How to access Wi-Fi automatically after set up Radius Server

Unanswered How to access Wi-Fi automatically after set up Radius Server

All Replies

  • Wednesday, August 29, 2012 1:59 PM
     
     

    To setup 802.1x certificate based wireless access is somewhat complex. Maybe you can tell us where you are having problems if it;s not working. Error messages would be helpful, as well as what the operating system version and service pack level of the server that you used to install certificate services, as well as if you created a certificate from a v2 template, set the permissions correctly, and if you setup a GPO for autoenrollment.


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Thursday, August 30, 2012 2:22 AM
     
     

    Thank you Ace

    i used to work in a company. their network infrastructure like this--they used Windows 7 for client and connected wireless automatically without any password when user log on,i learned that there's user certificate from Radius Server works.

    i have already added certifcate services and NAP services in a Server 2008.i just wanna know how to set the permissions or user certificate so that user can connect wireless without any prompt.Plus, can you show me how to deploy this with Group Policy

    thank you very much

  • Thursday, August 30, 2012 2:45 AM
     
     

    Hi Anthony,

    Setting this up is a very length procedure. The last time I did it, it took me 3 weeks in between other tasks and assistance from Cisco to configure an AP 1231.

    Whatever AP you are using, it must support 802.1x wireless.

    I see you have Windows 2008. You didn't state the Edition, but you MUST install Certificate Services on a Windows 2008 Enterprise Edition because that is what provides the ability to create a v2 certificate from a v2 Certificate Template. Standard does not have this feature. Windows 2008 R2 Standard does, but without web-enrollment, but we usually simply opt to use the Enterprise Edition.

    And when you create the template, choose WIndows 2003 compatible, not 2008, or it won't work.

    .

    Here are some links. I hope you find them helpful.

    Configure RRAS and Radius to work with WIFI wireless certs

    The following are non-Microsoft links that provide screenshots and explanations. Note: Since the web sites are not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    Setting up Wi-Fi Authentication in Windows Server 2008 (Part 1)
    http://www.windowsnetworking.com/articles_tutorials/Setting-up-Wi-Fi-Authentication-Windows-Server-2008-Part1.html

    Setting up Wi-Fi Authentication in Windows Server 2008 (Part 2)
    http://www.windowsnetworking.com/articles_tutorials/Setting-up-Wi-Fi-Authentication-Windows-Server-2008-Part2.html


    The passage below was quoted from:
    http://social.technet.microsoft.com/Forums/en/winserverNIS/thread/f6382dfc-7f6e-4b0b-9098-281ce82758ad
    Extensible Authentication Protocol (EAP) extends Point-to-Point Protocol (PPP) by enabling additional authentication methods that use credential and information exchanges of arbitrary lengths. With EAP authentication, both the network access client and the authenticator (such as the NPS server) must support the same EAP type for successful authentication to occur. However, PEAP-MS-CHAP v2 is easier to deploy than EAP-TLS because user authentication is performed by using password-based credentials (user name and password), instead of certificates or smart cards. Only NPS or other RADIUS servers are required to have a certificate. The NPS server certificate is used by the NPS server during the authentication process to prove its identity to PEAP clients.
    For more information, please also read the following Microsoft TechNet articles:

    802.1X Authenticated Wireless Access
    http://technet.microsoft.com/en-us/library/cc771455(WS.10).aspx

    Integrating Wireless Access Points with RADIUS and AD.
    http://www.hansenonline.net/Networking/wlanradius.html

    AD CS Step-By-Step Guide (about setting up a CA with wireless and autoenrollment):
    http://www.microsoft.com/DOWNLOADS/details.aspx?familyid=44315BFF-B744-4637-A66B-E69B4955EE45&displaylang=en

    Good discussion on  wireless 802.1x and Cisco APs:
    Thread - Moving Certificate Services
    http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/227591ef-ae8b-4eb3-8450-d626b59eb8ac

    Good discussion on  wireless 802.1x and Cisco APs:
    Thread - Configuring NPS for AD authentication on a Cisco router? 3/10/2012
    http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/bf5634bd-c3ca-4c19-9622-9238e5ef8e2f/

    Cisco IOS - fu#7 - Cisco + RADIUS + Windows Server 2008 NPS
    http://www.darylhunter.me/blog/2010/06/cisco-ios-fu-7-cisco-radius-windows-server-2008-nps.html

    .

    .

    And sorry not able to post a complete step by step on how to set it up, but it is a VERY LENGTHY procedure with numerous tasks involved, and each AP is different. I usually recommend to purchase a Cisco AP or compatible competitive name brand and model that supports 802.1x. If you purchase a Cisco device, make sure you get a 24x7 Gold support contract, because Cisco support will actually step you through the procedure step by step, even on the Windows side, to an extent.

    Read the info above, look at the Microsoft step by step guide. THis will give you a feel for it, then set up what you can, and test it. Let us know how far you get and where it failed.


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Thursday, August 30, 2012 6:39 AM
     
     

    Hey,Ace

    Thank you so much, that's really helpful to me. BTW, do u have any instructions about deploying them with Group Policy

    Thanks again

  • Friday, August 31, 2012 2:30 AM
    Moderator
     
     

    Hi Anthony,
     
    BTW, do u have any instructions about deploying them with Group Policy

    Ace Fekay posted Guide (802.1X Authenticated Wireless Access) already covered instruction about Wireless Network (IEEE 802.11) Policies.

    http://technet.microsoft.com/en-us/library/dd283034(WS.10).aspx

    Regards,


    Rick Tan

    TechNet Community Support

    • Proposed As Answer by Ace Fekay [MCT]MVP Friday, August 31, 2012 2:35 AM
    • Unproposed As Answer by Anthony Fu Wednesday, September 05, 2012 1:01 PM
    •  
  • Friday, August 31, 2012 2:40 AM
     
     

    Anthony,

    In addition, look at the link that I previously posted above that has the word "Autoenrollment" in it. That's what you will be configuring to give out certificates in a GPO. And don't forget, it must be a version 2 Windows 2003 certificate. I keep reiterating v2, because it won't work with any other type. Please re-read that part so you understand.

    .

    More info:

    Good discussion with links for how-to
    Technet thread: "Help/How to - Setting up Certificate servers on a Domain." 3/26/2012
    http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/8f0a4abf-a3e4-4966-9965-1711a55f2e4f/

    If you want to configure a GPO Autoenrollment and 802.1x (for wireless), you must use Windows Enterprise Edition, not Windows Standard Edition, because Enterprise provides v2 certs. The only exception is Windows 2008 R2 Standard, which provides v2, but it does not allow you to use web enrollment.

    .

    Here are some articles on how to set up Microsoft CA's and deploy certificates to users.

    .

    Core Network Guides for Windows Server 2008 R2, Updated: August 5, 2010
    The following guides are featured on this page:
    Windows Server 2008 R2 Core Network Guide
    Core Network Companion Guide: Deploying Server Certificates
    Core Network Companion Guide: Deploying Computer and User Certificates
    Core Network Companion Guide: Deploying Password-based 802.1X Authenticated Wireless Access
    http://technet.microsoft.com/en-us/library/dd894464(WS.10).aspx

    .


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Friday, August 31, 2012 3:51 AM
     
     

    Thank u Ace

    I got it, i'll read it carefully.

    BTW, my server is running Windows Server 2008 Enterprise Edition,i'll check it if there is v2 certificate in it

    Thank you very much

  • Friday, August 31, 2012 5:52 AM
     
     

    Thank u Ace

    I got it, i'll read it carefully.

    BTW, my server is running Windows Server 2008 Enterprise Edition,i'll check it if there is v2 certificate in it

    Thank you very much

    You are welcome.

    And I'm not sure what you mean by if there is a v2 certificate "in it." What I mean is you must install Certificate Services" on an Enterprise edition. When it's on a 2008 Enterprise Edition, you now have the ability to create a v2 certificate from a V2 Certificate Template in certificate server console.

    When you do, choose the "Windows 2003" version.

    As you read up on it, it will make more sense.

    .


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Monday, September 03, 2012 3:51 AM
     
     

    Hello Ace,

    How about weekend~

     I still have some problems about "you now have the ability to create a v2 certificate from a V2 Certificate Template " I installed Certificate Services and added a personal certificates as below pics, but i could't figure out v2 certificate from a v2 Certificate Template, i could't find "Windows 2003" version.

    Thank you

    Anthony

               

  • Monday, September 03, 2012 4:37 AM
     
     
    Is the issuing CA on WIndows 2008 Enterprise edition?

    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Monday, September 03, 2012 4:57 AM
     
     

    See if this helps:

    Adding the Certificate Templates to the Certification Authority
    http://www.spywarepoint.com/adding-certificate-templates-certification-authority-t38775.html


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Monday, September 03, 2012 4:59 AM
     
     

    Yes

    i'm trying to find "create a v2 certificate from a V2 Certificate Template" you ever told me, but i don't know where is and how could i create it  

  • Monday, September 03, 2012 8:18 AM
     
     

    Sorry, Ace

    I'm afraid i couldn't find the answer from the above website.

    I noticed that Certificate Templates had a tab named Minimum Supported CAs, it had some Windows Server 2003 options under it. I'm not sure if there has connections with v2 certificate from a v2 certificate template

    Thank you

    Anthony

  • Monday, September 03, 2012 3:12 PM
     
     

    I think you're going about it wrong. Try this:

    .

    clip_image018

    clip_image020

    .

    Call it Wireless User Auth:

    clip_image022

    .

    Then configure it for Autoenrollment (this way it's ready for the GPO that you will create to automatically distribute the certificates through Autoenrollment):

    clip_image016

    .

    And more. Follow the steps at:

    Designing and Implementing a PKI: Part III Certificate Templates
    http://blogs.technet.com/b/askds/archive/2010/05/27/designing-and-implementing-a-pki-part-iii-certificate-templates.aspx

    .

    Then you can repeat it to create a Computer certificate, if you decide to use machine authentication, too.

    .


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Wednesday, September 05, 2012 7:55 AM
     
     

    Thank you Ace

    I read the website"Designing and Implementing a PKI", it's very helpful for me.

    i did follow actions 

    a.Created user certificate template in Certificate Template, configured General tab, request handling tab security tab about it.

    b.Added the certificate template i configured in Certification Authority.

    c.Set Certificate Services Client - Auto-Enrollment to enable in Default Domain Policy--User Configuration--Policies--Windows Settings--Security Setting--Public Key Policies

    d.Updated Group Policy

    I'm not sure whether 4 steps from above can apply the certificate to Default Domain Policy or not, and then how can i deploy this policy to client

    Thank you

    Anthony

  • Wednesday, September 05, 2012 10:16 AM
     
     
    We should never touch the default Domain GPO. Create a separate, new GPO for this purpose. One of the links I posted earlier shows how to configure an Autoenrollment GPO.

    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Wednesday, September 05, 2012 1:27 PM
     
     

    Thank you Ace

    I noticed that one of the links as below is about how to configure an autoenrollment Gpo

    I wanna ask that after I configure user certificate autoenrollment in GPO, how can i autoenrollment this GPO to client. After finishing that, how can i check whether the client apply this GPO rightly or not.

    Thank you very much

    Anthony

  • Thursday, September 06, 2012 3:06 AM
     
     

    Thank you Ace

    I noticed that one of the links as below is about how to configure an autoenrollment Gpo

    I wanna ask that after I configure user certificate autoenrollment in GPO, how can i autoenrollment this GPO to client. After finishing that, how can i check whether the client apply this GPO rightly or not.

    Thank you very much

    Anthony

    > how can i autoenrollment this GPO to client

    Click on the link in the picture, "Configure Computer Certificate Autoenrollment." It should have the directions to configure Autoenrollment settings in a GPO.

    .

    > how can i check whether the client apply this GPO rightly or not

    On the client, run gpresult /R to see if the client got the GPO applied.

    Then create an MMC (start, type in mmc, enter), then add the Certificates snap-in, choose This Computer, then expand Personal. You should see the cert in there, if the GPO was configured properly, and GPOs are applying to the machines.


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Tuesday, September 11, 2012 6:49 AM
     
     

    Thank you Ace

    I can see the cert under Certificates(Local Computer) on my client MMC, but i can not see any user cert under Certificates-Current User

    I configured it according to the link in the picture, "Configure User Certificate Autoenrollment", but it still not working.

    I suspected that there's something wrong with my GPO, Here is picture about my Group Policy Management, can you tell me which wrong is it.

    BTW, i can see administrator cert under Certificates -Current User in Server

    Thank you very much

    Anthony

  • Friday, September 14, 2012 2:24 AM
    Moderator
     
     

    Hi Anthony,

    1. User certificate autoenrollment requires three steps, please double check autoenroll permission on the certificate templates

    http://technet.microsoft.com/en-us/library/dd379539(WS.10).aspx

    2. Run rsop.msc on your client to verify if the GPO is applied successful

    3. Other idea is to manual click task--request new certificate via MMC console. You will see the user certificate template if you have correct permission in the wizard

    4. Try to enable GP Certificate Services Client - Certificate Enrollment Policy. Here is a thread which user resolve the issue in this way.
    http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/38499c50-d706-4afc-a8b7-4d9bcd614bfb

    Good Luck!

    Regards


    Rick Tan

    TechNet Community Support

  • Friday, September 14, 2012 3:17 AM
     
     

    Hi Anthony,

    Sorry for the late reply. I am on the road this week and quite busy. I am glad Rick was able to jump in.

    In addition, I would also suggest that you make sure the Autoenroll is checked in the certificate permissions. Look at my previous screenshot. Highlight Authenticated Users, and make sure Autoenroll is checked. 


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Friday, September 14, 2012 8:12 AM
     
     

    Hi Rick,

    Thank you for you reply

    I configured it according to the follow website you gived me

    http://technet.microsoft.com/en-us/library/dd379539(WS.10).aspx

    But when i ran step there--Configure an enterprise CA, there is somthing wrong about it, i couldn't fould Certificate Template to Issue option under the Certificate Templates

    Here is the picture about this issue. How can i fix it.

    Thank you

    Anthony

  • Friday, September 14, 2012 8:35 AM
    Moderator
     
     

    Hi Anthony,

    The previous article have already guided it.
    http://blogs.technet.com/b/askds/archive/2010/05/27/designing-and-implementing-a-pki-part-iii-certificate-templates.aspx

    clip_image028

    Regards


    Rick Tan

    TechNet Community Support

  • Monday, September 17, 2012 6:56 AM
     
     

    Hi Rick

    Thanks for you reply

    I found Certificate Template to Issue option and selected certificate template which i wanna enrollment

    After that, i run rosp.msc on the client, and there's Resultant Set of Policy pop up, but i still counld't see any user certificate under the Certificates-Current User--Personal--Certificates. how can i figure out it works or not

    Thank you

    Anthony

  • Monday, September 17, 2012 7:29 AM
    Moderator
     
     

    Hi Anthony,

    Run rosp.msc is to verify the policy on your client (check if autoenrollment policy enabled in resultant Set of Policy). Update your client policy, please run "gpupdate /force" and reboot your client.

    Regards


    Rick Tan

    TechNet Community Support

  • Monday, September 17, 2012 8:02 AM
     
     

    Hi Rick

    How can i check if autoenrollment policy enabled in resultant set of policy?

    User comfiguration--security settings--public key policies--certificate services client-auto-enrollment?

    Anthony

  • Monday, September 17, 2012 10:35 PM
     
     

    Hi Rick

    How can i check if autoenrollment policy enabled in resultant set of policy?

    User comfiguration--security settings--public key policies--certificate services client-auto-enrollment?

    Anthony

    You should see the GPO show up in the list of GPOs when you run the RSOP. You can simply run gpresult /R to see the list of GPOs on the client, too. Also check the Computer certificate section in the Certificates snap-in on the client machine.

    .


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Wednesday, September 19, 2012 6:31 AM
     
     

    Hi Ace

    I can get certificates under the Computer certificate section

  • Wednesday, September 19, 2012 6:44 AM
     
     

    Hi Ace,

    I ran gpresult /r on the client, but i suspected that there's something wrong with GPO

    Here are two pics about Gpresult /r and Group Policy Management, pls help me point out mistakes

    Thank you

    Anthony

  • Wednesday, September 19, 2012 3:55 PM
     
     

    Why isn't the Default Dpomain Policy being applied? Please click on Enforce for the Default Domain Policy, then re-run gpupdate.

    I still think it's something in the GPO for the cert.

    But your machine is getting a cert, which is a good thing, but not the user. On the properties of the certificate template, I assume you selected the AD Group that you are allowing to obtain a certificated, and the user account, John Lennon is in the group?


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Thursday, September 20, 2012 3:31 AM
     
     

    Hi

    I enforced the Default Domain Policy and re-run it

    Here are two pics about certificate template and Group Policy management

    Thank you

    Anthony

  • Thursday, September 20, 2012 3:44 AM
     
     

    Your GPMC shows the cert GPO is the "For All Users"  GPO. Correct?

    But the gpresult /R you ran shows the "For All Users" GPO is not being applied, and  is Denied (Security):


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

  • Thursday, September 20, 2012 5:50 AM
     
     

    Yes, For All User is Certificate GPO

    I realized that For All User is not being applied, but this GPO's setting is same as For Administrator except Security Filtering, i have no idea why

    This pic is result of gpresult /r up to date

    Thank you

    Anthony

  • Friday, September 21, 2012 2:34 AM
    Moderator
     
     

    Hi Anthony,

    In your For All user policy security filtering list Certificate group.
    Please verify the user account is the member of Certificate group or use Authenticated users group instead.

    By default, the policy security filtering set to Authenticated users group which include domain computers and users.
    If the policy is computer based policy, set the security filtering to computer group.
    If the policy is user based policy, set the security filtering to computer group.

    Regards


    Rick Tan

    TechNet Community Support

  • Friday, September 21, 2012 7:13 AM
     
     

    Hi Rick

    Thank you for your reply

    I added Authenticated Users in For All User policy Security Filtering list, but it still have no user certificate on the client

    I ran gpresult /r on client, and the result show that For All Users GPO was applied

    Thank you

    Anthony


    • Edited by Anthony Fu Friday, September 21, 2012 7:16 AM
    •  
  • Monday, September 24, 2012 11:55 PM
     
     

    You're doing something fundamentally wrong. For starters, see if this helps. I have a 170 page document on how I did it in the past, however, it took me weeks to perfect it, and I got Cisco Support to assist me with it, but I did most of the work on my own from researching Microsoft's Technet documentation, because believe it or not, you will find all the step by steps in Microsoft's Technet articles, and from the documentation that I posted, as well as Rick. I assume you've been reading through the documentation, instead of just trying this or trying that from our suggestions?

    I suggest if this is for a company solution, the best bet, and I *assume* you're using a Cisco AP, to get Cisco involved, because they will help you from start to finish.

    In the meantime, I will be putting together a multi-part blog from my documentation. However, until I'm ready to publish it, because remember, it will take me time because it's about 170 pages, and I'm doing this in my spare time from work (I am a trainer and a consultant, and no, I do not work for Microsoft).

    For starters, see if this portion helps. I couldn't post the associated screenshots due to the vast number of them. This is only part of it. But as I said, if you have a Cisco unit and a support contract, Cisco will assist you with it. If not, you will need to research some of this stuff on your own, because each device is different.

    .

    Late Edit:

    I created a multi-part, Parts 1 to 9, blog post on how to do this from start to finish. Here's Part 1. You'll see links on the bottom for the remaining 8 parts. Let me know if it doesn't populate.

    802.1x Wireless Implementation: Part 1 – Setting up an Offline CA Root
    http://blogs.msmvps.com/acefekay/2012/09/25/802-1x-wireless-implementation-part-1-setting-up-an-offline-ca-root/



    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBookTwitterLinkedIn