Burton Group VP and Network World columnist Dan Blum seems to agree with me that Vista belongs on your desktops. Not immediately, he thinks, but following your normal deployment schedule of new machines. Perhaps even slowing that deployment down. He especially thinks you should wait until Vista is “playing nicely” with all of your third-party security tools.

But his column did remind me that one of the new security features in Vista – Network Access Protection (NAP) – will also be one of the more talked about enhancements in Longhorn when the new server operating system ships, which should occur within the next 12 months.

NAP is a “policy enforcement platform”, according to Microsoft, built into the Windows Vista and Longhorn Windows Server code that allows you to better protect network assets by enforcing compliance with system health requirements. With NAP, you can create customized health policies to validate computer health before allowing access or communication, automatically update compliant computers to ensure ongoing compliance, and optionally confine noncompliant computers to a restricted network until they become compliant.

“Health,” by the way, appears to be a euphemism for “running the most up-to-date software,” at least as I read the marketing materials from Microsoft. But if you can get past the cuteness factor (one press release talked about non-NAP protected computers being “…at higher risk of infection from Web sites, e-mail, files from shared folders, and other publicly accessible resources”), this is an important new tool. It will allow you to specify minimum requirements in terms of software and versions installed before allowing a computer to access your network.

You can also set limits on the connection based on a specific amount of time, or the access could be limited to a restricted network, a single resource, or to no internal resources at all. If you do not configure health update resources, the limited access will last for the duration of the connection. But if you do configure health update resources, the limited access will last only until the computer is brought into compliance. You could use both monitoring and health policy compliance in your networks and configure exceptions.

Microsoft has set up a Web site with lots of details about NAP which you should check out.