AD Connector + Policy

[far182]

I found an issue. I am not sure how to solve.

We have setup Untangle with the AD Connector and Policy.

• People who are logged in and are users of Active Directory go into a rack called "Employees".
• Servers (which have an IP range of 192.168.1.10-15) go through their own rack called "servers".
• All other devices that don't fit into the above go into the "default" rack.

The above works perfectly for servers and workstations. What it doesn't work well with is Laptops. Laptops use "cached credentials" for the Microsoft Windows AD network. If they didn't, laptop users would never be able to login to their laptops when away from the office.

So the problem happens when a user logs into their laptop without being connected to the network. Then.... they connect to the corporate network (like locally on premise). When this happens the Untangle login script is never run. Without running the login script, the laptop user is now not going through their correct rack.

Anyone else face this problem yet? If not, I bet there has to be plenty of people who are going to realize they have this problem now... Anyone have a solution?

[sky-knight]

Yes I have this issue. My largest customer runs almost ALL laptops on their internal network. The login script not only fires the UT integration module but also a sync backup of local profile information to a server.

The only way I have found to fix this is to create a shortcut to the login script that fires both the backup and the vbs for Untangle onto their desktops. And train the users to double click the icon when they connect.

The Enterprise solution for this is called NAC (Network Access Control) and it simply won't let them onto the LAN without a full AD login. So when they just plug in.. it doesn't work until they have logged out and back in again.

Alternately you could have a local login script on the box assigned in group policy that pings the untangle IP every so many seconds and if it gets a response fires up the login script...

Anyway you slice it, this issue is a PITA!

[dmorris]

is there some trigger on getting a new DHCP lease that we could use to fire off the script? that way it would run the script after getting the lease after plugging in.

just a thought...

[sky-knight]

Originally Posted by dmorris

is there some trigger on getting a new DHCP lease that we could use to fire off the script? that way it would run the script after getting the lease after plugging in.

just a thought...

Possibly but for some reason that seems unMicrosoft to me.. more than likely the event fires when the card connects not when the IP changes. Still if there is an API call that does that... building the script would be rather trivial.