How to require computer authentication when accessing windows domain network shares

Question

I have a network containing a mixed collection of Windows domain and workgroup computers.

Currently, the workgroup computers can access file/folder shares hosted on domain computers if the user provides valid domain credentials when connecting. I need to make this impossible.

Is there a way to enforce a requirement that the client computers are members of the domain before granting them access to domain network shares?

The domain controller is running Windows Server 2016 Standard.

I don't know what you try to accomplish with that policy, but I don't think it's possible. To my knowledge access rights are always validated for users, not computers. There could be a "new" way in the newer 2016 ADMX templates maybe, but I wouldn't bet on it. — Lenniey, Jan 17 '19 at 10:43
I've found a similar question in another forum https://goo.gl/D4bVbb the top answer states "this sort of thing is trivial if the server OS is Windows Server 2012 R2 or Windows Server 2016", but unfortunately doesn't go into any detail. — Mikuso, Jan 17 '19 at 11:02

score 0 · Answer 1 · answered Jan 17 '19 at 13:49

0

I had a similar situation a few years ago and I remember the solution was to block the computers with the firewall. I don't remember if I would deny access to certain addresses/ranges [when coming in on port 445] or grant access to certain addresses/ranges and deny all others. But I do remember that I did it with the firewall, not permissions or policies. So, take a look at the firewall, if you play around with it a little bit you should be able to make it work.

answered Jan 17 '19 at 13:49

Larryc

315
1
5

There are firewall options to only accept encrypted traffic, I've never used this technology but I think it might have the desired effect. – Harry Johnston Jan 17 '19 at 21:21
Create a new inbound rule permitting TCP port 445. – Larryc Jan 18 '19 at 02:32
then specify those machines you want to allow on the remote computers tab. – Larryc Jan 18 '19 at 02:40

score 0 · Answer 2 · answered Jan 18 '19 at 10:48

What you want is called 'Domain Isolation' It is a bit complex to implement.

Key element of domain isolation is a set of connection security rules in the Windows firewall, distributed by GPO that enforce domain members to authenticate before accepting connections. My advise is to first experiment in a lab: it is easy to have 'to much isolation' and end up with a domain or machines that cannot be used at all. I've been there, in a lab fortunately...

There's a lot of information on domain isolation. You can start reading here: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example

How to require computer authentication when accessing windows domain network shares

2 Answers2