Block windows Shared Folder over anyconnect

[najarian]

Hello everyone, we noticed that in the client VPN group "XXXX" access to internal resources without AD group membership (ATTRIBUTE_MAP) is possible!!. E.g. Open the $ shared folders of internal systems (tested with \\ 10.10.8.10 \c$\ if the user does not have any VPN AD groups; it shouldn't be like that. Can you please tell me why!!??

Regard

Ashkan

[Marvin Rhoads · Accepted solution]

AnyConnect simply allows or denies access to IP addresses. What, if any, access a connected endpoint or users has to a reachable network resource is controlled by the OS on that resource - not AnyConnect or the ASA (or whatever AnyConnect comes in through).