802.1x Authentication for Wireless Network - User Auth after Computer Auth?

Ok, I'll do my best to answer each of these questions. We have one Wireless AP, it is a Linksys WRT54G. It is configured to use RADIUS authentication with WEP encryption. It calls a RADIUS server in the form of Microsoft IAS for authentication. The supplicants at this time are all WZC native with their settings provided for in Group Policy.

There is only one IAS policy that applies to the wireless, and it is the first policy in this IAS server. It filters by NAS Port and Windows Group membership. The group is called "Wireless - Allow". If the user is a member of this group, he or she is allowed access to the wireless network. The problem is that the wireless domain computers cannot authenticate users before they log in, since they don't have a wireless connection. As a result, I've had to enable Computer Authentication and add the wireless computers to the Wireless - Allow group to let them establish connection before a user logs in.

I want the computers to be able to wirelessly authenticate users, ie a user that hasn't logged on to that workstation before or has since changed his password, but I also don't want users that aren't allowed on the wireless network to have a wireless connection. I want them to be able to log into the machine, but if their user credentials don't give them access I want the wireless connection to be terminated / restricted at that time.

I hope that makes some sense. I'm not sure what you mean by allowing authentication at login rather than pre-authentication of the workstation, but that sounds like it's in the right vein. Any suggestions you can provide would be greatly appreciated!

Best Regards,
Martin

Oh, one more thing,

WZC has an "advanced" button on the authentication tab, with a setting that has it authenticate with your local user ID.  I think that should be un-checked in order to have it use the user ID and password you enter into the dialog.

One more thing - this won't let you log in to the local machine with a profile that doesn't already exist on the local machine if the wireless auth fails and you tell it not to keep trying..  The user profile would have to be there already.

ShineOn,

   Thanks for the tips. I've tried the steps you've provided, but I'm still having trouble. I think your last comment describes exactly what I want to accomplish. I would like to be able to allow users to log in to computers that are wireless network clients. Ideally, the user authentication can be passed to the RADIUS server, and then the user is allowed to log in. However, when I attempt to authenticate with computer authentication disabled, I get an error that the windows domain is unavailable.

   In short, I'm trying to let users authenticate on wireless computers they haven't logged into before. Thanks for the help so far!

Best Regards,
Martin

I did, however, raise the encryption standard to WPA - TKIP as you recommended, so that's good at least.

If I get a chance I will check something at work to see if I can give you more info.  

Do you get anything in your IAS logs when you try the setup I outlined?

When you enter the user ID do you use the domain\user notation or the user@domain.tld notation?  Assuming you're using one or the other and not just the user ID, of course...

Ok, I've got it working for the most part. Here's a followup question if you'd like to take a swing at it: http://www.experts-exchange.com/Networking/Wireless/Q_24265573.html

For future users' reference, here are the settings distilled from ShineOn's post that ended up (mostly) working for me, with the only outstanding unresolved issue being the one linked to above.

Wireless Access Point: WRT54G v8.0 using DD-WRT v24 w/sp1 Firmware
Wireless Security: WPA Enterprise using RADIUS from Microsoft IAS

Settings for Wireless Zero Config in Windows were in my case deployed by Group Policy, but could also be set manually. Added a WPA / TKIP network using GPO. Computer Auth is turned on with User Re-Authentication. Guest Auth is off. EAP is using Protected EAP (PEAP). Trusted Root Certification Authorities include our Active Directory Certificate Authority, which is added to the clients using Group Policy as well. Fast Reconnect is disabled. Authentication method is EAP-MSCHAP v2 and Automatically Use Domain User / Password is enabled. Do Not Prompt User to authorize New Servers or Trusted Certification Authorities is enabled. IEEE 802.1x Certificate Authority for Machine Authentication is defined with the hash of the AD CA.

There are a lot of settings to be tweaked in these setups, and I don't claim to be an expert at all. This configuration may or may not suit your needs, and may not follow security or other best practices - I have no idea. Thanks for the help ShineOn, and any help on that other question is as always greatly appreciated.

Best Regards,
Martin