Can pulse or Network connect do Domain Machine Auth?

[Mrkool_]

The real machine auth where the computer is verified by the Domain controller? I am currently looking for registry entries, processes and specific files to uniquely identify the machine but i want to make sure that the machine is one of ours or someone has just made these changes to make it look like one of ours.

[Lilja_]

Yes you can.

From Junos Pulse 3.0R1 adminguide:

"Machine authentication uses machine credentials (machine name and password or machine certificate) to authenticate the endpoint. You can enable machine authentication for Pulse Access Control Service as part of a Junos Pulse connection and distribute the connection to endpoints through the normal Pulse distribution methods. "

[Mrkool_]

so as i dont see any options to configure this i am guessing this option is only avialble in 7.2 chain

[zanyterp_]

Machine auth, as mentioned previously, is available on the Access Controller (IC) starting with 4.2; it is not available on the Access Service (SA/IVE).

[Lilja_]

I have machine auth setup with machine certificate in my SA boxes (7.2R1), it should also be possible to use machine credentials from AD in the same way..

This is done in Junos Pulse connection set in "Connection is established" with the option:

"Automatically when the machine starts. Machine credentials used for authentication." OR

"Automatically when the machine starts. Connection is authenticated again when the user signs in into the desktop."

Different authentication realms can be used for machine and user if needed.

[zanyterp_]

I apologize for not realizing this was in place on the SA side as well.

[Lilja_]

It's a really cool feature as well. More flexible than the corresponding feature in MS Direct Access too.