Windows 2000 Network Access with RADIUS and IAS

In Microsoft Windows 2000, network access is centrally managed through the Internet Authentication Service (IAS), which acts as Microsoft's implementation of the Remote Authentication Dial-In User Service (RADIUS) protocol. By integrating directly with the Active Directory directory service, IAS enables organizations to perform centralized authentication, authorization, accounting, and auditing (AAAA) for diverse connection types, such as dial-up, Virtual Private Networks (VPN), and wireless connections.

Centralized Authentication via Active Directory

When a remote access client connects to a Network Access Server (NAS)—such as a VPN gateway, dial-up server, or wireless access point—the NAS forwards the client's credentials to the Windows 2000 IAS server in a RADIUS Access-Request packet.

IAS checks these credentials against the central Active Directory database. Because IAS natively supports Windows authentication protocols (including MS-CHAP, MS-CHAP v2, EAP-TLS, and PAP/SPAP), it eliminates the need to maintain separate user databases across multiple access servers. If the credentials match an active user account in Active Directory, IAS proceeds to evaluate authorization rules.

Authorization Through Remote Access Policies

Authorization in Windows 2000 IAS is governed by Remote Access Policies rather than simple per-user permissions alone. A Remote Access Policy consists of three components:

  1. Policy Conditions: Specific criteria that must match the incoming request, such as the time of day, group membership (Windows 2000 security groups), connection type (e.g., PPTP or L2TP), or the phone number dialed.
  2. Policy Permissions: A grant or deny decision applied when all conditions of a policy are met. Access can also be deferred to the individual user’s dial-in properties in Active Directory.
  3. Policy Profiles: A set of attributes returned to the NAS if the connection is permitted. These attributes can enforce session limits, idle timeouts, specific IP address assignments, and mandatory encryption strengths (such as 40-bit, 56-bit, or 128-bit MPPE).

When a request arrives, IAS evaluates policies sequentially. The first policy whose conditions match the request determines whether access is granted or denied, overriding subsequent policies.

RADIUS Proxy Capabilities

Windows 2000 IAS can also function as a RADIUS proxy. In this role, IAS inspects the realm name (the username prefix or suffix, such as user@example.com) and routes the authentication request to an external RADIUS server. This allows multi-domain enterprises or service providers to authenticate visiting or outsourced users without sharing internal directory infrastructures.

Accounting and Auditing

IAS provides centralized accounting by recording connection attempts, session start and stop times, and data usage reported by the NAS via RADIUS Accounting-Request packets. Windows 2000 IAS stores this data either in local log files (using standard or database-compatible text formats) or logs events directly to the Windows Event Viewer. This data allows administrators to track network usage, generate billing reports, and monitor unauthorized access attempts.