Solved

SSO with Pre-Shared Key on Windows 7

Posted on 2014-01-16
12
638 Views
Last Modified: 2014-02-18
Hello, Experts!

I'm trying to configure a Single-Sign On for our users who are outside the office and need to connect to our VPN before signing into Windows.

I've been able to configure it with this guide:

http://www.windowsnetworking.com/articles-tutorials/windows-7/VPN-Single-Sign-On-Windows-7.html

However, when it tries to connect to our VPN, we get this error:
Error Description:  766: A certificate could not be found. Connections that use the L2TP protocol over IPSec require the installation of a machine certificate, also known as a computer certificate.

Because our Meraki Security Appliance ONLY uses a pre-shared key and there's no remote access server in the picture, I believe that this is a Windows limitation (Windows is trying to protect me from using pre-shared keys). I thought this Microsoft article would help:
https://support.microsoft.com/kb/240262

but it seems to discuss a remote access server which is not part of the picture.

I'm sure there are some registry tweaks needed to suppress Microsoft looking for a certificate - the question is where. Any ideas?

Thanks!
0
Comment
Question by:workforceinsight
12 Comments
 
LVL 11

Expert Comment

by:diprajbasu
ID: 39793436
here, the certificate you are asking for must be requested from Certificate authority(CA).

you need to install this certificate inside machine store of the VPN server.


the certificate should include the following details:

   1.  Common name (CN): Same as the hostname OR IP  address that is configured as VPN destination on the VPN client of your network.

   2.  Extended Key Usage (EKU):   “Server Authentication” and “IP Security IKE intermediate”.

   3.  Key Usage: Select Digital signature and Key encipherment( algorithm for performing encryption and decryption)
0
 

Author Comment

by:workforceinsight
ID: 39794058
Hello,

Thanks for commenting. Unfortunately, the VPN server is a firewall appliance that ONLY allows for a pre-shared key - no certificate.

I'm hoping to turn off Windows' need to seek out a certificate because it cannot apply to this situation.

Thanks,
0
 
LVL 45

Expert Comment

by:Craig Beck
ID: 39804596
What type of VPN is the firewall appliance configured to allow?  In your error message it looks like you're using a L2TP VPN.  That's quite uncommon.  I'd imagine you're using an IPSec VPN instead.
0
 

Author Comment

by:workforceinsight
ID: 39812570
Hello, craigbeck,

Thanks - you are correct, we're using an IPSec VPN.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 59

Expert Comment

by:LeeTutor
ID: 39868343
I've requested that this question be deleted for the following reason:

The question has either no comments or not enough useful information to be called an "answer".
0
 

Author Comment

by:workforceinsight
ID: 39868282
Figured it out:

1. Run "regedit", allocate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters, and delete ProhibitIpSec key.
2. Restart Windows, and try to connect VPN again.
0
 

Accepted Solution

by:
workforceinsight earned 0 total points
ID: 39868283
1. Run "regedit", allocate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters, and delete ProhibitIpSec key.
2. Restart Windows, and try to connect VPN again.
0
 

Author Comment

by:workforceinsight
ID: 39868640
I've requested that this question be closed as follows:

Accepted answer: 0 points for workforceinsight's comment #a39868283

for the following reason:

Registry fix is the solution
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
ZIP or ZIPX 8 70
Eclipse Neon start with Admin account only 6 47
Command to modify Registry entry 5 83
Gateway Resilience 4 16
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now