Network Center for IT Pros

The Help for Network Connections is now part of the documentation for Network Center, and can be found on the Microsoft Web site at the locations described here.
General information about Network Center
  • For more information, see the documentation available at Network Center for the IT Pro (http://go.microsoft.com/fwlink/?linkid=58934).

General information about Modems and TAPI
  • For more information, see the documentation available at Modems and TAPI for the IT Pro (http://go.microsoft.com/fwlink/?linkid=62174).

Troubleshooting documentation

Extensive troubleshooting information is available in these documents:

  • Network Center Operations Guide (http://go.microsoft.com/fwlink/?linkid=63530)

  • Modems and TAPI Operations Guide (http://go.microsoft.com/fwlink/?linkid=62209)


XP Wireless Network Policy - General

Wireless network settings in the Wireless Network (IEEE 802.11) Policies Group Policy extension include global wireless settings, the list of preferred networks, WEP settings, and IEEE 802.1X settings. These settings encompass all of the items on the Association and Authentication tabs in the properties dialog box for a wireless network on a wireless client running Windows XP with SP2, Windows XP with SP1, or Windows Server 2003, as well as additional settings.

General - Configuration Items

Item Details

XP Policy Name

Provides a location for you to type a friendly name for the wireless network policy.

Note

When you name the Wireless Network (IEEE 802.11) Policy, the name you specify is displayed as the name of the associated properties page, and under XP Policy Name in the details pane in the Group Policy Management Console (GPMC) for that policy.

Description

Provides a location for you to type a description for the wireless policy.

Note

The description you type for is displayed under Description in the details pane of the Group Policy Management Console (GPMC) for that policy.

Networks to access

Specifies the types of wireless networks with which the wireless client is allowed to create connections:

  • Any available network (access point preferred)

  • Access point (infrastructure) networks only

  • Computer-to-computer (ad hoc) networks only

Use Windows WLAN Auto Config service for clients

Enables the Wireless Zero Configuration service. When enabled, the Wireless Zero Configuration service is used to configure and connect clients running Windows XP to wireless networks.

Note

Clients running Windows XP use Wireless Zero Configuration while Clients running Windows Vista use WLAN AutoConfig Service.

Automatically connect to non-preferred networks

Specifies that wireless clients can attempt to automatically connect to wireless networks that are not configured as preferred networks.

If selected, your domain-member wireless clients can connect to a non-preferred network after first attempting to connect to preferred networks.


Vista Wireless Network Policy - Security

Security configuration items include all of the settings on the Security tab. These settings specify whether to perform 802.1X authentication for connecting clients, which network security authentication method to use, and which network authentication method to use.

Security - Configuration Items

Network Security Method - Configuration Items pertain to the authentication and security that the client uses to exchange data with the wireless access point.

Network Authentication Method - Configuration Items pertain to the EAP method that is used for 802.1X authenticated network access.

Network Security Method - Configuration Items

Item Details

Authentication

Specifies the security authentication method to use when the wireless client associates with the wireless access point.

  • Open

  • Shared

  • WPA-Enterprise

  • WPA-Personal

  • WPA2-Enterprise

  • WPA2-Personal

  • Open with 802.1X

Note

Network Authentication Methods and advanced settings are only exposed by selecting WPA-Enterprise, WPA2-Enterprise, and Open with 802.1X for the network security authentication method.

Default = Defaults to the most secure setting supported by the wireless hardware and drivers.

Encryption

Specifies the security encryption to use for the selected network security authentication method.

If the Authentication is set to WPA-Enterprise, WPA-Personal, WPA2-Enterprise, or WPA2-Personal, the encryption options are AES or TKIP.

If Authentication is set to Open, Shared, or Open with 802.1X, then encryption options are either WEP or Disabled.

Network Authentication Method - Configuration items

Item Details

Select a network authentication method

Specifies the network authentication method that connecting wireless clients use.

  • Smart Card or other certificate

  • Protected EAP (PEAP)

Default = Protected EAP (PEAP)

Properties

Opens the properties page of the selected network authentication method.

For setting information for network authentication methods, see:

Authentication Methods Properties

Authentication Mode

Specifies how credentials are used for network authentication. The following options are available.

  • User re-authentication. An 802.1X-compliant device always uses security credentials based on the computer's current state. Authentication is performed by using the computer credentials when no users are logged on to the computer. When a user logs on to the computer, authentication is always performed by using the user credentials.

    This is the recommended setting.

  • Computer only. Authentication is always performed using only the computer credentials.

  • User authentication. Specifies that when users are not logged on to the computer, authentication is performed by using the computer credentials. After a user logs on to the computer, authentication is still based on the computer credentials. Authentication is preformed by using the user credentials if the user travels to a new wireless access point.

  • Guest authentication. Allows connections to the network which are regulated by the restrictions and permissions set for the Guest user account.

Default = User re-authentication

Max Authentication Failures

Specifies the maximum number of failed authentication attempts that can occur with a specific set of credentials before notification is displayed to indicate that authentication has failed.

Default = 3

Clear credentials after logoff

Specifies that when the user logs off, the user credential data is removed from the registry. The result is that at the next user log on, they will be prompted for their credentials (such as user name and password).

Default = Not enabled

Authenticate as guest when user or computer information is unavailable

Specifies that client connection requests that cannot meet computer or user authentication requirements can connect to the network by using permissions configured for the Guest account.

Default = Not enabled

Advanced

Provides access to advanced security settings.


Vista Wired Network Policies - Security

Security configuration items include all of the settings on the Security tab. These settings specify whether to perform 802.1X authentication for connecting clients and which network authentication method to use.

Security - Configuration Items

Item Details

Enable use of IEEE 802.1X authentication for network access

Specifies that 802.1X authentication is performed for access requests to the wired network.

Default = enabled

Select a network authentication

  • Specifies the network authentication method that connecting clients use:

  • Smart Card or other certificate (EAP-TLS)

  • Protected EAP (PEAP)

Default = Protected EAP (PEAP)

Properties

Opens the properties page of the selected network authentication method.

For setting information specific to network authentication methods, see:

Authentication Methods Properties

Authentication Mode

Specifies how network authentication is performed:

  • User re-authentication. An 802.1X-compliant device always uses security credentials based on the computer's current state. Authentication is performed by using the computer credentials when no users are logged on to the computer. When a user logs on to the computer, authentication is always performed using the user credentials.

    This is the recommended setting.

  • Computer only. Authentication is always performed using only the computer credentials.

  • User authentication. Specifies that when users are not logged on to the computer, authentication is performed by using the computer credentials. After a user logs on to the computer, authentication is still based on the computer credentials. Authentication is preformed by using the user credentials if the user travels to a new wireless access point.

  • Guest authentication. Allows connections to the network that are regulated by the restrictions and permissions set for the Guest user account.

Default = User re-authentication

Clear credentials after logoff

Specifies that when the user logs off, the user credential data is removed from the registry. The result is that at the next user log on, they will be prompted for their credentials (such as user name and password).

Default = Not enabled

Authenticate as guest when user or computer information is unavailable

Specifies that client connection requests that cannot meet computer or user authentication requirements can connect to the network by using permissions configured for the Guest account.

Default = Not enabled

Max Authentication Failures

Specifies the maximum number of failed authentication attempts that can occur with a specific set of credentials before notification is displayed to indicate that authentication has failed.

Default = 3

Enforce advanced 802.1x settings

Specifies that that the settings listed are enforced as configured:

  • Max Start

  • Held Period (seconds)

  • Start Period (seconds)

  • Auth Period (seconds)

  • Eapol-Start Message

Max Start

EAPOL is the Extensible Authentication Protocol (EAP) over local area network (LAN) protocol.

If no response is received to the original EAPOL-Start message, this setting specifies the maximum number of subsequent EAPOL-Start messages sent.

Default = 3

Held Period (seconds)

After a client has received notification of authentication failure, this setting specifies the number of seconds an authenticating client waits before it performs another 802.1X authentication request.

Default = 60

Start Period (seconds)

If no response is received to the original EAPOL-Start message, this setting specifies the number of seconds between the retransmission of subsequent EAPOL-Start messages.

Default = 5

Auth Period (seconds)

After end-to-end 802.1X authentication is initiated, this setting specifies the number of seconds authenticating clients must wait before retransmitting any 802.1X requests.

Default = 30

Eapol-Start Message

Specifies the transmission behavior of the EAPOL-Start message when authenticating. You can select from the following:

  • Do not transmit. Specifies that EAPOL-Start messages are not sent.

  • Transmit Determines. Specifies when to send EAPOL-Start messages and, if needed, sends an EAPOL-Start message.

  • Transmit per IEEE 802.1x. Sends an EAPOL-Start message upon association to initiate the 802.1X authentication process.


Authentication Methods Properties

You can configure the properties of Extensible Authentication Protocol (EAP) authentication methods to specify authentication parameters for EAP.

Authentication method properties are accessed by:

  • Selecting either of the network authentication methods in the Select a network authentication drop-down list on the Security tab in the Wired Network (IEEE 802.3) Policy or in the Wireless Network (IEEE 802.11) Policy for Windows Vista®.

  • Selecting either of the network authentication methods in the EAP Type drop-down list on the IEEE 802.1x tab in the Wireless Network (IEEE 802.11) Policy for Windows XP.

Authentication Methods

This topic contains configuration information specific to the following authentication methods:

  • EAP-Transport Layer Security (TLS) Smart Card or Other Certificate Properties - Configuration Items for EAP-TLS

  • Protected EAP (PEAP) Protected EAP (PEAP) Properties- Configuration Items

    Additionally, this section contains setting information for two EAP types within PEAP:

    • EAP-TLS Smart Card or Other Certificate Properties - Configuration Items for EAP-TLS

    • EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) Secure password (EAP-MSCHAP v2) Properties - Configuration Items

      Note

      EAP-MS-CHAP v2 is available only with PEAP.

This topic presents information for settings that are shared by the Wireless Network IEEE 802.11 Policy for Windows Vista and Windows XP, as well as the Windows Vista Wired Network (IEEE 802.3) Policy. To return to the topic specific to the Group Policy you are configuring, select from the following:

  • Vista Wired Network Policies - Security

  • Vista Wireless Network Policy - Security

  • XP Wireless Network Policy - IEEE 802.1X

Smart Card or Other Certificate Properties - Configuration Items for EAP-TLS

Item Details

Use my smart card

Specifies that clients making authentication requests (supplicants) will present a smart card certificate for network authentication.

Default = Not enabled

Use a certificate on this computer

Specifies that authenticating clients will use a certificate located in the either the Current User or Local Computer certificate stores.

Default = Enabled

Use simple certificate selection

Specifies that Windows attempts to simplify the list of certificates from which the user is prompted to select.

Default = Enabled

Validate server certificate

Verifies that the server certificates presented to your users' computers have the correct signature, have not expired, and were issued by a trusted root certification authority (CA).

Important

Do not disable this check box or client computers will not verify the identity of your servers during the authentication process. If server authentication does not occur, users are exposed to severe security risks, including the possibility that users might unknowingly connect to a rogue network.

Default = Enabled

Connect to these servers

Allows you to specify the name for Remote Authentication Dial-In User Service (RADIUS) servers that provide network authentication and authorization.

Note

You must type the name exactly as it appears in the Subject field of each RADIUS server's certificate.

Default = Not enabled

Note

Even if no RADIUS servers are specified, the client will still verify that the RADIUS server certificate was issued by a trusted root CA.

Trusted Root Certification Authorities

The list in Trusted Root Certification Authorities is built from the trusted root CAs installed in the computer and user certificate stores. You can designate which trusted CA certificates that supplicants use to determine whether they trust your servers, such as your IAS server or provisioning server. If no trusted root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by an installed Trusted Root CA. If one or multiple Trusted Root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by a selected trusted root CA.

If you have deployed Public Key Infrastructure (PKI) on your network, and have issued a RADIUS server certificate, that certificate will be automatically added to the list of trusted root CAs. The root CA is installed on a client computer when the computer is joined to a domain against which the RADIUS certificate is verified.

You can also purchase a server certificate from a third-party vendor. Some third-party trusted root CAs provide software with your purchased certificate that automatically installs the purchased certificate into the trusted root certification authorities store; in this case the trusted root CA automatically appears in the list of trusted root CAs.

Notes
  • The trusted root CA certificates that you designate must already be installed on client computers. Do not specify a trusted root CA certificate that client computers do not already have in the trusted root certification authorities stores for Current User and Local Computer.
  • If you designate a certificate that is not installed on client computers, authentication will fail.

Default = Not enabled, no trusted root CAs selected.

Note

Even if no trusted root CAs selected, the client will still verify that the RADIUS server certificate was issued by a trusted root CA.

View Certificate

You can select a trusted root CA, and then click View Certificate to view the associated certificate properties.

Use a different user name for the connection

Specifies whether to use a user name for authentication that is different from the user name in the certificate. If enabled, the user is prompted to select a user certificate, even if only one user certificate is installed. The certificate is used until the user terminates the session.

Default = Not enabled

Do not prompt user to authorize new servers or trusted certification authorities

If this check box is selected, this setting prevents the user from being prompted to trust a server certificate if that certificate is incorrectly configured, is not already trusted, or both. It is recommended that you select this check box in order to simplify the user experience and to prevent users from inadvertently choosing to trust a server deployed by an attacker.

Default = Not enabled

Protected EAP (PEAP) Properties- Configuration Items

Important

When you deploy both PEAP and EAP unprotected by PEAP, do not use the same EAP authentication type with and without PEAP. For example, if you deploy PEAP with EAP-TLS (PEAP-EAP-TLS), do not also deploy EAP-TLS without PEAP. Deploying authentication methods with the same type—one with and the other without the protection of PEAP—creates a security vulnerability.

Item Details

Validate server certificate

Verifies that the server certificates presented to your users' computers have the correct signature, have not expired, and were issued by a trusted root CA.

Important

Do not disable this check box or client computers will not verify the identity of your servers during the authentication process. If server authentication does not occur, users are exposed to severe security risks, including the possibility that users might unknowingly connect to a rogue network.

Default = Enabled

Connect to these servers

Allows you to specify the name for RADIUS servers that provide network authentication and authorization.

Note

You must type the name exactly as it appears in the Subject field of each RADIUS server's certificate.

Default = Not enabled

Note

Even if no RADIUS servers are specified, the client will still verify that the RADIUS server certificate was issued by a Trusted Root CA.

Trusted Root Certification Authorities

The list in Trusted Root Certification Authorities is built from the trusted root CAs installed in the computer and user certificate stores. You can designate which trusted root CA certificates that supplicants use to determine whether they trust your servers, such as your IAS server and your provisioning server. If no trusted root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by an installed trusted root CA. If one or multiple trusted root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by a selected trusted root CA.

If you have deployed Public Key Infrastructure (PKI) on your network, and have issued a RADIUS server certificate, that certificate will be automatically added to the list of trusted root CAs. The root CA is installed on a client computer when the computer is joined to a domain against which the RADIUS certificate is verified.

You can also purchase a server certificate from a third-party vendor. Some third-party trusted root CAs provide software with your purchased certificate that automatically installs the purchased certificate into the trusted root certification authorities store; in this case the trusted root CA will automatically appear to the list of trusted root CAs.

Notes
  • The trusted root CA certificates that you designate must already be installed on client computers. Do not specify a trusted root CA certificate that client computers do not already have in the trusted root certification authorities stores for Current User and Local Computer.
  • If you designate a certificate that is not installed on client computers, authentication will fail.

Default = Not enabled, no Trusted Root Certification Authorities selected.

Note

Even if no trusted root CAs are selected, the client will still verify that the RADIUS server certificate was issued by a trusted root CA.

Do not prompt user to authorize new servers or trusted certification authorities.

If this check box is selected, this setting prevents the user from being prompted to trust a server certificate if that certificate is incorrectly configured, is not already trusted, or both. It is recommended that you select this check box in order to simplify the user experience and to prevent users from inadvertently choosing to trust a server deployed by an attacker.

Default = Not enabled

Select Authentication Method

Allows you to select the EAP type to use with PEAP for network authentication.

Note

By default two EAP types are available, Secured password (EAP-MSCHAPv2) and Smart card or other certificate (EAP-TLS). However, EAP is a flexible protocol that allows inclusion of additional EAP methods, and is not restricted to these two types.

For information about Secured password (EAP-MSCHAPv2) or Smart card or other certificate (EAP-TLS) configuration settings, see:

  • Secure password (EAP-MSCHAP v2) properties - Configuration Items

  • Smart Card or other certificate Properties - Configuration Items for EAP-TLS

Default = Secured Password (EAP-MSCHAP v2)

Configure

Provides access to property settings for the specified EAP type.

Enable Fast Reconnect

Allows users to roam with their wireless computers between access points without being reauthenticated each time they encounter a new access point.

Fast reconnect works only when access points are configured as Remote Authentication Dial-In User Service (RADIUS) clients to the same Internet Authentication Service (IAS) server; if a client computer associates with an access point that is configured as a RADIUS client to a different IAS server, the authentication process occurs in full, including client authentication of the IAS server.

Default = Enabled

Enable Quarantine checks

Specifies that checks are performed on EAP supplicants to determine if they meet system health requirements, before connections to a network are permitted.

Default = Enabled

Disconnect if server does not present cryptobinding TLV

Specifies that connecting clients will end the network authentication process if the RADIUS server does not present cryptobinding Type-Length-Value (TLV). Selecting this check box allows the client to connect only if cryptobinding TLV is active.

Note

Cryptobinding TLV increases the security of the TLS tunnel in PEAP by combining the inner method and the outer method authentications together so that attackers cannot perform man-in-the-middle attacks by redirecting an MS CHAPv2 authentication through the PEAP channel.

Default = Not enabled

Secure password (EAP-MSCHAP v2) Properties - Configuration Items

Secure password EAP-MS CHAPv2 is an EAP type that is used with PEAP-MS CHAPv2, for password-base network authentication.

Item | Details
Automatically use my Windows logon name and password (and domain if any) | Specifies that the current user-based Windows logon name and password are used as network authentication credentials. Default = Enabled

See Also

  • Vista Wired Network Policies - Security
  • Vista Wireless Network Policy - Security
  • XP Wireless Network Policy - IEEE 802.1X


XP Wireless Network Policy - IEEE 802.1X

IEEE 802.1X settings specify the behavior of wireless clients when connecting to an infrastructure wireless network that is configured for 802.1X authentication. Settings include authentication methods, (such as Extensible Authentication Protocol (EAP), authentication mode, and 802.1X-specific parameters.

802.1X - Configuration Items

Item Details

Enable network access control using IEEE 802.1X

Specifies whether you want to use Institute of Electrical and Electronics Engineers (IEEE) 802.1X to perform authentication for your wireless network. If you clear this check box, all of the other settings on this tab become unavailable.

EAP Type

Specifies the network authentication method that connecting wireless clients use.

  • Smart Card or other certificate (EAP-TLS)

  • Protected EAP (PEAP)

Default = Protected EAP (PEAP)

Settings

Opens the properties page of the selected network authentication method.

For setting information for network authentication methods, see:

Authentication Methods Properties

Eapol-Start message

EAPOL is the Extensible Authentication Protocol (EAP) over local area network (LAN) protocol.

This setting specifies the transmission behavior of the EAPOL-Start message when authenticating. You can select from the following:

  • Do not transmit. Specifies that EAPOL-Start messages are not sent.

  • Transmit Determines. when to send EAPOL-Start messages and, if needed, sends an EAPOL-Start message.

  • Transmit per IEEE 802.1x. Sends an EAPOL-Start message upon association to initiate the 802.1X authentication process.

Authentication Mode

Specifies how credentials are used for network authentication. The following options are available.

  • User re-authentication. An 802.1X-compliant device always uses security credentials based on the computer's current state. Authentication is performed using the computer credentials when no users are logged on to the computer. When a user logs on to the computer, authentication is always performed using the user credentials.

    This is the recommended setting.

  • Computer only. Authentication is always performed using only the computer credentials.

  • User authentication. Specifies that when users are not logged on to the computer, authentication is performed by using the computer credentials. After a user logs on to the computer, authentication is still based on the computer credentials. Authentication is preformed by using the user credentials if the user travels to a new wireless access point.

  • Guest authentication. Allows connections to the network which are regulated by the restrictions and permissions set for the Guest user account.

Default = User re-authentication

Authenticate as computer when computer information is available

Specifies whether the computer will attempt to authenticate using computer credentials when the user is not logged on.

Computer credentials are typically a computer certificate.

Default = Enabled

Authenticate as guest when user or computer information is unavailable

Specifies that client connection requests that cannot meet computer or user authentication requirements can connect to the network by using permissions configured for the Guest account.

Default = Not enabled

Max Eapol-Start Msgs

If no response is received to the original EAPOL-Start message, this setting specifies the maximum number of subsequent EAPOL-Start messages sent.

Default = 3

Held Period

After a client has received notification of authentication failure, this setting specifies the number of seconds an authenticating client waits before it performs another 802.1X authentication request.

Default = 60

Start Period

If no response is received to the original EAPOL-Start message, this setting specifies the number of seconds between the retransmission of subsequent EAPOL-Start messages.

Default = 5

Auth Period

After end-to-end 802.1X authentication is initiated, this setting specifies the number of seconds authenticating clients must wait before retransmitting any 802.1X requests.

Default = 30


Vista Wireless Network Policy - General

Use the General tab to create and manage wireless network profiles and to define a list of preferred wireless networks, which prioritizes the order in which your domain-member clients attempt to connect. You can also specify whether the WLAN AutoConfig Service is used to configure 802.11 wireless adapters to connect to wireless networks.

General - Configuration Items

Item Details

Vista Policy Name

Provides a location for you to type a friendly name for the Wireless Network Policy.

Note

When you name the Wireless Network (IEEE 802.11) Policy, the name you specify is displayed as the title of its properties page, and under Name in the details pane in the Group Policy Management Console (GPMC) for that policy.

Description

Provides a location for you to type a description for the Wireless Policy.

Note

The description you type is displayed under Description in the details pane of the Group Policy Management Console (GPMC) for that policy.

Use Windows WLAN Auto Config service for clients

Specifies that the WLAN AutoConfig Service is used to configure and connect clients running Windows Vista® to the wireless network.

Default = enabled

Connect to available networks in the order of profiles listed below

Click the desired profile, and then use the Move Up and Move down buttons to specify the preferred order for clients to attempt connections.

Note

Profiles for ad-hoc networks cannot be prioritized higher than infrastructure profiles.

Add

Allows you to add a wireless network profile and specify the profile properties.

When you click Add, you will be presented with two options:

Ad-hoc. Specifies a computer-to-computer network. Access points are not used.

Infrastructure. Specifies a network that uses one or more wireless access points.

Edit

Select a network under Profile name and then click Edit to modify the properties of the wireless network profile.

Remove

Select a network under Profile name and then click Remove to delete the wireless network profile.

Import

Allows you to incorporate an existing wireless network profile, from a location you specify, into the list of available networks.

Export

Allows you to save a configured profile as an Extensible Markup Lanugage (XML) file.

Import and Export Wireless Network Profiles

Profile import and export are managed by using the following two interfaces. You can use Import a Profile to add a wireless network profile, from a location you specify, into the list of available wireless networks. You can use Save Export Profile to export any profile listed under Connect to available networks in the order of profiles listed below on the General tab, and save it to a location you specify.

Open for import a profile (Import Profiles)

Item | Details
Save in | Specifies the location to save a profile.
Name | Lists saved wireless profiles.
File name | Provides a location for you to type a name for the profile.
Save as type | Specifies the file type used to save the profile.

Save export profile as (Export Profiles)

Item | Details
Look in | Specifies the location of a saved profile.
Name | Lists saved profiles. Select the profile you want to export, and then click Open.
File name | Provides a location for you to type a new name or modify the existing profile name.
Files of type | Specifies the file type for files that are displayed under Name.


Vista Wireless Network Policy - Advanced

The Wireless Network (IEEE 802.11) Policies Advanced settings specify settings associated with 802.1X authentication requests. Advanced settings are only exposed by enabling Wi-Fi Protected Access 2 (WPA2)-Enterprise, WPA-Enterprise, or Open with 802.1X as the network authentication setting on the Security tab in the Windows Vista® Wireless Network (IEEE 802.11) Policy.

Advanced security settings are separated into three groups of configuration items: IEEE 802.1X, Fast Roaming, and Single Sign On:

IEEE 802.1X - Configuration Items

IEEE 802.1X settings specify the behavior of wireless client 802.1X authentication requests.

Item Details

Enforce advanced 802.1x settings

Specifies that that the settings listed are enforced as configured:

  • Max Eapol-Start Msgs

  • Held Period (seconds)

  • Start Period (seconds)

  • Auth Period (seconds)

Max Eapol-Start Msgs

EAPOL is the Extensible Authentication Protocol (EAP) over local area network (LAN) protocol.

If no response is received to the original EAPOL-Start message, this setting specifies the maximum number of subsequent EAPOL-Start messages sent.

Default = 3

Held Period (seconds)

After a client has received notification of authentication failure, this setting specifies the number of seconds an authenticating client waits before it performs another 802.1X authentication request.

Default = 60

Start Period

If no response is received to the original EAPOL-Start message, this setting specifies the number of seconds between the retransmission of subsequent EAPOL-Start messages.

Default = 5

Auth Period

After end-to-end 802.1X authentication is initiated, this setting specifies the number of seconds authenticating clients must wait before retransmitting any 802.1X requests.

Default = 30

Single Sign On - Configuration Items

In Windows Server® 2008 and Windows Vista, Single Sign On performs 802.1X authentication based on the network security configuration during the user logon process. This feature enables scenarios — such Group Policy updates, execution of login scripts, and joining of wireless clients to domains — that require network connectivity prior to user logon.

You can use Group Policy settings to configure Single Sign On profiles for your wireless client computers. When a Single Sign On profile is configured, 802.1X authentication is conducted prior to computer logon to the domain; users are only prompted for credential information if needed.

Item Details

Enable Single Sign On for this network

Specifies that Single Sign On is activated for the wireless network profile for this network.

Default = Not enabled

Perform immediately before User Logon

Specifies that Single Sign On performs 802.1X authentication before user logon completes.

Default = Not enabled

Perform immediately after User Logon

Specifies that Single Sign On performs 802.1x authentication immediately upon successful user logon.

Default = Not enabled

Max delay for connectivity (Seconds)

Specifies the maximum time, in seconds, in which 802.1X authentication must complete and authorize network access. This setting allows the network administrator to define the maximum length of time a user waits at the logon screen.

Default = 10

This network uses different VLAN for authentication with machine and user credentials

Specifies that wireless computers are placed on one virtual local area network (VLAN) at startup, and then — based on user permissions — transitions to a different VLAN network after the user logs on to the computer.

This setting is used in scenarios where it is desirable to separate traffic by using VLANs. For example, one VLAN, "VLAN-a," allows access only to authenticated computers, typically with a restricted set of assets. A second VLAN, "VLAN-b," provides authenticated and authorized users with access to a broader set of assets, such as e-mail, build servers, or the intranet.

Default = Not enabled

Fast Roaming Settings

Fast Roaming is a feature of WPA2 that uses pre-authentication and Pairwise Master Key (PMK) Caching to enable wireless clients to roam more quickly among wireless access points (APs).

Fast Roaming settings are only exposed by enabling WPA2-Enterpries on the Security tab in the Windows Vista Wireless Network (IEEE 802.11) Policy.

Item Details

Enable Pairwise Master Key (PMK) Caching

Specifies that Pairwise Master Key (PMK) Caching is used for WPA2 Fast Roaming.

Default = Enabled

PMK time to Live (Minutes)

Specifies the duration, in minutes, the PMK is held in cache.

Default = 720

Number of Entries in PMK Cache

Specifies the maximum number of PMK entries that are stored in cache.

Default = 128

This network uses pre-authentication

Specifies that pre-authentication is used for WPA2 Fast Roaming.

Pre-authentication enables WPA2 wireless clients that are connected to one wireless AP to perform 802.1X authentication with other wireless APs within its range. Pre-authentication stores the PMK and its associated information in the PMK cache. When the wireless client connects to a wireless AP with which it has pre-authenticated, it uses the cached PMK information to reduce the time required to authenticate and connect.

Note

WPA2 client pre-authentication is only possible with wireless access points that broadcast pre-authentication capability in Beacon and Probe Response messages.

Default = Enabled

Maximum pre-authentication attempts

Specifies the maximum allowed pre-authentication attempts.

This setting is available only when This network uses pre-authentication is selected.

Default = 3


Vista Wireless Network Policy - New Permissions

Use the Wireless Network (IEEE 802.11) Policy New Permission page to add new wireless networks to the permission list on the Networks Permissions tab. You can use New Permissions to specify, by Service Set Identifier (SSID), which wireless networks your wireless domain members are allowed to connect to, and which are denied.

New Permissions Entry Configuration Items

Items | Details
Network Name (SSID) | Provides a location for you to type the name for the wireless network for which you want to set permissions.
Network Type | Specifies whether the network is infrastructure (uses a wireless access point) or ad-hoc (computer-to-computer).
Permission | Specifies whether to permit or deny connections to the selected network.


Vista Wireless Network Policy - Connection

The Connection tab for the Wireless Network (IEEE 802.11) Policy allows you to create wireless network profiles and specify the name of each wireless network to which domain-member wireless clients can connect. Each network is saved as a profile. A profile is the collection of configuration settings for a wireless networks, saved as an Extensible Markup Language (XML) file.

Connection - Configuration Items

Item Details

Profile name

Specifies the friendly name for the wireless network profile.

Network Name (SSID)

Specifies the name of the wireless network. This must match the Service Set Identifier (SSID) configured on the wireless access points for this network.

Connect automatically when this network is in range

Specifies that Windows will automatically attempt to connect to the wireless network when the computer is within broadcast range of any wireless access points that are broadcasting the SSID.

Note

Windows attempts connections to wireless networks in the order they are listed in preferred networks.

Connect to a more preferred network if available

Specifies that clients will attempt to connect to wireless networks in the order specified under Connect to available networks in the order of profiles listed below on the General tab.

Connect even if the network is not broadcasting

Specifies that wireless clients will actively probe for wireless access points with the specified SSID, in case wireless access points are configured to suppress beacon broadcasts.


Vista Wired Network Policies - General

Use the Wired Network (IEEE 802.3) Policies General tab to specify whether the Wired AutoConfig Service is used to configure local area network (LAN) adapters to connect to the wired network. You can also specify the policy name and description.

General - Configuration Items

Item Details

Policy Name

Provides a location for you to type a name for the Network Policy that is applied to your wired clients running Windows Vista®.

Note

When you name the Wired Network (IEEE 802.3) Policy, the name is displayed as the title of its property pages, and under Name in the details pane in the Group Policy Management Console (GPMC) for that policy.

Description

Provides a location for you to type a description for your Wired Network (IEEE 802.3) Policy.

Note

The description you type is displayed under Description in the details pane of the Group Policy Management Console (GPMC) for that policy.

Use Windows wired network service for clients

Specifies that Wired AutoConfig Service is used to configure and connect clients running Windows Vista to the 802.3 wired Ethernet network.

Default = enabled


XP Wireless Network Policy - Preferred Networks

You can use the settings on the Preferred Networks tab to add wireless networks, by name, to a prioritized list. That list specifies the order in which your domain-member wireless clients will attempt to connect to wireless networks.

If a client cannot connect to a preferred wireless network, and the wireless network is configured to prevent automatic connection to wireless networks that are not in the preferred list (the default), then the Wireless Zero Configuration service places the wireless network adapter in infrastructure mode using a random wireless network name. At this point, the wireless adapter is not connected to any wireless networks and continues to scan for preferred wireless networks.

Preferred Networks - Configuration Items

Item Details

Profile name

Displays the prioritized list of preferred wireless networks. General profile information, such as Service Set Identifier (SSID), IEEE 802.1X status Enabled or Disabled, and encryption type, is displayed.

Add

Allows you to add a wireless network profile, and specify the profile properties.

When you click Add, you will be presented with two options:

  • Ad-hoc. Specifies a computer-to-computer network. Access points are not used.

  • Infrastructure. Specifies a network that uses one or more wireless access points.

Edit

Allows you to change the configuration settings for the selected preferred wireless network profile.

Remove

Deletes the selected network from the list of preferred networks.

Up arrow

Moves a selected network to a higher connection priority in the list of preferred networks.

Note

Profiles for ad-hoc networks cannot be prioritized higher than infrastructure profiles.

Down arrow

Moves a selected network to a lower connection priority in the list of preferred networks.


XP Wireless Network Policy - Network Properties

You can use the Wireless Network (IEEE 802.11) Policy for Windows XP clients to specify the name of the wireless network, network security authentication, such as Wi-Fi Protected Access 2 (WPA2), and Fast Roaming features.

Network Properties - Configuration Items

Item Details

Network Name (SSID)

Provides a location for you to type the wireless LAN network name, also known as the Service Set Identifier (SSID).

Description

Provides a location for you to type a description of the wireless LAN network.

Connect even if network is not broadcasting

Specifies that wireless clients will actively probe for wireless access points with the specified SSID, if wireless access points are configured to suppress beacon broadcasts.

Authentication

Specifies the security authentication method that is used between the wireless access point and the wireless client.

  • Open

  • Shared

  • WPA-Enterprise

  • WPA-Personal

  • WPA2-Enterprise

  • WPA2-Personal

  • Open with 802.1X

Note

Network Authentication Methods and advanced settings are only exposed by selecting WPA-Enterprise, WPA2-Enterprise, and Open with 802.1X for the network security authentication method.

Default = Defaults to the most secure setting supported by the wireless hardware and drivers.

Encryption

Specifies the security encryption to use for the selected network security authentication method.

If Authentication is set to WPA-Enterprise, WPA-Personal, WPA2-Enterprise, or WPA2-Personal, the encryption options are AES or TKIP.

If Authentication is set to Open, Shared, or Open with 802.1X, then encryption options are WEP or Disabled.

Enable Pairwise Master Key (PMK) Caching

Specifies that Pairwise Master Key (PMK) Caching is used for WPA2 Fast Roaming.

Note

Fast Roaming is a feature of Wi-Fi Protected Access 2 (WPA2) that uses pre-authentication and PMK Caching to enable wireless clients to roam more quickly among wireless access points (APs). Fast Roaming settings are only exposed if WPA2 is selected as the network security method.

PMK Time to Live (Minutes)

Specifies the duration, in minutes, the PMK is held in cache.

Default = 720

Number of Entries in PMK Cache

Specifies the maximum number of PMK entries that are stored in cache.

Default = 128

This network uses pre-authentication

Specifies that pre-authentication is used for WPA2 Fast Roaming.

Pre-authentication enables WPA2 wireless clients that are connected to one wireless AP to perform 802.1X authentication with other wireless APs within its range. Pre-authentication stores the PMK and its associated information in the PMK cache. When the wireless client connects to a wireless AP with which it has pre-authenticated, it uses the cached PMK information to reduce the time required to authenticate and connect.

Note

WPA2 client pre-authentication is only possible with wireless access points that broadcast pre-authentication capability in Beacon and Probe Response messages.

Default = Enabled

Maximum Pre-authentication attempts

Specifies the maximum allowed pre-authentication attempts.

This setting is available only when This network uses pre-authentication is selected.

Default = 3


Vista Wireless Network Policy - Network Permissions

Use Network Permissions to list and configure wireless networks that are not defined on the General tab in the Connect to available networks in the order of profiles listed below preferred list. You can use these settings to define additional wireless networks and specify whether you want to allow or deny connections by your domain-member wireless clients. Alternatively, you can block the additional wireless networks from being displayed to your domain-member wireless clients. These settings are specific to the wireless networks listed on the Network Permissions tab under Network Name (SSID).

Connections to the wireless networks that are listed under Network Name (SSID) on the Network Permissions tab are only possible if the permission is set to Allow. If the permission is set to Allow, your domain-member wireless clients first attempt to connect to a preferred network, before attempting to connect to non-preferred networks. However, domain members can actively launch a connection attempt to listed networks that have permissions set to Allow.

Network Permissions - Configuration Items

Item Details

Network Name (SSID)

Lists wireless networks, for which you want to allow or deny permissions, but that are not defined on the General tab in Connect to available networks in the order of profiles listed below.

Default = disabled

Add

Opens the New Permission Entry dialog box, for adding a new wireless network to the permission list.

When you click Add, you will be presented with two options:

  • Ad-hoc. Specifies a computer-to-computer network. Access points are not used.

  • Infrastructure. Specifies a network that uses one or more wireless access points.

Remove

Deletes the selected wireless network from the permission list.

Prevent connections to ad-hoc networks

Specifies that domain-member wireless clients cannot form a new ad-hoc network or connect to any ad-hoc networks in the permission list.

Default = not enabled

Prevent connections to infrastructure networks

Specifies that domain-member wireless clients cannot connect to any infrastructure networks in the permission list.

Default = not enabled

Allow user to view denied networks

Specifies whether domain-member wireless clients can view wireless networks in the permission list that have permissions set to Deny.

Default = not enabled

Allow everyone to create all user profiles

Specifies that any user to which Wireless Network (IEEE 802.11) Policy applies can create all user wireless profiles on the computer. When this setting is not selected, only users in the Network Administrators group or Network Operators group can create all user wireless profiles on the computer.

All user profiles are wireless profiles that are used to connect to a specific wireless network and that can be started by any user with an account on the computer. Every user with an account on the computer is contained within the computer-wide access control list (ACL) named Everyone. Based on the Everyone ACL group, network administrators can use this setting to limit access to the controls that enable users to create all user profiles.

Default = enabled