I am trialing 802.1x on 20 dell notebooks. I can get 8021x authentication to work however the user has to be logged onto the domain previously for it to work. If a new user logs in they get domain is unavailable. I am using Windows 2003 server for the radius server and for the Certificate Server. There is a group policy that when devices are placed in that OU they receive a Certificate from the Certificate Server. The clients are windows xp SP3 using windows zero config utility for wireless. How can I get the wireless 8021x connected prior to the logon process?


For Windows XP clients you should be able to set the "Authenticate as computer when computer information is available" option Wireless Network Properties - Authentication tab. This certainly worked for XP SP2 and earlier but this appears to have changed with SP3.

For Vista (and apparently for XP SP3, I don't have an XP system to test) this must be explicitly enabled - the details for both are outlined in this MS kb article : "How to enable computer-only authentication for a 802.1X-based network in Windows Vista, in Windows Server 2008, and in Windows XP Service Pack 3"

For this to work your Radius server must support machine only authentication, your GPO must be deploying computer and not user certs.

  • Has Anyone got this working for Windows xp sp3? The netsh wlan command mentioned in the KB above doesnt exist in windows xp sp3 so I cant change the authentication type to machine rather that user. – JohnyV Jun 24 '09 at 21:46
  • I tried th methods shown in the article and when I try to (for wired) to import the profile back again when I put the <Authmode> tag in it says profile is corrupt. I also tried the reg key for wireless and it didnt work. – JohnyV Jun 27 '09 at 0:04
  • Interesting. The Netsh process detailed above works as described for Vista - well you can edit the XML and it will add back the profile without generating an error at least while adding an unsupported tag does produce the "profile is corrupted" error. Note the <authMode> entry is case sensitive and sensitive to whitespace. I would expect XP SP3 to fail though as it doesn't support this. What Radius server are you using and what do you find in its logs after you make the registry change? Which EAP type are you using? – Helvick Jun 27 '09 at 7:35
  • The radius server is just the IAS in Microsoft server 2003. The EAP used is PEAP. I tried <authMode> and <AuthMode> but neither worked (just to be sure) I made sure not to add additional formatting. There is nothing in the log that seems out of the ordinary. I have now tried with an xp machine (LAN) a vista machine (WLAN) and an xp notebook . – JohnyV Jun 29 '09 at 0:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.