Questions from PWG IDS participants on Microsoft NAP Architecture and Implementation
--------------------------------------------------------------------------------------------------------------------------------------

Q1:  The NAP architecture document states that "A NAP client is a computer running Windows Vista, Windows Server 2008, or Windows XP with Service Pack 3..."

Does this mean that Microsoft will not support non-Windows-based NAP clients?

Q2:  When a NAP client is asked to send it's health information to the NAP servers for
assessment, can the NAP client "lie" about this information?  If clients cannot "lie" about it's health, how can the servers tell that clients aren't telling the truth about their health info?

Q3:  I didn't see a specific document section that describes how a 3rd party (non-Microsoft) might code a System Health Validator plugin for NAP.  In detail, I would like to know how a 3rd party SHV gets "triggered".  Meaning, when a NAP server receives a statement of health from a NON-windows device, how does it know to pass the statement of health off to a plugin SHV?  I would like to know the algorithm that NAP uses to examine a statement of health to determine whether or not to handle it with Microsoft standard SHVs, or pass it off to a particular SHV plugin.

Q4:  It's my understanding that there is a new security model for the "Device Profile for Web Services" (DPWS) and that this service supports digitally signing web service messages.

There are also certificates used in NAP.

There are also machine certificates, and user certificates, managed by a Windows Server certificate authority.

Do each of these subsystems all use the WIndows Server 2008 PKI? Or are there separate CAs for each application domain (NAP, DPWS, and WS-2008 CA)?

Q5:
Which of the defined transport(s) are required to be supported in order to guarantee a device can attach to the network?  MS defines DHCP, 802.1x, IPSec, and VPN and has extended each to add SOH information.  So, in an environment where we are attaching wirelessly via 802.1x and receive our IP address from DHCP, what happens if we only support SOH over DHCP (or 802.1x)?  Will we attach or fail? 

I think the answer is that unless we are enrolled in their health certificate solution (MS-HCEP), we'll need to re-assess.  However, this is something we need to clarify with MS. 

Q6 
Is the remediation step required to use NAP or can it be outside NAP? 

Q7 
Would MS be willing to provide a class plug-in to assess imaging devices if the manufacturers committed to supporting NAP? 

Q8
Would MS be willing to host a "NAP Plugfest" for imaging (and other) devices? 

Q9 
The attributes being assessed consists of configuration settings and code levels.  It seems the remediation steps would involve updating code levels and configuration settings.  Both remedies could be standardized to use some corporate policy statement.  How might this be handled? 

Q10 
Is a remediation plug-in allowed to operate in a "pass-thru" mode where it initiates remediation via some external mechanism? 

Q11
 The MS-Machine-Inventory Packet only defines Microsoft OSes and x86 architecture.  We need additional platform definitions.  How should we proceed? 

Q12
The MS-Quarantine-State Packet, that is required for SSoH, contains a URL.  What is the purpose of the URL? 

Q13
 It seems like the purpose of the MS-Packet-Info Packet is to differentiate between version 1 and 2.  Is this correct? 

Q14
 The MS-SystemGenerated-Ids Packet is optional.  However, it looks like if the SOH contains vendor extensions that this becomes a required packet.  Is this attribute used to route the SOH to various assessment applications? 

Q15
  The MS-Machine-Inventory-Ex Packet defines client, server, and domain controller.  Are there plans to expand this list?  What should a print service use? 

Q16  Section 2.2.8 SSoH specifies *MS-Machine-Inventory-Ex as optional.  However, section 2.2.4.8 MS-Machine-Inventory-Ex Packet states the attribute MUST be present in the SSoH and MAY be present in the SSoHR.  So, is it optional or required?