Step 4: Testing Isolation with a Computer That Does Not Have the Domain Isolation Rule
Published: November 2, 2007
Updated: December 7, 2009
Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista
To simulate a computer that is not part of the domain, remove the GPO from CLIENT1, and try to connect again.
On MBRSVR1, switch to Group Policy Management.
Under MyClientComputers, right-click Domain Isolation, and then click Link Enabled to disable the link.
In the next procedure, you refresh the GPO on CLIENT1 and try to communicate with MBRSVR1.
On CLIENT1, at an Administrator: Command Prompt, run gpupdate /force. Wait until the command finishes.
At the command prompt, run telnet mbrsvr1. The connection fails because it never receives a reply to its request. Because MBRSVR1 requires authentication, and CLIENT1 cannot supply it, all incoming packets are dropped.
In the next procedure, you restore the GPO to the client so that the correct rule is in place for later steps.
On MBRSVR1, under MyClientComputers, right-click Domain Isolation, and then click Link Enabled.
If you want, you can repeat the previous procedure "To test the modified GPO on CLIENT1" to confirm that you can connect again. This time the connection succeeds.