User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 12 User Databases
Setting Up a MAR Exception List
OL-14386-02
Windows User Database
You might need to set up a MAR exception list if you need to set up specific users (for example managers
and administrators) to have access to the network; regardless of whether they pass machine
authentication. This feature allows you to select user groups that would be exempt from the MAR.
Before You Begin
So that users can immediately authenticate as part of the MAR exception list, you should set up the
required number of groups and permissions before changing your Windows database settings. To
manage your group settings, see Group TACACS+ Settings, page 5-2 and Listing Users in a User Group,
page 5-40.
To set up a MAR exception list for selected user groups:
Step 1 From the navigation bar, choose External User Databases > Database Configuration > Windows
Database.
Step 2 Click Configure.
Step 3 In the Windows User Database Configuration page, enable the correct machine authentication settings
and move the user groups that you want to include in the MAR exemption list to the Selected Groups list.
Step 4 Click Submit.
The exception list is based on ACS user groups to which the relevant NT groups would map. You can
create exceptions for several user groups, and map different authorization permission to each group.
Microsoft Windows and Machine Authentication
ACS supports machine authentication with Active Directory in Windows 2000 and 2003 R2. To enable
machine authentication support in Windows Active Directory you must:
1. Apply Service Pack 4 to the computer that is running Active Directory.
2. Complete the steps in Microsoft Knowledge Base Article 306260: Cannot
Modify Dial-In Permissions for Computers That Use Wireless Networking.
Client operating systems that support machine authentication are:
Microsoft Windows XP with Service Pack 1 applied.
Microsoft Windows 2000 with:
– Service Pack 4 applied.
– Patch Q313664 applied (available from Microsoft.com).
Microsoft Windows 2003 R2
The following list describes the essential details of enabling machine authentication on a client computer
with a Cisco Aironet 350 wireless adapter. For more information about enabling machine authentication
in Microsoft Windows operating systems, please refer to Microsoft documentation.
1. Ensure that the wireless network adapter is installed correctly. For more information, see the
documentation that is provided with the wireless network adapter.
User Guide for Cisco Secure Access Control Server 4.2
12-13