Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 548
  • Last Modified:

Setting up Radius Server to authenticate users in AD

Hi Team,

I have just been assigned a project in which 10 users out of 120 users in an active directory environment need to start using radius authentication.
These 10 users are the domain admins of the company and need higher security then what AD has build in. Has any of you done this is the past and are there any articles or book you can point me to.
The ultimate goal here is for all domain users to type in the password give by the radius server every time they log into any computer.

Thank you.
0
exTechnology
Asked:
exTechnology
1 Solution
 
yo_beeDirector of ITCommented:
This is a great group of links to assist with setting up RRAS and radius

http://technet.microsoft.com/en-us/network/bb545655
There are Step by Steps and video labs.
0
 
footechCommented:
I have just been assigned a project in which 10 users out of 120 users in an active directory environment need to start using radius authentication.

Radius authentication for what?  To authenticate their wireless connection?  Their wired connection?  Are you wanting to authenticate the machines they are logging on to?

The password that users type in to log on to a computer will always be their AD password, there is no separate password for NPS/RADIUS.  NPS just authenticates a user based on the user's AD group membership.  The user is verified either through the use of their AD credentials (i.e. username and password), or through a certificate.  A machine can also be authenticated in similar fashion.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
exTechnologyAuthor Commented:
I would like to use the Radius Authentication for the user that logs into a wired domain computer. Is this possible? Instead of using their AD Password they would use the password the radius server generates and displays on the keychain module?
0
 
footechCommented:
In short, no.  Reread the bottom paragraph of my previous post.

I think you're misunderstanding what NPS/RADIUS is for.  When a user logs on to a computer, it will always be using either AD credentials or local credentials.  After that point, the connection (wired, wireless, or even VPN) can be authenticated by the RADIUS, but that is done by checking whether the user (or machine) is allowed by verifying their credentials against AD.  Other criteria can also be applied by the rules which must match in order for the connection to be allowed, such as where the connection is coming, what type of device, time of day, etc.

Can't say I know what you're referencing here...
password the radius server generates and displays on the keychain
0
 
exTechnologyAuthor Commented:
Ok, so when the user logs in they will use their AD account password, after that point, would the radius server ask the user for a second password for authentication? What I mean by the keychain is that the radius system that we have has key chains that generate random passwords, each use will have one of these. When does this authentication come into play when using the radius feature within AD account?

Thank you
0
 
footechCommented:
No, it would use their credentials already entered (at least in a default configuration).  RADIUS comes into play to authorize the connection.  For instance, for wired connections 802.1x is used so that if a device without proper credentials is plugged into an ethernet port, the port won't allow any communication.  I've never seen what you're describing, so I don't know if there's a way to configure it to do what you want, but it's not the way RADIUS is typically used.

I'm really not sure what you're trying to do here that can't be accomplished with AD settings.  Are you worried about password complexity or length?  That can be set.  Need different requirements for Domain Admins?  That can be set with fine-grained password policies if your domain functional level is 2008.  Are up looking to do two-factor authentication?  Can't help you with that, but I know there're products out there for it.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Tackle projects and never again get stuck behind a technical roadblock.
Join Now