To begin, we're going to create some security groups, and for Always On VPN,
we need a number of different groups created in Active Directory. To start,
we need a group for our VPN servers. Now,
of course,
this assumes that your VPN servers are joined to the domain. As
we discussed in the previous modules, domain join is optional for
our VPN servers, so quite clearly,
if you're not joining your VPN servers to the domain,
there's no need for these security groups.
But if you are, and that's a pretty standard deployment,
then we'll need to create a security group in Active Directory for
our VPN servers. We'll also create a group for our NPS servers, our
VPN users, as well as our VPN devices.
We're going to use these security groups for a variety of things.
The first is Certificate Enrollment.
We're going to use the security groups as ACLs or access control lists on
our security templates to restrict enrollment for those certificates to
only those devices and users that require them.
In addition, we'll use these security groups to control access to the VPN.
We don't want everyone or everything in the domain to be able to access our
network remotely, so we're going to restrict that to a very specific subset of
users and define access controls in NPS on those users.
So in this demonstration,
I'm going to create some security groups in Active Directory.
I'm going to do so using the standard method of the UI
Active Directory users and computers,
but I am also going to demonstrate how to do this with
PowerShell if you're working in Server Core or you just want to simply automate the process.