Microsoft Windows Server 2003 Network Access Quarantine Control
The Network Access Quarantine Control feature of Microsoft® Windows Server™ 2003 delays normal remote
access to a private network until the configuration of the remote access computer has been examined and
validated by an administrator-provided script. This paper describes the components of Network Access Quarantine
Control, how it works, and how to deploy it using Windows Server 2003 remote access servers, the Connection
Manager Administration Kit, and, optionally, Internet Authentication Service...
Microsoft Windows Server 2003 Network Access
Quarantine Control
Microsoft Corporation
Published: March 2003
Updated: October 2003
Abstract
The Network Access Quarantine Control feature of Microsoft® Windows Server™ 2003 delays normal remote
access to a private network until the configuration of the remote access computer has been examined and
validated by an administrator-provided script. This paper describes the components of Network Access Quarantine
Control, how it works, and how to deploy it using Windows Server 2003 remote access servers, the Connection
Manager Administration Kit, and, optionally, Internet Authentication Service.
Microsoft® Windows Server™ 2003 White Paper
The information contained in this document represents the current view of
Microsoft Corporation on the issues discussed as of the date of
publication. Because Microsoft must respond to changing market
conditions, it should not be interpreted to be a commitment on the part of
Microsoft, and Microsoft cannot guarantee the accuracy of any
information presented after the date of publication.
This document is for informational purposes only. MICROSOFT MAKES
NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE
INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the
user. Without limiting the rights under copyright, no part of this document
may be reproduced, stored in or introduced into a retrieval system, or
transmitted in any form or by any means (electronic, mechanical,
photocopying, recording, or otherwise), or for any purpose, without the
express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights,
or other intellectual property rights covering subject matter in this
document. Except as expressly provided in any written license agreement
from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual
property.
© 2003 Microsoft Corporation. All rights reserved.
Microsoft, Active Directory, Windows, and Windows Server are either
registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
The names of actual companies and products mentioned herein may be
the trademarks of their respective owners.
Microsoft® Windows Server™ 2003 White Paper
Contents
Contents..................................................................................................................................3
Introduction.............................................................................................................................1
Components of Windows Remote Access.............................................................................2
Components of Network Access Quarantine Control............................................................3
Quarantine-compatible Remote Access Clients.................................................................3
Quarantine-compatible Remote Access Server.................................................................4
Quarantine-compatible RADIUS Server (Optional)............................................................5
Quarantine Resources.......................................................................................................5
Accounts Database............................................................................................................5
Quarantine Remote Access Policy.....................................................................................6
How Network Access Quarantine Control Works................................................................7
How to Deploy Network Access Quarantine Control...........................................................9
Creating Quarantine Resources............................................................................................9
Creating a Script or Program that Validates Client Configuration........................................10
Installing Rqs.exe on Remote Access Servers....................................................................11
Creating a New Quarantine CM Profile with Windows Server 2003 CMAK.........................12
Distributing the CM Profile for Installation on Remote Access Client Computers................16
Configuring a Quarantine Remote Access Policy................................................................16
Alternate Configurations......................................................................................................26
Using an Exception Remote Access Policy.........................................................................26
Mitigating Application Delay in Quarantine Mode................................................................26
Using Only a Quarantine Session Timeout......................................................................27
Immediate Notification.....................................................................................................27
Global Dispersion of Quarantine Resources.......................................................................27
Appendix A - Sample Quarantine Script.............................................................................29
Appendix B – Network Access Quarantine Control Requirements..................................31
Summary................................................................................................................................32
Related Links.........................................................................................................................33
Introduction
Typical remote access connections only validate the credentials of the remote access user. Therefore,
the computer used to connect to a private network can often access network resources even when its
configuration does not comply with organization network policy. For example, a remote access user
with valid credentials could connect to a network with a computer that does not have the following:
• The correct service pack or the latest security patches installed.
• The correct antivirus software and signature files installed.
• Routing disabled. A remote access client computer with routing enabled might pose a security risk,
providing an opportunity for a malicious user to access corporate network resources through the client
computer, which has an authenticated connection to the private network.
• Firewall software installed and active on the Internet interface.
• A password-protected screensaver with an adequate wait time.
Despite the efforts made within organizations to ensure that computers used internally comply with
network policy, those used from employee’s homes for remote access can still present significant risk to
the network.
Network Access Quarantine Control, a new feature in the Windows Server 2003 family, delays normal
remote access to a private network until the configuration of the remote access computer has been
examined and validated by an administrator-provided script. When a remote access computer initiates a
connection to a remote access server, the user is authenticated and the remote access computer is
assigned an IP address. However, the connection is placed in quarantine mode, with which network
access is limited. The administrator-provided script is run on the remote access computer. When the
script notifies the remote access server that it has successfully run and the remote access computer
complies with current network policies, quarantine mode is removed and the remote access computer is
granted normal remote access.
The quarantine restrictions placed on individual remote access connections consists of the following:
• A set of quarantine packet filters that restrict the traffic that can be sent to and from a quarantined
remote access client.
• A quarantine session timer that restricts the amount of time the client can remain connected in
quarantine mode before being disconnected.
You can use either restriction, or both, as needed.
Network Access Quarantine Control is not a security solution. It is designed to help prevent computers
with unsafe configurations from connecting to a private network; not to protect a private network from
malicious users who have obtained a valid set of credentials.
To understand the components of Network Access Quarantine Control and how it works, we will first
review a normal Windows-based remote access configuration and then examine a quarantine
configuration.
Windows Server 2003 Network Access Quarantine Control 1
Components of Windows Remote Access
Figure 1 shows the components of Windows remote access when Remote Authentication Dial-In User
Service (RADIUS) authentication is being used.
Figure 1 Components of Windows remote access
This configuration consists of the following components:
• Remote access clients
Computers running a Windows operating system that create either a dial-up or virtual private
network connection to the remote access server. The remote access client can use either a
manually configured connection or a Connection Manager (CM) profile.
• Remote access server
A computer running a member of the Windows 2000 Server or Windows Server 2003 families and
the Routing and Remote Access service configured for the Windows or RADIUS authentication
provider.
• RADIUS server (optional)
A computer running a member of the Windows 2000 or Windows Server 2003 families and the
Internet Authentication Service (IAS). The use of a RADIUS server is optional and is only required
when the remote access server is configured to use RADIUS as the authentication provider.
• Accounts database
For Windows 2000 or Windows Server 2003-based networks, the Active Directory® directory
service is used as the accounts database, which stores user accounts and their dial-in properties.
• Remote access policy
On the remote access server running Routing and Remote Access or the IAS server, a remote
access policy that provides authorization and connection constraints is configured for remote
access connections.
Windows Server 2003 Network Access Quarantine Control 2
Components of Network Access Quarantine Control
Figure 2 shows the components of Windows remote access for Network Access Quarantine Control
when RADIUS is being used as the authentication provider.
Figure 2 Components of Windows remote access for Network Access Quarantine Control
This configuration consists of the following components:
• Quarantine-compatible remote access clients
• Quarantine-compatible remote access server
• Quarantine-compatible RADIUS server (optional)
• Quarantine resources
• Accounts database
• Quarantine remote access policy
Quarantine-compatible Remote Access Clients
The remote access client must be a computer running one of the following operating systems:
• Windows Server 2003
• Windows XP Professional
• Windows XP Home Edition
• Windows 2000
• Windows Millennium Edition
• Windows 98 Second Edition
These versions of Windows support CM profiles that are created with the Connection Manager
Administration Kit (CMAK) provided in Windows Server 2003. The CM profile contains the following:
• A post-connect action that runs a network policy requirements script.
This is configured when the CM profile is created with CMAK.
Windows Server 2003 Network Access Quarantine Control 3
• A network policy requirements script.
This script performs validation checks on the remote access client computer to verify that it
conforms to network policies. It can be a custom executable file or as simple as a command file
(also known as a batch file). When the script has run successfully and the connecting computer has
satisfied all of the network policy requirements (as verified by the script), the script runs a notifier
component (an executable) with the appropriate parameters.
If the script does not run successfully, it should direct the remote access user to a quarantine
resource such as an internal Web page, which describes how to install the components that are
required for network policy compliance.
• A notifier component
The notifier component sends a message that indicates a successful execution of the script to the
quarantine-compatible remote access server. You can use your own notifier component or you can
use Rqc.exe, which is provided with the Windows Server 2003 Resource Kit.
With these components installed, the remote access client computer uses the CM profile to perform
network policy requirements tests and indicate its success to the remote access server as part of the
connection setup.
Notes Because quarantine network access control introduces a delay in obtaining normal remote access,
applications that run immediately after the connection is complete might encounter problems. For ways to
reduce this delay or otherwise mitigate the impact to applications, see "Alternate configurations" in this
paper.
The previous discussion describes using a separate script and notifier component. For a custom script and
notifier component, it is possible to combine them into a single component.
It is possible to use a third-party dialer program instead of a CM profile, as long as there is a way to
configure a post-connect action to run the quarantine script and to embed the script and notifier component
with the dialer or otherwise install the script and notifier component on the remote access client.
Quarantine-compatible Remote Access Server
A quarantine-compatible remote access server requires the following:
• A computer running a member of the Windows Server 2003 family and Routing and Remote Access,
which supports the use of a listener component and the MS-Quarantine-IPFilter and MS-Quarantine-
Session-Timeout RADIUS vendor-specific attributes (VSAs) to enforce quarantine settings.
• A listener component
This component listens for messages from quarantine-compatible remote access clients, which
indicate that their scripts have been run successfully. You can create your own custom listener
component (matched with your own custom notifier component), or you can install the Remote
Access Quarantine Agent service (Rqs.exe) from the Windows Server 2003 Resource Kit.
If you create your own listener component, it must be designed to listen for a message from the
notifier component and use the MprAdminConnectionRemoveQuarantine() application
programming interface (API) to remove the quarantine restrictions from the remote access
Windows Server 2003 Network Access Quarantine Control 4
connection. For more information, see the Microsoft Developer Network at
http://msdn.microsoft.com/.
With these components installed, the remote access server computer can use quarantine mode for
connecting remote access clients and listen for notifier messages, indicating that they have satisfied
network policy requirements and can be taken out of quarantine mode.
If you are using Rqc.exe and Rqs.exe, the notification message sent by Rqc.exe contains a text string
that indicates the version of the quarantine script being run. This string is configured for Rqc.exe as part
of its command-line parameters, as run from the quarantine script. Rqs.exe compares this text string to
a set of text strings stored in the registry of the remote access server. If there is a match, the quarantine
conditions are removed from the connection. For an example of how to configure the quarantine script
and Rqs.exe for a matching script version string, see "How to deploy Network Access Quarantine
Control" in this paper.
Note The notification sent by Rqc.exe is not encrypted or authenticated and can be spoofed by a malicious
client.
Routing and Remote Access can be configured with either the Windows or RADIUS authentication
provider. If Routing and Remote Access is configured with the Windows authentication provider, then
quarantine-compatible RADIUS servers are not required and you configure the quarantine attributes for
a remote access policy that is stored on the remote access server. The configuration shown in Figure 2
assumes that Routing and Remote Access is configured with the RADIUS authentication provider.
Quarantine-compatible RADIUS Server (Optional)
If Routing and Remote Access on the remote access server is configured with the RADIUS
authentication provider, a quarantine-compatible RADIUS server requires a computer running
Windows Server 2003 and IAS, which supports the configuration of the MS-Quarantine-IPFilter and MS-
Quarantine-Session-Timeout RADIUS vendor-specific attributes (VSAs). The MS-Quarantine-IPFilter
attribute is for the quarantine filters. The MS-Quarantine-Session-Timeout attribute is for the quarantine
session timer.
Quarantine Resources
Quarantine resources consists of servers that a remote access client in quarantine mode can access to
perform name resolution (such as Domain Name System [DNS] servers), obtain the latest version of the
CM profile (file servers with anonymous access allowed), or access instructions and components
needed to make the remote access client comply with network policies (Web servers with anonymous
access allowed). Anonymous access to file and Web resources is needed because, although the
remote access user had correct credentials to create the remote access connection, they might not be
using correct domain credentials to access protected file and Web resources.
Accounts Database
For Windows Server 2003 or Windows 2000-based networks, Active Directory is used as the accounts
database to store user accounts and their dial-in properties. You can also use Windows NT 4,0
domains.
Windows Server 2003 Network Access Quarantine Control 5
Quarantine Remote Access Policy
You need to configure a quarantine remote access policy with the required conditions for remote access
connections, but with profile settings that can specify the MS-Quarantine-IPFilter or MS-Quarantine-
Session-Timeout attributes (configured on the Advanced tab of the profile).
You can use the MS-Quarantine-IPFilter attribute to configure input and output packet filters to allow
only the following:
• The traffic generated by the notifier component. If you are using Rqc.exe and Rqs.exe with its default
port, then configure a single input packet filter to allow only traffic to TCP port 7250.
• The traffic needed for Dynamic Host Configuration Protocol (DHCP) messages between the remote
access client and the remote access server.
• The traffic needed to access the quarantine resources. This includes filters that allow the remote access
client to access name resolution servers (such as DNS servers), file shares, or Web sites.
The packet filters configured for the MS-Quarantine-IPFilter attribute provide the quarantine of the
remote access client until the notifier component on the remote access client indicates that the
computer is in compliance with network policies.
You can use the MS-Quarantine-Session-Timeout attribute to specify how long the remote access
server must wait to receive the notification that the script has run successfully before terminating the
connection.
If the quarantine remote access policy is the only policy for remote access connections, then all of your
remote access clients must be using the quarantine CM profile in order to validate the remote access
computer configuration and send the notification to the remote access server. Remote access clients
that do not install and use the quarantine CM profile are unable to obtain a normal remote access
connection. They are placed in quarantine mode, and because they do not run the script or send the
notification, are either left in quarantine mode (if no quarantine timer has been configured) or are left in
quarantine mode until the quarantine timer expires (if a quarantine timer has been configured), at which
time they are automatically disconnected.
If you want to support a mixture of quarantine clients and non-quarantine clients, you can create a
group to contain the user accounts of the non-quarantine clients and create a new group-based remote
access policy that does not use the quarantine restrictions. For more information, see "Using an
exception remote access policy" in this paper.
Note Network Access Quarantine Control cannot be used for wireless or authenticated switch clients
because it requires the use of the Routing and Remote Access service and the ability to run a post-connect
script on the wireless or switch client. However, wireless and switch clients must have a domain account for
computer authentication and network policy compliance scripts can be run as part of the computer's startup
and domain logon sequence.
Windows Server 2003 Network Access Quarantine Control 6
How Network Access Quarantine Control Works
The following process describes how Network Access Quarantine Control works when the set of
components in Figure 2 and Rqc.exe and Rqs.exe and RADIUS authentication are used:
1. The user on the quarantine-compatible remote access client uses the installed quarantine CM
profile to connect with the quarantine-compatible remote access server.
2. The remote access client passes its authentication credentials to the remote access server.
3. The Routing and Remote Access service sends a RADIUS Access-Request message to the IAS
server.
4. The IAS server validates the authentication credentials of the remote access client and, assuming
that the credentials are valid, checks its remote access policies. The connection attempt matches
the quarantine policy.
5. The connection is accepted with quarantine restrictions. The IAS server sends a RADIUS Access-
Accept message that contains the MS-Quarantine-IPFilter and MS-Quarantine-Session-Timeout
attributes, among others. This example assumes that both attributes are configured in the
matching remote access policy.
6. The remote access client and remote access server complete the remote access connection,
which includes obtaining an IP address and other configuration settings.
7. The Routing and Remote Access service configures the MS-Quarantine-IPFilter and MS-
Quarantine-Session-Timeout settings on the connection. At this point, the remote access client can
only successfully send traffic that matches the quarantine filters and has up to the number of
seconds specified in MS-Quarantine-Session-Timeout to notify the remote access server that the
script has run successfully.
8. The CM profile runs the quarantine script as the post-connect action.
9. The quarantine script runs and verifies that the remote access client computer's configuration
complies with network policy requirements. If all the tests for network policy compliance pass, the
script runs Rqc.exe with its command-line parameters, one of which is a text string for the version
of the quarantine script included within the CM profile.
10. Rqc.exe
sends a notification to the remote access server, indicating that the script was successfully run.
The notification includes the quarantine script version string.
11. The
notification is received by the listener component (Rqs.exe). The notification traffic was allowed
because it matched the permitted traffic specified by the quarantine filters configured via the MS-
Quarantine-IPFilter attribute in the matching remote access policy.
12. The listener
component verifies the script version string in the notification message with those configured in the
registry and sends back either a message indicating that the script version was valid or a message
indicating that the script version was invalid.
Windows Server 2003 Network Access Quarantine Control 7
13. If the script
version was valid, the listener component calls the MprAdminConnectionRemoveQuarantine() API,
which causes the Routing and Remote Access service to remove the MS-Quarantine-IPFilter and
MS-Quarantine-Session-Timeout settings from the connection and configure the normal
connection constraints. At this point, the remote access client has normal access to the intranet.
14. The listener
component creates an event detailing the quarantined connection in the System event log.
Windows Server 2003 Network Access Quarantine Control 8
How to Deploy Network Access Quarantine Control
In the set of instructions that follow, the following assumptions are made:
• The notifier component is Rqc.exe, from the Windows Server 2003 Resource Kit
• The listener component is Rqs.exe, from the Windows Server 2003 Resource Kit
• The client dialer program is a CM profile created with the Windows Server 2003 CMAK
If you use a custom notifier component, listener component, or client dialer program, substitute their
configuration and deployment procedures as needed.
To deploy Network Access Quarantine Control, the basic steps (in order) are as follows:
1. Create quarantine resources
2. Create a script or program that validates client configuration
3. Install Rqs.exe on remote access servers
4. Create a new quarantine CM profile with Windows Server 2003 CMAK
5. Distribute the CM profile for installation on remote access client computers
6. Configure a quarantine remote access policy
Creating Quarantine Resources
To allow your remote access clients to access name server, Web server, or file server resources while
they are in quarantine mode, you must designate the servers and their resources that are available to
remote access clients. Quarantine resources consist of the following types of resources:
• Name resolution servers (such as DNS and Windows Internet Name Service [WINS] servers)
Allows resolution of DNS or NetBIOS names while the client is in quarantine mode. This is
important when you are referencing file servers, Web sites, or other types of resources by name.
For example, if the remote access client is directed to the Web page at
http://www.corpnet.example.com/remote_access_tshoot.asp to install components and the name
www.corpnet.example.com cannot be resolved, the client will be unable to access the Web site.
• File servers
Allows access to shares and files for components to install on remote access clients such as
updated virus signatures or CM profiles. The file share should allow anonymous access. The
Universal Naming Convention (UNC) addresses of file shares or files for designated quarantine
resources can be used in the quarantine script.
• Web servers
Allows access to Web pages containing instructions and links to components to install on remote
access clients. The Web pages should allow anonymous access. The Uniform Resource Locators
(URLs) to the quarantine Web pages can be used in the quarantine script.
When designating your quarantine resources, you can do one of the following:
Windows Server 2003 Network Access Quarantine Control 9
• Designate different servers on your intranet as quarantine resources, regardless of their location.
The advantage to this approach is that you can use existing servers to host quarantine resources,
taking advantage of underutilized servers. The disadvantage to this approach is that for each
quarantine resource, you might have to specify a different packet filter for the MS-Quarantine-
IPFilter attribute in the quarantine remote access policy. Microsoft recommends that you try to
minimize the number of filters configured in the MS-Quarantine-IPFilter attribute.
In this configuration, the following are recommended input packet filters:
• For Rqc.exe notifier traffic, destination TCP port 7250 (this is the default TCP port used by
Rqs.exe).
• For DHCP traffic, source UDP port 68 and destination UDP port 67 (this allows DHCPInform
messages to be received by the remote access server).
• For DNS traffic, destination UDP port 53. Alternately, you can also specify the IP address of a
specific DNS server.
• For WINS traffic, destination UDP port 137. Alternately, you can also specify the IP address of a
specific WINS server.
• For HyperText Transfer Protocol (HTTP) traffic, destination TCP port 80. Alternately, you can also
specify the IP address of a specific Web server.
• For file sharing traffic using NetBIOS over TCP/IP, destination TCP port 139. Alternately, you can
also specify the IP address of a specific file server.
• For file sharing traffic using direct hosting over TCP/IP, destination TCP port 445. Alternately, you
can also specify the IP address of a specific file server.
• Designate or place all your quarantine resources on a separate subnet.
The advantage to this approach is that, at a minimum, you only need to configure a single input or
output packet filter for your quarantine resources; a packet filter that specifies all traffic to the range
of IP addresses corresponding to the subnet ID of the quarantine resource subnet. The
disadvantage to this approach is that it requires you to configure a separate subnet and separate
servers just for quarantine access.
In this configuration, the following are recommended input packet filters:
• For Rqc.exe notifier traffic, destination TCP port 7250 (this is the default TCP port used by
Rqs.exe).
• For DHCP traffic, source UDP port 68 and destination UDP port 67 (this allows DHCPInform
messages to be received by the remote access server).
• For quarantine resource traffic (name resolution, file sharing, and Web), the IP address range
(destination IP address and subnet mask) of the quarantine subnet.
Creating a Script or Program that Validates Client Configuration
The quarantine script or program that you create can be an executable file (*.exe) or as simple as a
command file (*.cmd or *.bat). In the script, perform the set of tests to ensure that the remote access
Windows Server 2003 Network Access Quarantine Control 10
client complies with network policy. If all of the tests are successful, the script must run Rqc.exe with the
following parameters:
rqc ConnName TunnelConnName TCPPort Domain Username ScriptVersion
The command-line parameters of Rqc.exe are as follows:
• ConnName The name of the remote access connection on this host. The value of this parameter can
be inherited from the Connection Manager profile %DialRasEntry% variable (also known as a macro).
• TunnelConnName The name of the tunnel connection on this host. The value of this parameter can be
inherited from the Connection Manager profile %TunnelRasEntry% variable.
• TCPPort The TCP port used to send the notification message. The default TCP port used by Rqs.exe
is 7250. If you configure Rqs.exe to use a different TCP port than 7250, you must specify that TCP port
number here.
• Domain The domain of the connecting user. The value of this parameter can be inherited from the
Connection Manager profile %Domain% variable.
• Username The username of the connecting user. The value of this parameter can be inherited from the
Connection Manager profile %UserName% variable.
• ScriptVersion A text string that contains the script version. You can specify a text string using keyboard
characters, except that cannot use the "/0" character sequence.
For an example use of Rqc.exe in a quarantine script, see Appendix A.
If the remote access computer fails to pass the network policy compliance tests, the script can direct the
remote access user to a Web page that contains instructions about how to obtain the current set of
components (such as the latest virus signature file or the latest security patch). If the notification
response message indicates an invalid script version, the script can direct the remote access user to
install the latest CM profile from a file share or Web page.
Installing Rqs.exe on Remote Access Servers
The Remote Access Quarantine Agent service (Rqs.exe) must be installed on all Windows Server 2003
remote access servers, which is done by running the Rqs_setup.bat file from the Program
Files\Windows Server 2003 Resource Kit folder. Rqs_setup.bat copies the appropriate files and
modifies registry settings to install Rqs.exe as an auto-starting service.
Part of setting up Rqs.exe is configuring the script version strings, which must match the script version
string configured on the Rqc.exe command line as run from the quarantine script. Rqs.exe can be
configured to accept multiple script version strings, which are written to the registry of the remote
access server. For initial configuration, you can either modify the registry manually or you can modify
the Rqs_setup.bat file before running it, and have Rqs_setup.bat create the correct registry settings
during installation of Rqs.exe. For subsequent configuration of script version strings, you must manually
modify the registry.
The following procedure assumes that you are modifying Rqs_setup.bat before running it to configure
Rqs.exe for script version strings. To install and configure Rqs.exe on a Windows Server 2003 remote
access server, do the following:
1. Install the Windows Server 2003 Resource Kit tools on the remote access server.
Windows Server 2003 Network Access Quarantine Control 11
2. Use Notepad from the Accessories folder to open the file named Rqs_setup.bat from the Program
Files\Windows Server 2003 Resource Kit folder from the drive on which the Windows Server 2003
Resource Kit tools were installed.
3. Click Edit, then click Find. In Find what, type Version1\0, and then click OK.
4. The text cursor should be on a line that reads:
REM REG ADD %ServicePath% /v AllowedSet /t REG_MULTI_SZ /d Version1\0Version1a\0Test
5. To add a single script version string, remove "REM" from the beginning of the line and replace the
text "Version1\0Version1a\0Test" with the script version string specified in the Rqc.exe command
line of the quarantine script. For example, for the single script version string "QScript1.0a", the
modified line is:
REG ADD %ServicePath% /v AllowedSet /t REG_MULTI_SZ /d QScript1.0a
6. To add multiple script version strings, remove "REM" from the beginning of the line and replace the
text "Version1\0Version1a\0Test" with the series of script version strings, separated by "\0". For
example, to use the script version strings Script1, Script1a, and Script2, the modified line is:
REG ADD %ServicePath% /v AllowedSet /t REG_MULTI_SZ /d Script1\0Script1a\0Script2
In both cases, the script version strings are added to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rqs\AllowedSet.
7. Click File, and then click Save. Click File, then click Exit.
8. Run Rqs_setup /install in the Program Files\Windows Server 2003 Resource Kit folder from a
Command Prompt .
The Rqs_setup.bat file installs all needed files to the SystemRoot\System32\Ras folder.
Running the Rqs_setup.bat file does not automatically start the Remote Access Quarantine Agent
service. As the network administrator, you must decide the best time to start the service in relation to
the configuration of the Routing and Remote Access service. The Remote Access Quarantine Agent
service depends on the Routing and Remote Access service. However, when the Routing and Remote
Access service is restarted, the Remote Access Quarantine Agent service is not automatically
restarted. You must manually restart the Remote Access Quarantine Agent service.
To remove Rqs.exe, type Rqs_setup /remove at a Command Prompt.
To modify script version strings manually, use the Windows Registry Editor (Regedit.exe) to modify the
value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rqs\AllowedSet.
By default, Rqs.exe listens for notifications from Rqc.exe on TCP port 7250. To change the default TCP
port, create the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rqs\Port registry value
(REG_DWORD) and set it to the desired port. Make sure that the port you configure for Rqs.exe is the
same TCP port that Rqc.exe uses to send the notification.
Creating a New Quarantine CM Profile with Windows Server 2003 CMAK
A quarantine CM profile is just a normal remote access CM profile for dial-up or VPN access with the
following additions:
Windows Server 2003 Network Access Quarantine Control 12
• You must add a post-connect action to run the script or program you have created to check network
policy compliance and include the script or program within the profile. This is done on the Custom Actions
page of the CMAK Wizard.
• You must add the notification component to the profile. This is done on the Additional Files page of the
CMAK Wizard.
For more information about using custom actions in CMAK, see the topic titled "Incorporating custom
actions" in Windows Server 2003 Help and Support.
The following instructions provide an example of how to configure the post-connect action and add the
notification component to the profile. These instructions do not guide you step by step through the
creation of the entire profile. For more information about creating CM profiles, see
Windows Server 2003 Help and Support.
To configure the quarantine portions of the CM profile with the CMAK Wizard, do the following:
1. Proceed through the CMAK Wizard pages and configure as appropriate for your remote access
connections until the Custom Actions page is displayed, as shown in the following figure.
2. In Action type, click Post-connect, and then click New.
3. The New Custom Action dialog box is displayed, as shown in the following figure.
Windows Server 2003 Network Access Quarantine Control 13
4. In Description, type a descriptive title for the post-connection action.
5. In Program to run, type the name of the program or script file for network policy compliance
testing or click Browse to specify it.
6. In Parameters, type the set of command-line parameters that are passed to the program specified
in Program to run.
7. Select the Include the custom action program with this service profile check box. The
following figure shows an example for the Script.bat script file using the parameters
"%DialRasEntry% %TunnelRasEntry% %Domain% %UserName%". These parameters are CM
profile variables that are passed to the script file for use in making decisions within the script.
8. Click OK. An example is shown in the following figure.
Windows Server 2003 Network Access Quarantine Control 14
9. Add additional post-connect actions as needed.
10. Click Next.
11. Configure the
CM profile as needed, until the Additional Files page is displayed. This is shown in the following
figure.
12. Click Add. In
the Browse dialog box, specify the Rqc.exe file in the Program Files\Windows Server 2003
Resource Kit folder from the drive on which the Windows Server 2003 Resource Kit tools were
installed.
13. Click OK. The
addition of the Rqc.exe file to the CM profile is shown in the following figure.
Windows Server 2003 Network Access Quarantine Control 15
14. Add
additional files as needed.
15. Complete the
remainder of the CMAK Wizard to create the quarantine CM profile.
Distributing the CM Profile for Installation on Remote Access Client Computers
After the quarantine CM profile has been created, it must be distributed and installed on all your remote
access client computers. The profile itself is an executable file that must be run on the remote access
client to install the profile and configure the quarantine network connection. There are many methods to
distribute and run the profile on remote access client computers:
• Send out the profile executable file or a link to the profile in an email message to your remote access
users with instructions to run the profile that installs the quarantine connection.
• Place the profile executable on a Web page and instruct your users to run the profile that installs the
quarantine connection.
• Have the profile run as part of a startup script or the domain login script.
In addition to distributing the profile to your remote access users, you should place the profile on a file
share or Web site corresponding to your quarantine resources. Once placed there, remote access
clients who do not have the current profile installed and are in quarantine mode can be instructed to
install the latest profile and then reconnect.
Configuring a Quarantine Remote Access Policy
If Routing and Remote Access is configured with the Windows authentication provider, configure the
quarantine remote access policy on the remote access server using the Routing and Remote Access
snap-in. If Routing and Remote Access is configured with the RADIUS authentication provider,
configure the quarantine remote access policy on the IAS server using the Internet Authentication
Service snap-in.
Windows Server 2003 Network Access Quarantine Control 16
To configure a quarantine remote access policy, first create the remote access policy for normal remote
access connections using a common remote access policy configuration. Modify the newly created
remote access policy for your custom settings. Then, add the MS-Quarantine-Session-Timeout and MS-
Quarantine-IPFilter attributes as needed on the Advanced tab of the remote access policy profile
properties.
The following is an example of creating a quarantine remote access policy for VPN remote access
connections that does not use any custom settings or additional vendor-specific attributes and all files
for installation on the client are available through Web pages:
1. Inthe console tree, right-click Remote Access Policies, and then click New Remote Access
Policy.
2. On the Welcome to the New Remote Access Policy Wizard page, click Next.
3. On the Policy Configuration Method page, type Quarantined VPN remote access connections
in Policy name. This is shown in the following figure.
4. Click Next. On the Access Method page, select VPN. This is shown in the following figure.
Windows Server 2003 Network Access Quarantine Control 17
