2

I have created a GPO and linked it to a test OU. This GPO has Windows 7 Wireless Policy that directs the machines to auth on the network with PEAP in computer auth mode.

This auth is being done with certificates. When connecting it should Validate the server certificate, via our NPS server, trusting some third party CA.

Now, the problem lies when these settings actually get applied to a machine, everything carries over except for "Trusted Root Certification Authorities" configuration. While in the GPO we have a specific CA trusted, on the client there are no CAs Trusted.

If I configure the machine manually, by configuring the trust root CAs myself, I am able to connect perfectly.

What could be preventing the GP from being applied in this situation?

enter image description here

Improve this question

1 Answer 1

Reset to default
0

Trusted Root CAs is one of those GPs that MUST be set either in the Default Domain Policy (not recommended) or another one at the domain root. You can only have one policy for the domain.

Verify that there is only one certificate policy in effect for your domain. This can be done by running a GP result on the machine in question.

Improve this answer
5
  • whats the path for the policy you are talking about?
    – MattUebel
    Mar 7, 2012 at 19:10
  • It can be any policy that is linked at the root. The critical part is that first, the GPO MUST be linked at the root and second, it's the only GPO that has root CA defined.
    – newmanth
    Mar 7, 2012 at 19:12
  • The specific setting is located at Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Security Options | Public Key Policies | Trusted Root Certification Authorities
    – newmanth
    Mar 7, 2012 at 19:14
  • Upon rereading the question... I think I may have misunderstood what you were asking. It the root CA already trusted on the machine, and that you're just trying the get the PEAP CA trust checked?
    – newmanth
    Mar 7, 2012 at 19:19
  • I will look at the policy settings you mentioned. Yes, if I configure the Trusted Root CAs manually, I am able to connect. If I configure it as such via Group Policy, it doesn't actually configure the Trusted Root CA section as I want, and therefore fails to authenticate.
    – MattUebel
    Mar 7, 2012 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.