up vote 1 down vote favorite
1
share [g+] share [fb]

I am trialing 802.1x on 20 dell notebooks. I can get 8021x authentication to work however the user has to be logged onto the domain previously for it to work. If a new user logs in they get domain is unavailable. I am using Windows 2003 server for the radius server and for the Certificate Server. There is a group policy that when devices are placed in that OU they receive a Certificate from the Certificate Server. The clients are windows xp SP3 using windows zero config utility for wireless. How can I get the wireless 8021x connected prior to the logon process?

link|improve this question
87% accept rate
feedback

2 Answers

up vote 0 down vote accepted

For Windows XP clients you should be able to set the "Authenticate as computer when computer information is available" option Wireless Network Properties - Authentication tab. This certainly worked for XP SP2 and earlier but this appears to have changed with SP3.

For Vista (and apparently for XP SP3, I don't have an XP system to test) this must be explicitly enabled - the details for both are outlined in this MS kb article : "How to enable computer-only authentication for a 802.1X-based network in Windows Vista, in Windows Server 2008, and in Windows XP Service Pack 3"

For this to work your Radius server must support machine only authentication, your GPO must be deploying computer and not user certs.

link|improve this answer
Has Anyone got this working for Windows xp sp3? The netsh wlan command mentioned in the KB above doesnt exist in windows xp sp3 so I cant change the authentication type to machine rather that user. – JohnyV Jun 24 '09 at 21:46
I tried th methods shown in the article and when I try to (for wired) to import the profile back again when I put the <Authmode> tag in it says profile is corrupt. I also tried the reg key for wireless and it didnt work. – JohnyV Jun 27 '09 at 0:04
Interesting. The Netsh process detailed above works as described for Vista - well you can edit the XML and it will add back the profile without generating an error at least while adding an unsupported tag does produce the "profile is corrupted" error. Note the <authMode> entry is case sensitive and sensitive to whitespace. I would expect XP SP3 to fail though as it doesn't support this. What Radius server are you using and what do you find in its logs after you make the registry change? Which EAP type are you using? – Helvick Jun 27 '09 at 7:35
The radius server is just the IAS in Microsoft server 2003. The EAP used is PEAP. I tried <authMode> and <AuthMode> but neither worked (just to be sure) I made sure not to add additional formatting. There is nothing in the log that seems out of the ordinary. I have now tried with an xp machine (LAN) a vista machine (WLAN) and an xp notebook . – JohnyV Jun 29 '09 at 0:36
feedback
up vote 0 down vote

does anyone know how to do this on a wired connection? I'm trying to implement 802.1x authentication over a wired infrastructure using windows xp SP2 supplicants and windows server 2003 as the RADIUS. I need it to authenticate the workstation prior to log on so the users can log onto the domain. any ideas?

link|improve this answer
I should have the answer tommorow. Will post once i get it working – JohnyV Jul 1 '09 at 7:39
For the wired network In radius I set a policy condition that mathes ethernet OR wireless (because I am using both on our network). I was having problems with it not working because I updated the edge switches firmware. Once I rolled back to the old version of flash I was able to connect straight away. There are also several vlans one is for computers so that when the computer is there without anyone logged on it reverts to this vlan so that the computer can still get the dns server to check logon details. However is an unauthenticated machine plugs access is cut off. – JohnyV Jul 7 '09 at 5:18
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.