Peap and domain login

Archived from groups: microsoft.public.windows.networking.wireless (More info?)

We just setup wireless in my company and it is working great. Question
i have is we have setup a room with laptops that are using wireless. We
have this setup for Peap and authenticate against a radius server. Is
there a way to log onto the domain via wireless if you never logged onto
the machine before. Keep in mind that the machine is joined to the
domain but it is not using a cached profile at first. We always had to
connect to the wire first.

Any help?
3 answers Last reply
More about peap domain login
  1. Archived from groups: microsoft.public.windows.networking.wireless (More info?)

    Are you using MS-CHAP v2 or a TLS certificate inside of the PEAP connection?
    If you are using MS-CHAP v2, there should be no need for the user to logon
    via the wire first. If you are using certs, then you need to provision the
    cert before they can authenticate, so you would need to have another method
    to acquire the cert.

    Cheers,

    --
    Mark Gamache
    Certified Security Solutions
    http://www.css-security.com


    "Tech" <tech@tech.com> wrote in message
    news:OdpHhg%23BFHA.3976@tk2msftngp13.phx.gbl...
    > We just setup wireless in my company and it is working great. Question i
    > have is we have setup a room with laptops that are using wireless. We
    > have this setup for Peap and authenticate against a radius server. Is
    > there a way to log onto the domain via wireless if you never logged onto
    > the machine before. Keep in mind that the machine is joined to the domain
    > but it is not using a cached profile at first. We always had to connect
    > to the wire first.
    >
    > Any help?
  2. Archived from groups: microsoft.public.windows.networking.wireless (More info?)

    I am using EAP MS-CHAP v2 and a wireless certificate. Does this make
    sense? But what i am noticing is that i need to log on the machine
    first, configure the wireless with the SSID and PEAP and than except the
    certificate. I would like to do all this via group policies but i was
    told that i need to have 2003 DC and we are still at 2000.


    Mark Gamache wrote:
    > Are you using MS-CHAP v2 or a TLS certificate inside of the PEAP connection?
    > If you are using MS-CHAP v2, there should be no need for the user to logon
    > via the wire first. If you are using certs, then you need to provision the
    > cert before they can authenticate, so you would need to have another method
    > to acquire the cert.
    >
    > Cheers,
    >
  3. Archived from groups: microsoft.public.windows.networking.wireless (More info?)

    The certificate that protects the EAP exchange is the IAS server's
    certificate, this is also the certificate that your client uses to
    authenticate the IAS server (if you use mutual auth). So the MS-CHAP v2 is
    being used inside the TLS tunnel. This means that you don't need a client
    cert. You are correct though, in order to configure the client, you do need
    to have access to the domain to process the login without cached
    credentials.

    To achieve this , add the Domain Computers Group (or the Computer accounts
    separately) to whatever group you use for wireless authentication. The
    computers are then able to authenticate to using their machine accounts.
    This access should allow you to process the login while still in the context
    of the machine assuming that it retains the previous user's wireless
    settings. Some vendors hardware may not support this. The only way to know
    for sure is give it a try.

    To automatically configure each user's account, you would need a win2003 DC
    and actually if you are using WPA, that is currently not supported for auto
    config via GPO. That's coming ins 2003 server sp1.

    Cheers,

    --
    Mark Gamache
    Certified Security Solutions
    http://www.css-security.com


    "Tech" <tech@tech.com> wrote in message
    news:eu79Ce$BFHA.936@TK2MSFTNGP12.phx.gbl...
    >I am using EAP MS-CHAP v2 and a wireless certificate. Does this make
    >sense? But what i am noticing is that i need to log on the machine first,
    >configure the wireless with the SSID and PEAP and than except the
    >certificate. I would like to do all this via group policies but i was told
    >that i need to have 2003 DC and we are still at 2000.
    >
    >
    > Mark Gamache wrote:
    >> Are you using MS-CHAP v2 or a TLS certificate inside of the PEAP
    >> connection? If you are using MS-CHAP v2, there should be no need for the
    >> user to logon via the wire first. If you are using certs, then you need
    >> to provision the cert before they can authenticate, so you would need to
    >> have another method to acquire the cert.
    >>
    >> Cheers,
    >>
Ask a new question

Read More

Wireless Domain Wireless Networking