Solved

Setting up Radius Server to authenticate users in AD

Posted on 2012-04-12
7
542 Views
Last Modified: 2012-05-10
Hi Team,

I have just been assigned a project in which 10 users out of 120 users in an active directory environment need to start using radius authentication.
These 10 users are the domain admins of the company and need higher security then what AD has build in. Has any of you done this is the past and are there any articles or book you can point me to.
The ultimate goal here is for all domain users to type in the password give by the radius server every time they log into any computer.

Thank you.
0
Comment
Question by:exTechnology
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37837183
0
 
LVL 22

Expert Comment

by:yo_bee
ID: 37837197
This is a great group of links to assist with setting up RRAS and radius

http://technet.microsoft.com/en-us/network/bb545655
There are Step by Steps and video labs.
0
 
LVL 40

Expert Comment

by:footech
ID: 37846076
I have just been assigned a project in which 10 users out of 120 users in an active directory environment need to start using radius authentication.

Radius authentication for what?  To authenticate their wireless connection?  Their wired connection?  Are you wanting to authenticate the machines they are logging on to?

The password that users type in to log on to a computer will always be their AD password, there is no separate password for NPS/RADIUS.  NPS just authenticates a user based on the user's AD group membership.  The user is verified either through the use of their AD credentials (i.e. username and password), or through a certificate.  A machine can also be authenticated in similar fashion.
0
Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

 
LVL 2

Author Comment

by:exTechnology
ID: 37883219
I would like to use the Radius Authentication for the user that logs into a wired domain computer. Is this possible? Instead of using their AD Password they would use the password the radius server generates and displays on the keychain module?
0
 
LVL 40

Expert Comment

by:footech
ID: 37888201
In short, no.  Reread the bottom paragraph of my previous post.

I think you're misunderstanding what NPS/RADIUS is for.  When a user logs on to a computer, it will always be using either AD credentials or local credentials.  After that point, the connection (wired, wireless, or even VPN) can be authenticated by the RADIUS, but that is done by checking whether the user (or machine) is allowed by verifying their credentials against AD.  Other criteria can also be applied by the rules which must match in order for the connection to be allowed, such as where the connection is coming, what type of device, time of day, etc.

Can't say I know what you're referencing here...
password the radius server generates and displays on the keychain
0
 
LVL 2

Author Comment

by:exTechnology
ID: 37889157
Ok, so when the user logs in they will use their AD account password, after that point, would the radius server ask the user for a second password for authentication? What I mean by the keychain is that the radius system that we have has key chains that generate random passwords, each use will have one of these. When does this authentication come into play when using the radius feature within AD account?

Thank you
0
 
LVL 40

Accepted Solution

by:
footech earned 500 total points
ID: 37889658
No, it would use their credentials already entered (at least in a default configuration).  RADIUS comes into play to authorize the connection.  For instance, for wired connections 802.1x is used so that if a device without proper credentials is plugged into an ethernet port, the port won't allow any communication.  I've never seen what you're describing, so I don't know if there's a way to configure it to do what you want, but it's not the way RADIUS is typically used.

I'm really not sure what you're trying to do here that can't be accomplished with AD settings.  Are you worried about password complexity or length?  That can be set.  Need different requirements for Domain Admins?  That can be set with fine-grained password policies if your domain functional level is 2008.  Are up looking to do two-factor authentication?  Can't help you with that, but I know there're products out there for it.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains how to install and use the NTBackup utility that comes with Windows Server.
Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question