Solved

Windows NPS certificate issue

Posted on 2012-04-09
11
355 Views
Last Modified: 2012-06-21
I  have setup several Cisco's 2911 Wifi AccessPoints, they are setup to use domain server authentication against a Win08R2 DC with NPS roled installed.

I have it set to allow connection if any of the following requirements are met:

1-computer already belongs to the domain
2-valid domain user/pass (allow apple ios devices to connect)

it works great if you are already part of the Domain

but if a computer that doesnt belong tries to connect (a guest, for example), after entering VALID domain credentials, the connection fails, event viewer indicates it cant find a valid vertificate to allow the connection.
so... it wants a certificate to be installed on the computer before it allows the connection EVEN when the user/pass is correct for the domain user.

Ive been manually installing the certificates but i rather it just works by authenticating the username/pass the user enters when attempting the connection to the AP.

how can i get rid of the certificare requirement? (and not have to modify settings on currently connected computers)
0
Comment
Question by:Comptx
  • 6
  • 3
  • 2
11 Comments
 
LVL 21

Expert Comment

by:Jakob Digranes
ID: 37825392
have you chosen EAP-TLS or PEAP-MsChap V2 as authentication method on NPS?

if you want to use username/password choose EAP-MsChap V2 - but you can have both policies activated as inner authentication - remember to put EAP-TLS on top
0
 

Author Comment

by:Comptx
ID: 37825513
authentication methods are
Protected Eap [peap]
secured password [eap-mschap v2]
Less secure authentication methods : None checked
0
 
LVL 39

Expert Comment

by:footech
ID: 37853184
I'm not sure if it's any less intrusive than copying the certificate over, but you if you modify the properties of the wireless connection > Security tab > Configure (next to dropdown with MS PEAP selected) > Uncheck the box for "validate server certificate", then non-domain machines can connect.
0
 

Author Comment

by:Comptx
ID: 37853277
windows wont add the connection to the list until its successfully able to connect, to i cant access the properties of the connection
0
 

Author Comment

by:Comptx
ID: 37853280
i havent tried jacobs response yet, i will try it today and see if that fixes the issue
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 
LVL 39

Expert Comment

by:footech
ID: 37853674
You can manually add the connection.  You will just have to enter the correct SSID, Security type, and Encryption type.  After clicking Next you will be able to change the connection settings.
0
 

Author Comment

by:Comptx
ID: 37887201
footech, that task will be nearly impossible for your regular non computer savy user.
0
 

Author Comment

by:Comptx
ID: 37887283
ok, tried only having  EAP-MsChap V2 by itself, but then no device, windows, mac, or ios would connect. just fails after entering user/password

also tried using :less secure methods"
such as ms-chap-v2 by itself with same results.
0
 
LVL 39

Accepted Solution

by:
footech earned 500 total points
ID: 37887417
Perhaps you're right, but it works.

One of the premises behind PEAP is to authenticate the server with a certificate.  To get around it you have to manually modify the connection properties to ignore this.  Your only other options (at least as far as I'm aware) are to use a PSK or captive portal for guest access, or to use a publicly trusted certificate for the NPS.
0
 
LVL 21

Expert Comment

by:Jakob Digranes
ID: 37891042
Log on to NPS ans look in security logs in event viewer why users aren't authenticated using PEAP-MsChap V2
0
 

Author Closing Comment

by:Comptx
ID: 38101930
sorry for the delay. will try the public certificate. thanks
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

914 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now