October 13, 2006, 4:08 PM — Send your Windows question to Mitch today! | See other Windows tips
I've talked about some of the great things that are coming in Windows Vista in previous columns. For example, the inclusion of Access-Based Enumeration (ABE) to increase the privacy of shared folders and enhancements in Remote Assistance are two big improvements in Vista that businesses should consider when deciding whether to upgrade their desktops to Vista.
Improvements to IPsec in Vista are a third factor to consider, and not just improvements under the hood like new credential types such as User (Kerberos) that let you restrict access to computers based on user identity and stronger crypto algorithms for ensuring data integrity and encrypting traffic.
No, the biggest improvement with IPsec in Vista is that it's now easy to work with! Think about trying to use IPsec to secure traffic between your client computers and domain controllers. Have you ever tried that with an existing Windows network? It takes dozens (more likely hundreds) of IPsec filters and rules just to make it work -- if you can ever get it working. Domain and server isolation are great in theory but they're still difficult to implement and maintain on today's Windows networks. Until Vista.
With Simple Ipsec -- the integration of IPsec into Windows Firewall -- configuring IPsec policy on a machine becomes a snap. Instead of the confusing interface of the IPsec Security Policy Management snap-in, the new Windows Firewall With Advanced Security snap-in lets you create a connection security rule using a wizard that handles all of the messy work for configuring IPsec policy on the machine.
Of course, Vista is really only half the solution here since Windows Server Code Name "Longhorn" will supply the other half when it is released later next year. But even with Windows Server 2003 on the back end (and using the KB914841 update to simplify creating and maintaining IPsec filters on Windows Server 2003 and Windows XP) you can implement a secure isolation strategy for your domain today with much less hassle than before. And having Vista on the desktop just makes it all that much easier.
