We have 200 odd wireless-only laptops that I want to put on a domain. The wireless authentication is user based, so establishing a wireless connection before the logon is not possible i.e. machine authentication is not possible.

However, the credentials for wireless auth and the domain are the same. Is it possible to configure the machines so windows tries to establish the wireless connection as the first part of the logon process? i.e. SSO?

Just to make things more complicated, the wireless system uses a supplicant (SecureW2) for authentication.

  • Sounds painful. Personally, I'd be asking this of SecureW2. They seem to puff out their chests and spout off about being "Rigorously tested" and how the "SecureW2 Enterprise Client is Microsoft certified". Perhaps they can be bothered to describe such basic functionality. (Looking at their web site I'm getting a bad feeling about them... no public knowledge base, prominent "customer login", description of "support services" when you click the "Support" link. Not things that I consider positive in terms of an ISV. I'd guess that Customers look like "recurring revenue streams" to them.) – Evan Anderson Jun 24 '10 at 12:25
  • would it be easier if secureW2 were not in the equation? – askvictor Jun 24 '10 at 23:02

A portion of the information on this page is relevant to your question. http://technet.microsoft.com/en-us/library/bb727033.aspx

I agree that removal of securew2 from the required configuration would likely aid in accomplishing this task.


We're running into the exact same problem with our campus network. The essentially user-space login page means that workstation-logon isn't working, so the workstations aren't getting their Group Policies updated. The work-around for our laptop maintainers is to plug the laptop into the wire after they're done staging it up in order to get the GPOs cached locally. GPO-based software installs just don't work, and we need it to.

What we're doing to fix this is to use a NAC solution and a separate SSID for these laptops. The NAC client ensures the system is ours and allowed to talk. We're also really looking into 802.1x systems as a way to solve it more permanently.

  • My personal experience as well. Welcome to the wonderful world of cached credentials . . . – songei2f Aug 10 '10 at 1:23

The network has (thankfully) moved away from secureW2 and to straight AD-based auth, so it ties in with windows much more nicely. Together with single-sign on, it almost works perfectly (machine group policy still isn't there yet though...)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.