Network Access Protection (NAP) is a Microsoft technology for controlling network access of a computer, based on its health. It was first included in

Windows Vista Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, released five years earlier, which was then the longest time span between successive releases of Microsoft W ...

and

Windows Server 2008 Windows Server 2008, codenamed "Longhorn Server" (alternatives: "Windows Vista Server" or "Windows Server Vista"), is the seventh major version of the Windows NT operating system produced by Microsoft to be released under the Windows Server b ...

and backported to Windows XP Service Pack 3. With NAP, system administrators of an organization can define policies for system health requirements. Examples of system health requirements are whether the computer has the most recent operating system updates installed, whether the computer has the latest version of the anti-virus software signature, or whether the computer has a host-based firewall installed and enabled. Computers with a NAP client will have their health status evaluated upon establishing a network connection. NAP can restrict or deny network access to the computers that are not in compliance with the defined health requirements. NAP was

deprecated Deprecation is the discouragement of use of something human-made, such as a term, feature, design, or practice. Typically something is deprecated because it is claimed to be inferior compared to other options available. Something may be deprec ...

in Windows Server 2012 R2 and removed from Windows Server 2016.

Overview

Network Access Protection Client Agent makes it possible for clients that support NAP to evaluate software updates for their statement of health. NAP clients are computers that report their system health to a NAP enforcement point. A NAP enforcement point is a computer or device that can evaluate a NAP client's health and optionally restrict network communications. NAP enforcement points can be IEEE 802.1X-capable switches or VPN servers,

DHCP The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a clie ...

servers, or Health Registration Authorities (HRAs) that run

or later. The NAP health policy server is a computer running the Network Policy Server (NPS)

service Service may refer to: Activities * Administrative service, a required part of the workload of university faculty * Civil service, the body of employees of a government * Community service, volunteer service for the benefit of a community or a ...

in Windows Server 2008 or later that stores health requirement policies and provides health evaluation for NAP clients. Health requirement policies are configured by administrators. They define criteria that clients must meet before they are allowed undeterred connection; these criteria may include the version of the operating system, a personal firewall, or an up-to-date antivirus program. When a NAP-capable client computer contacts a NAP enforcement point, it submits its current health state. The NAP enforcement point sends the NAP client's health state to the NAP health policy server for evaluation using the

RADIUS In classical geometry, a radius (: radii or radiuses) of a circle or sphere is any of the line segments from its Centre (geometry), center to its perimeter, and in more modern usage, it is also their length. The radius of a regular polygon is th ...

protocol. The NAP health policy server can also act as a RADIUS-based authentication server for the NAP client. The NAP health policy server can use a health requirement server to validate the health state of the NAP client or to determine the current version of software or updates that need to be installed on the NAP client. For example, a health requirement server might track the latest version of an antivirus signature file. If the NAP enforcement point is an HRA, it obtains health certificates from a

certification authority In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. Thi ...

for NAP clients that it deems to be compliant with the relevant requirements. NAP clients can be placed on a restricted network if they are deemed non-compliant. The restricted network is a logical subset of the intranet and contains resources that allow a noncompliant NAP client to correct its system health. Servers that contain system health components or updates are known as remediation servers. A noncompliant NAP client on the restricted network can access remediation servers and install the necessary components and updates. After remediation is complete, the NAP client can perform a new health evaluation in conjunction with a new request for network access or communication.

NAP client support

A NAP client ships with

Windows 7 Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on July 22, 2009, and became generally available on October 22, ...

Windows 8 Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on August 1, 2012, made available for download via Microsoft ...

and Windows 8.1 but not with

Windows 10 Windows 10 is a major release of Microsoft's Windows NT operating system. The successor to Windows 8.1, it was Software release cycle#Release to manufacturing (RTM), released to manufacturing on July 15, 2015, and later to retail on July 2 ...

. A limited NAP client is also included in Windows XP Service Pack 3. It has no MMC snap-in and does not support AuthIP-based IPsec enforcement. As such, it can only be managed via a command-line tool called netsh, and the IPsec enforcement is IKE-based only. Microsoft partners provide NAP clients for other operating systems such as

macOS macOS, previously OS X and originally Mac OS X, is a Unix, Unix-based operating system developed and marketed by Apple Inc., Apple since 2001. It is the current operating system for Apple's Mac (computer), Mac computers. With ...

and

Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...

References

External links

Microsoft's Network Access Protection Web page

Microsoft's Network Access Protection Web page on Microsoft Technet

NAP Blog on Microsoft Technet

Microsoft's Network Access Protection Design Guide on Microsoft Technet

Microsoft's Network Access Protection Deployment Guide on Microsoft Technet

Microsoft's Network Access Protection Troubleshooting Guide on Microsoft Technet
{{Windows Components Microsoft Windows security technology Windows Server

Overview

NAP client support

See also

References

External links