W2K domain IPsec implementation

Hi,

I'm working on the implementation of IPsec in a Windows 2000 enviroment.

The eviroment is highly secured, almost no rights in on the users' desktop.
IPsec is set up on the domain level GPO but when signing on to the
machine with a domain user account and checking the status in the
ipsecmon.exe tool it tells you IPsec is not enabled on the machine.

When I add the domain user to the local Administrators group it will
work, and ipsecmon.exe will tell you IPsec is enabled.
But when the domain user is in the Power User group it won't be active.
Since this is an highly secure enviroment we cannot leave the domain user in
the Administrator group.

Look's to me this has to do with the right on the machine?
But I cannot figure out where these rights are really applied or needed when
it comes to IPsec policies.

If anyone can help me or give me some suggestions to make this work, please
do so.

Thanks

Evening,

It does seem like a rights issue. Is the network a complete 2000 environment
(2000 server and workstations?)

Some of these links may be helpful:

Using IPSec in Windows 2000 and XP Part One:
http://www.securityfocus.com/infocus/1519

Using IPSec in Windows 2000 and XP Part Two:
http://www.securityfocus.com/infocus/1526

Using IPSec in Windows 2000 and XP Part Three:
http://www.securityfocus.com/infocus/1528

Step by Step Guide to IPSec from Technet
http://www.microsoft.com/technet/tre...at/ispstep.asp

Configure IPSec Tunneling in Windows 2000
http://support.microsoft.com/support.../q252/7/35.asp

Also on the three part "Using IPSec..." article there are some helpful links
at the end of each article. I know it isn't really an answer but I hope it
helps in some way.


--
Louis Vitiello Jr.
------------------------------
MCSE, MCSA, MCP, A+/N+
ERCP XP Pro / Net Concepts



"MWest" <(E-Mail Removed)> wrote in message
news:BDF30776-FEE9-4A8D-900B-(E-Mail Removed)...
> Hi,
>
> I'm working on the implementation of IPsec in a Windows 2000 enviroment.
>
> The eviroment is highly secured, almost no rights in on the users'
> desktop.
> IPsec is set up on the domain level GPO but when signing on to the
> machine with a domain user account and checking the status in the
> ipsecmon.exe tool it tells you IPsec is not enabled on the machine.
>
> When I add the domain user to the local Administrators group it will
> work, and ipsecmon.exe will tell you IPsec is enabled.
> But when the domain user is in the Power User group it won't be active.
> Since this is an highly secure enviroment we cannot leave the domain user
> in
> the Administrator group.
>
> Look's to me this has to do with the right on the machine?
> But I cannot figure out where these rights are really applied or needed
> when
> it comes to IPsec policies.
>
> If anyone can help me or give me some suggestions to make this work,
> please
> do so.
>
> Thanks
>

Of you can switch to another VPN - ViPNet

More information here: www.vpnsolution.info

MWest wrote:
> Hi,
>
> I'm working on the implementation of IPsec in a Windows 2000 enviroment.
>
> The eviroment is highly secured, almost no rights in on the users' desktop.
> IPsec is set up on the domain level GPO but when signing on to the
> machine with a domain user account and checking the status in the
> ipsecmon.exe tool it tells you IPsec is not enabled on the machine.
>
> When I add the domain user to the local Administrators group it will
> work, and ipsecmon.exe will tell you IPsec is enabled.
> But when the domain user is in the Power User group it won't be active.
> Since this is an highly secure enviroment we cannot leave the domain user in
> the Administrator group.
>
> Look's to me this has to do with the right on the machine?
> But I cannot figure out where these rights are really applied or needed when
> it comes to IPsec policies.
>
> If anyone can help me or give me some suggestions to make this work, please
> do so.
>
> Thanks