwa umbhalo wesikripthi owabhala ukwenqaba okucacile eminyakeni edlule futhi ongakaze uphinde uhlolwe.

Ukwenqaba kungenzeka ngaphambi kokuba umgomo ufundwe

I-Windows ihlola imvume yocingo ye-akhawunti ngenkathi yakha isinqumo sokugunyaza, ngakho ukwenqaba okucacile kuqeda ingxoxo kusenesikhathi. Okubonayo kuklayenti ukwehluleka kokugunyaza okuvamile, ngezinye izikhathi ngemva kokuqedwa kokushintshana kwezitifiketi, futhi yingakho abantu bechitha intambama behlola imininingwane yokungena eyayingakaze ibe yinkinga.

Icala elihlukile lihlanya ngendlela efanayo. I-akhawunti okungakaze kusethwe kuyo ifulegi ingase ixhumeke ngempumelelo ngoba umgomo wawuvuma, bese leyo akhawunti iyeka ukuxhumeka lapho othile ehlela umthetho we-NPS ngesizathu esingahlobene. Akukho kwesinye salezi zigameko esibonakala ngaphandle njengokushintsha kwemvume yocingo.

Izimo ezintathu, futhi eyesithathu ayibonakali

TRUE ivumela ucingo, FALSE ilwenqaba, futhi NULL isho ukuthi i-akhawunti izuza impendulo yayo kumgomo wokufinyelela kude noma ekugunyazweni kwe-NPS. I-GUI ibonisa leso simo sesithathu "Control access through NPS Network Policy", futhi sifundeka njengebhokisi elingamakwanga kunokuba kube isinqumo.

Yingakho ukubala abasebenzisi abavunyelwe kusuka kukhonsoli akusho cishe lutho. I-akhawunti ezuzwe njengefa ingase ivunyelwe namuhla futhi yenqatshwe kusasa ngaphandle kokuthi i-akhawunti ithintwe, futhi FALSE i-akhawunti isengaxhumeka kuseva umgomo wayo ohlelwe ukuba ungayinaki izakhiwo zocingo zomsebenzisi. Funda isici kanye nomgomo kanyekanye, uma kungenjalo uhlola ingxenye yesinqumo.

Khipha amafulegi ngaphandle kokulahlekelwa ama-akhawunti ezuzwe njengefa

Gijimisa ukukhipha kusuka kusilawuli sesizinda, noma kusuka esiteshini somsebenzi esinemojuli ye-Active Directory, futhi gcina ifayela eliluhlaza njengobufakazi esikhundleni sokuphinda ubhale isifinyezo:

Get-ADUser -Filter * -Properties msNPAllowDialin, LastLogonDate |
  Select-Object SamAccountName, Enabled, msNPAllowDialin, LastLogonDate |
  Sort-Object SamAccountName |
  Export-Csv -NoTypeInformation .\dialin.csv

Isihlungi esisodwa se-LDAP kulula ukusinamathisela kurekhodi yoshintsho. Lesi sibuyisela kuphela izimvume ezicacile:

dsquery * -Filter "(&(objectCategory=person)(objectClass=user)(msNPAllowDialin=TRUE))" -Attr sAMAccountName

Bese ubuza futhi ngaphandle kwesigatshana socingo futhi ufune ama-akhawunti angenalo inani. Yilawo azuzwe njengefa, ngokuvamile iqembu elikhulu kusizinda, futhi ukuwadlula kushintsha ukuhlolwa kube uhlu lwabantu abambalwa umuntu akhumbula ukubasetha ngesandla.

Hlukanisa ifulegi nokufinyelela kweqembu kanye nempilo ye-akhawunti

Isici siphendula umbuzo owodwa: ingabe le akhawunti ingashaya ucingo. Akusho lutho mayelana nokuthi umuntu usasebenza lapha, ukuthi i-akhawunti ivuliwe, noma ukuthi iphasiwedi yabiwe ilele kumbhalo wedeski losizo. Hlanganisa ukukhipha nesimo sokuvulwa, usuku lokungena kokugcina kanye nobulungu beqembu elinikeza ukufinyelela kuseva.

Okwenzayo kuncike ezinhlanganisweni. I-akhawunti evaliwe ene-TRUE iwumsindo nje. I-akhawunti evuliwe ene-TRUE engakangeni unyaka iyisisulu sokususwa. Kodwa i-akhawunti ezuzwe njengefa eqenjini le-VPN okungekho muntu ongayichaza iyitholakalo ebalulekile ngempela, ngoba akukho silungiselelo esisodwa esibhala ukuthi yanikezwa ngani.

Yifunde kusilawuli sesizinda i-seva ye-VPN eqinisekisa ngayo ngempela. Ukubambezeleka kokuphindwa kungabonisa inani iseva eselishintshile, futhi ukuhlolwa okucaphuna inani le-DC eliphelelwe yisikhathi kuzophikiswa ngesikhathi umuntu eqinisekisa futhi.

Shintsha i-akhawunti eyodwa futhi ufake ubufakazi bokuthi ushintsho lwafika

Ukuze ususe ukufinyelela, setha isici ku-FALSE esikhundleni sokusula. Ukusula kubuyisela i-akhawunti ekuzuzweni komgomo, okungase iphinde iyivume lapho ixhumana ngokulandelayo, futhi ushintsho lubukeka njengokulungisa kuyilapho empeleni kuyisinqumo esihlukile:

dsmod user "CN=Jane Doe,OU=Staff,DC=corp,DC=example" -allowDialin no
Set-ADUser -Identity jdoe -Clear msNPAllowDialin

Umgqa wesibili ukusethwa kabusha kokuzuzwa njengefa, kugcinwe ngokwehlukana ngamabomu ukuze kimina kungahlanganiswa imisebenzi emibili. Bese uqinisekisa kusuka kuseshini yesibili, ufunda isici futhi, futhi uhlola izehlakalo zokubalwa ze-NPS zokwenqaba esikhundleni sokuthemba ukuvuselelwa kukhonsoli.

Ekugcineni, bhala ukuthi iyiphi indlela ephethe isinqumo kusevisi ngayinye yokufinyelela kude. Uma umgomo ungayinaki izakhiwo zocingo zomsebenzisi, isimo seqembu siyigunya futhi isici siyisiphakamiso kuphela kuleyo sevisi. Amasevisi amabili esizindeni esisodwa angaphendula ngokuhlukile ngokusemthethweni, futhi irekhodi lokubuyekezwa kufanele lisho lokho emgqeni owodwa ngesevisi ngayinye.

Umphumela ophuma phambili ekuhlolweni mfushane: ubani ongaxhumeka, ngayiphi indlela, wahlolwa nini, ngubani. Ifulegi locingo linikeza izimpendulo ezimbili zokuqala; okusele kunikezwa kuphela ukubuyekezwa komgomo.