I'm working on a solution to identify if a machine is a member of the domain or not. We are using Checkpoint R75 Identity Awareness with two possible methods to retrieve machine identity.
- AD Query to pull out machine authentication from logs.
- Identity Agent (software) to log on to the Domain Controller via the firewall.
After some work with Identity Agent, which does not work to well with multiple domain controllers, I'm looking at the possibility to let clients log onto the AD to establish the identity.
Considering that the idea of this solution is to block unknown computers at the firewall, I am a bit reluctant to allow them access to the Domain Controller. Especially since the DC can be considered the "Crown Jewel" security-wise.
Now for the question,
What traffic should be allowed from clients to the Domain Controllers to allow them to login?