We have setup a lab to evaluate the Windows Server 2008 NAP role work with 802.1x.
I have two questions:
1. How to determine a computer is NAP-capable or non-NAP-capable?
- Non-NAP-capable computer. A computer that cannot provide its health status to NAP server components. A computer that has NAP agent installed but not running is also considered non-NAP-capable.
- a non-Microsoft OS like Unix/Linux/Mac is non-NAP capable for sure.
- a computer running with Windows XP pre-SP3 (no NAP agent/client) is non-NAP capable.
- a computer running Windows XP SP3/Vista/Win7, but not start NAPAgent service, is non-NAP capable.
From NAP server side, when it will know the supplicant is a NAP or non-NAP capable? It's during detecting through ' Connection Request Policies ' or ' Network Policies ' or somewhere else?
2. Is that possible to check a non-NAP capable computer's health status?
In my case, we have most of workstations joined domain, a few don't join domain for some reasons. A workgroup computer running OS - Windows 7, also start NAP service, setup MAC Address Bypass both on Cisco switch and NAP, create AD username with this specific MAC Address and set password as MAC also, create connection request and network bypass policies only with MAC(User Group) filter in conditions Tab.
If not add Health Policies, the bypass works fine. But after added any Health Policies, the request will not match the health check, it will skip the MAC Bypass policy and goto following non-NAP capable policy, which means this computer is not recognized as a NAP capable computer.
So looks like it's not possible to check health status on non-NAP capable computer? Right?
The interesting thing here is this win7 with NAP service started is supposed to be a NAP-capable supplicant, but NAP thinks it's a non-NAP. I can't find out the reason.
Any reply will be appreciate.
Regards,
Randy Zhong, MCSA/MCDBA/MCSE/MCBMSS@CRM
