Patent ID: 7673326

Claim:
A method for providing security in a computer system, comprising: in a processor of a clean group server: specifying a set of properties for use in determining if an item is clean; in response to receiving an add request from an item, the add request containing evidence collected from the item relating to the presence or absence of the properties in the specified set of properties, evaluating the add request to determine if the evidence proves that the item has the specified set of properties; determining from the evidence in the add request whether the item has the specified set of properties, and if so, designating the item as a member of a clean group by instructing a domain controller to add the item to the clean group, the domain controller configured to store information identifying network users and resources; and managing access to a plurality of group policy objects through an active directory server, each of the group policy objects being associated with a group defined by the domain controller, and the active directory server providing access to each of the plurality of group policy objects to items based on membership in a group defined by the domain controller such that only members of the clean group can read the group policy object; wherein: members of the clean group communicate using security associations; and a group policy object of the plurality of group policy objects comprises parameters for security associations used by items of the clean group, whereby communication with items of the clean group is restricted to other items within the clean group.