1

We are distributing wireless profiles in our Windows domain (AD servers are 2012, domain level is 2008, various client Windows versions - mostly Win7 and Win10). However, it seems we just cannot achieve the goal we want to achieve regarding saved credentials. Under "Computer configuration" - "Policies" - "Windows settings" - "Security settings" - "Wireless network policies (IEEE 802.11)", we created a "Vista and later" policy with one profile, and this has in its security pane the (seemingly only applicable) setting "Cache user information for subsequent connections to this network".

  • If we uncheck this option, users are asked for their username and password each time they connect to our WLAN. The problem with this is that we'd prefer if the credentials do not have to be entered so often.
  • If we check this option, users are asked only once and never again. The problem with this is that the user is not even asked for credentials if the password has been changed in the meantime and so the saved password has become invalid. In this situation, there seems to be no way for the user to re-obtain WLAN connectivity.

Questions:

  1. Is there any way for the users to update the login credentials with the second scenario above?
  2. Preferably, is there any way to configure the profile such that connection failure due to login failure makes the username/password dialog pop up, thus allowing the user to store the changed credentials?
Improve this question
4
  • Any reason why you aren't using the policy setting Automatically use my Windows logon name and password(and domain if any) ?
    – BlueCompute
    Jun 16, 2016 at 15:12
  • 1
    @BlueCompute Actually, two reasons: I don't want everyone to use wireless rsources if they don't have to. It seems that at least Win7 boxes would happily login to WiFi even with cable plugged in (at least they are otherwise getting the annoying credentials needed toast). Secondly, I'd like to be able to sometimes use different credentials for WLAN temporarily (as in: underprivileged user X is not allowed WLAN access, but I as admin might need to temporarily connect to WLAN from his session).
    – Hagen von Eitzen
    Jun 16, 2016 at 20:01
  • I thought that the second scenario would work even with this setting in place. You would still be able to enter your credentials manually to connect? Not tested that though. I take your first point, that makes sense. Are you able to remove the cached credentials through credentials manager?
    – BlueCompute
    Jun 17, 2016 at 9:22
  • 1
    @BlueCompute My second scenario won't work if that user X had ever formerly entered his credentials (that do not work any more). Any attempt to connect to the WLAN is done with the saved credentials. -- I'll have to take your idea with the credential manager to a test, though.
    – Hagen von Eitzen
    Jun 17, 2016 at 21:31

1 Answer 1

Reset to default
0

My dirty workaround!

Created a new GP that…

  • Deletes all files under c:\Windows\wlansvc\PoliciesI only have one wi-fi GP profile so no issue with deleting files from here
  • Restart the wlansvc service
  • With both of these GP settings have been set to only apply once.

On the GP Security Filtering removed Authenticated User and when needed added the Computer device, where the user needs to change their GP wi-fi profile password.

Obviously this requires abit of communication with the end user that needs to re-enter their password.

  • Add their Computer device to GP and get them to do a gpupdate /force
  • Remove their Computer device from the GP
  • Get the user to gpupdate /force to re-apply the wi-fi GP profile
  • Get the user to connect to the wi-fi GP profile and fingers crossed they will be prompted for their username and password.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .