ultrak2
February 12, 2015, 8:27pm
1
Greetings!
I am in the process of setting up my DC as a RADIUS server for wireless authentication. I was wondering if it was possible for devices that are not able to join a domain (Windows 7 Home Edition) to join using a valid AD account and password. We have some stragglers whose computers aren’t upgraded but use an AD account for things like file shares.
And documentation links would be greatly appreciated.
Server: Windows Server 2008 R2 Standard
Meraki APs
1 Spice up
Totally. Auth queries the NPS/AD, no need for the computer to actually be part of the domain.
Here’s some good info. The wireless side is on a cisco controller, but the NPS side is what you’re looking for anyway.
For Meraki, each AP you have needs to be a RADIUS client in NPS. I’ve ran into a problem where if the RADIUS shared key is too complex, Meraki APs don’t seem to like it. It may have been fixed, but just something to look out for.
2 Spice ups
ultrak2
February 12, 2015, 11:50pm
4
Thanks a lot Steve! I was able to get the Meraki APs added as clients and domain PC’s to join the network but when I try to join from a non-domain PC I get a UAC style prompt. After entering a user and password I’m prompted with an EAP-TTLS prompt that asks for Domain\user name and password (token). When I enter a valid account and password I get a “Windows is unable to Connect” error. It’s strange because when I connect via an iphone I simply put in a username/password and accept a certificate.
steveb1352
February 13, 2015, 12:11am
5
Are you actually using TLS as an EAP method, or PEAP? What do the NPS logs say?
https://communities.intel.com/servlet/JiveServlet/previewBody/4321-102-1-7037/SImple%20NPS%20Configuration%20as%20Radius%20Part%201.pdf
Check that link too to verify config with another NPS guide. That has NPS for wired, but just replace that with wireless.
Can you screen shot your network policy tabs and post them quick
ultrak2
February 13, 2015, 4:13pm
6
The logs show Event ID 6273 Denied access to a user. The user I am attempting to add is part of the allowed security group as well.
ultrak2
February 13, 2015, 6:13pm
7
So on the Windows Home machine if I edit the wireless connection properties untick the Validate Server certificate, remove the automatic login with local credentials, and then specify the AD account with permission to join I can join!
This seems like more of a band-aide than a fix… Maybe this will help us push everyone to domain PCs.
Thank you very much for the help!
1 Spice up
