Solved

Setting up Radius Server to authenticate users in AD

Posted on 2012-04-12
7
540 Views
Last Modified: 2012-05-10
Hi Team,

I have just been assigned a project in which 10 users out of 120 users in an active directory environment need to start using radius authentication.
These 10 users are the domain admins of the company and need higher security then what AD has build in. Has any of you done this is the past and are there any articles or book you can point me to.
The ultimate goal here is for all domain users to type in the password give by the radius server every time they log into any computer.

Thank you.
0
Comment
Question by:exTechnology
7 Comments
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37837183
0
 
LVL 22

Expert Comment

by:yo_bee
ID: 37837197
This is a great group of links to assist with setting up RRAS and radius

http://technet.microsoft.com/en-us/network/bb545655
There are Step by Steps and video labs.
0
 
LVL 39

Expert Comment

by:footech
ID: 37846076
I have just been assigned a project in which 10 users out of 120 users in an active directory environment need to start using radius authentication.

Radius authentication for what?  To authenticate their wireless connection?  Their wired connection?  Are you wanting to authenticate the machines they are logging on to?

The password that users type in to log on to a computer will always be their AD password, there is no separate password for NPS/RADIUS.  NPS just authenticates a user based on the user's AD group membership.  The user is verified either through the use of their AD credentials (i.e. username and password), or through a certificate.  A machine can also be authenticated in similar fashion.
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
LVL 2

Author Comment

by:exTechnology
ID: 37883219
I would like to use the Radius Authentication for the user that logs into a wired domain computer. Is this possible? Instead of using their AD Password they would use the password the radius server generates and displays on the keychain module?
0
 
LVL 39

Expert Comment

by:footech
ID: 37888201
In short, no.  Reread the bottom paragraph of my previous post.

I think you're misunderstanding what NPS/RADIUS is for.  When a user logs on to a computer, it will always be using either AD credentials or local credentials.  After that point, the connection (wired, wireless, or even VPN) can be authenticated by the RADIUS, but that is done by checking whether the user (or machine) is allowed by verifying their credentials against AD.  Other criteria can also be applied by the rules which must match in order for the connection to be allowed, such as where the connection is coming, what type of device, time of day, etc.

Can't say I know what you're referencing here...
password the radius server generates and displays on the keychain
0
 
LVL 2

Author Comment

by:exTechnology
ID: 37889157
Ok, so when the user logs in they will use their AD account password, after that point, would the radius server ask the user for a second password for authentication? What I mean by the keychain is that the radius system that we have has key chains that generate random passwords, each use will have one of these. When does this authentication come into play when using the radius feature within AD account?

Thank you
0
 
LVL 39

Accepted Solution

by:
footech earned 500 total points
ID: 37889658
No, it would use their credentials already entered (at least in a default configuration).  RADIUS comes into play to authorize the connection.  For instance, for wired connections 802.1x is used so that if a device without proper credentials is plugged into an ethernet port, the port won't allow any communication.  I've never seen what you're describing, so I don't know if there's a way to configure it to do what you want, but it's not the way RADIUS is typically used.

I'm really not sure what you're trying to do here that can't be accomplished with AD settings.  Are you worried about password complexity or length?  That can be set.  Need different requirements for Domain Admins?  That can be set with fine-grained password policies if your domain functional level is 2008.  Are up looking to do two-factor authentication?  Can't help you with that, but I know there're products out there for it.
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question