MS IAS service in PEAP environment

  • Thread starter Thread starter kc
  • Start date Start date
K

kc

Just want to use MS windows 2000 IAS service to show my boss that how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very simple. One
PC sit behind an Ap, one notebook trying to wirelessly connect to this
PC through the AP, using PEAP authentication. What I want to do is to
group the PC and the notebook into one workgroup, install IAS service
and certificate service in this PC, get a certificate for this PC,
install the root CA certificate and IAS server certificate into this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish this job?

Appreciate any suggestions/comments from this group.

KC
 
if you mean from the client side, the user you will be prompted to enter his
credentials before getting access to the network

--

This posting is provided "AS IS", with NO warranties and confers NO rights
kc said:
"Wajihy [MSFT]" <[email protected]> wrote in message
you can do it both ways:
without installing an AD, add a local user to the IAS server and use that
user to connect from the client ( don't forget in the wireless configuration
of the client to uncheck " use winlogon credentials" option) you can also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help
Click to expand...

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
 
I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console :
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



Wajihy said:
if you mean from the client side, the user you will be prompted to enter his
credentials before getting access to the network

--

This posting is provided "AS IS", with NO warranties and confers NO rights
kc said:
"Wajihy [MSFT]" <[email protected]> wrote in message
you can do it both ways:
without installing an AD, add a local user to the IAS server and use that
user to connect from the client ( don't forget in the wireless configuration
of the client to uncheck " use winlogon credentials" option) you can also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers NO rights
Just want to use MS windows 2000 IAS service to show my boss that how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very simple. One
PC sit behind an Ap, one notebook trying to wirelessly connect to this
PC through the AP, using PEAP authentication. What I want to do is to
group the PC and the notebook into one workgroup, install IAS service
and certificate service in this PC, get a certificate for this PC,
install the root CA certificate and IAS server certificate into this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish this job?

Appreciate any suggestions/comments from this group.

KC
Click to expand...

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
 
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console :
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
if you mean from the client side, the user you will be prompted to enter his
credentials before getting access to the network

--

This posting is provided "AS IS", with NO warranties and confers NO rights
kc said:
"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
you can do it both ways:
without installing an AD, add a local user to the IAS server and use that
user to connect from the client ( don't forget in the wireless configuration
of the client to uncheck " use winlogon credentials" option) you can also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers NO rights
Just want to use MS windows 2000 IAS service to show my boss that how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very simple. One
PC sit behind an Ap, one notebook trying to wirelessly connect to this
PC through the AP, using PEAP authentication. What I want to do is to
group the PC and the notebook into one workgroup, install IAS service
and certificate service in this PC, get a certificate for this PC,
install the root CA certificate and IAS server certificate into this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish this job?

Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
It is a stand alone CA running Windows 2000 Server SP4.

Wajihy said:
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console :
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
if you mean from the client side, the user you will be prompted to enter his
credentials before getting access to the network
Click to expand...
you can do it both ways:
without installing an AD, add a local user to the IAS server and use that
user to connect from the client ( don't forget in the wireless configuration
of the client to uncheck " use winlogon credentials" option) you can also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers NO rights
Just want to use MS windows 2000 IAS service to show my boss that how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very simple. One
PC sit behind an Ap, one notebook trying to wirelessly connect to this
PC through the AP, using PEAP authentication. What I want to do is to
group the PC and the notebook into one workgroup, install IAS service
and certificate service in this PC, get a certificate for this PC,
install the root CA certificate and IAS server certificate into this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish this job?

Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console :
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be prompted to
Click to expand...
enter
his
credentials before getting access to the network
Click to expand...
you can do it both ways:
without installing an AD, add a local user to the IAS server and
Click to expand...
use
that
user to connect from the client ( don't forget in the wireless configuration
of the client to uncheck " use winlogon credentials" option) you
Click to expand...
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help
Click to expand...
NO
rights
Just want to use MS windows 2000 IAS service to show my boss
Click to expand...
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very
Click to expand...
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly connect
Click to expand...
to
this
PC through the AP, using PEAP authentication. What I want to
Click to expand...
do
is to
group the PC and the notebook into one workgroup, install IAS service
and certificate service in this PC, get a certificate for this PC,
install the root CA certificate and IAS server certificate
Click to expand...
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish this job?

Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

Wajihy said:
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console :
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be prompted to
Click to expand...
enter
his
credentials before getting access to the network
Click to expand...
you can do it both ways:
without installing an AD, add a local user to the IAS server and
Click to expand...
use
that
user to connect from the client ( don't forget in the wireless configuration
of the client to uncheck " use winlogon credentials" option) you
Click to expand...
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help
Click to expand...
NO
rights
Just want to use MS windows 2000 IAS service to show my boss
Click to expand...
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very
Click to expand...
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly connect
Click to expand...
to
this
PC through the AP, using PEAP authentication. What I want to
Click to expand...
Click to expand...
do
is to
into
this
Click to expand...
Click to expand...
 
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already have a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console :
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be prompted
Click to expand...
to
enter
his
credentials before getting access to the network
Click to expand...
NO
rights
"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
you can do it both ways:
without installing an AD, add a local user to the IAS server
Click to expand...
and
use
that
user to connect from the client ( don't forget in the
Click to expand...
wireless
configuration
of the client to uncheck " use winlogon credentials" option)
Click to expand...
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help
Click to expand...
confers
NO
rights
Just want to use MS windows 2000 IAS service to show my
Click to expand...
boss
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very simple.
One
PC sit behind an Ap, one notebook trying to wirelessly
Click to expand...
connect
to
this
PC through the AP, using PEAP authentication. What I want
Click to expand...
to
do
is to
group the PC and the notebook into one workgroup, install
Click to expand...
IAS
service
and certificate service in this PC, get a certificate for
Click to expand...
this
PC,
install the root CA certificate and IAS server certificate into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish
Click to expand...
this
job?
Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
Thanks for your quick reply.

I finally get it worked. The problem is because the Hard disk was
formated as FAT32. After I convert it to NTFS system. The problem
gone.

Thanks for your help.

Wajihy said:
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already have a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be prompted to
enter
his
credentials before getting access to the network
Click to expand...
NO
rights
"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
you can do it both ways:
without installing an AD, add a local user to the IAS server and
use
that
user to connect from the client ( don't forget in the
Click to expand...
wireless
configuration
of the client to uncheck " use winlogon credentials" option) you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
Just want to use MS windows 2000 IAS service to show my boss
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly connect
to
this
PC through the AP, using PEAP authentication. What I want to
do
is to
group the PC and the notebook into one workgroup, install
Click to expand...
IAS
service
and certificate service in this PC, get a certificate for
Click to expand...
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish
Click to expand...
this
job?
Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found the IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to connect into
the wired network.

Any comments?




Wajihy said:
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already have a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate console
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be prompted to
enter
his
credentials before getting access to the network
Click to expand...
NO
rights
"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
you can do it both ways:
without installing an AD, add a local user to the IAS server and
use
that
user to connect from the client ( don't forget in the
Click to expand...
wireless
configuration
of the client to uncheck " use winlogon credentials" option) you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
Just want to use MS windows 2000 IAS service to show my boss
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly connect
to
this
PC through the AP, using PEAP authentication. What I want to
do
is to
group the PC and the notebook into one workgroup, install
Click to expand...
IAS
service
and certificate service in this PC, get a certificate for
Click to expand...
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish
Click to expand...
this
job?
Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user that the
current wireless connection is in 802.1x condition when users use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
are you using EAPTLS or PEAP?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found the IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to connect into
the wired network.

Any comments?




"Wajihy [MSFT]" <[email protected]> wrote in message
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already have a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate
Click to expand...
console
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will
Click to expand...
process
the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be
Click to expand...
prompted
to
enter
his
credentials before getting access to the network
Click to expand...
confers
NO
rights
"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
you can do it both ways:
without installing an AD, add a local user to the IAS
Click to expand...
server
and
use
that
user to connect from the client ( don't forget in the wireless
configuration
of the client to uncheck " use winlogon credentials"
Click to expand...
option)
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
Just want to use MS windows 2000 IAS service to show
Click to expand...
my
boss
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly connect
to
this
PC through the AP, using PEAP authentication. What I
Click to expand...
want
to
do
is to
group the PC and the notebook into one workgroup,
Click to expand...
install
IAS
service
and certificate service in this PC, get a certificate
Click to expand...
for
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to
Click to expand...
finish
this
job?
Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user
Click to expand...
that
the
current wireless connection is in 802.1x condition when
Click to expand...
users
use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
Glad to hear that it is worked for you

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
Thanks for your quick reply.

I finally get it worked. The problem is because the Hard disk was
formated as FAT32. After I convert it to NTFS system. The problem
gone.

Thanks for your help.

"Wajihy [MSFT]" <[email protected]> wrote in message
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already have a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate
Click to expand...
console
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will
Click to expand...
process
the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be
Click to expand...
prompted
to
enter
his
credentials before getting access to the network
Click to expand...
confers
NO
rights
"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
you can do it both ways:
without installing an AD, add a local user to the IAS
Click to expand...
server
and
use
that
user to connect from the client ( don't forget in the wireless
configuration
of the client to uncheck " use winlogon credentials"
Click to expand...
option)
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
Just want to use MS windows 2000 IAS service to show
Click to expand...
my
boss
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly connect
to
this
PC through the AP, using PEAP authentication. What I
Click to expand...
want
to
do
is to
group the PC and the notebook into one workgroup,
Click to expand...
install
IAS
service
and certificate service in this PC, get a certificate
Click to expand...
for
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to
Click to expand...
finish
this
job?
Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user
Click to expand...
that
the
current wireless connection is in 802.1x condition when
Click to expand...
users
use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
PEAP


Wajihy said:
are you using EAPTLS or PEAP?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found the IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to connect into
the wired network.

Any comments?




"Wajihy [MSFT]" <[email protected]> wrote in message
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already have a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate (Shows as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use local machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with this EAP"

I also have problem to get a certificate from certificate
Click to expand...
console
run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will
Click to expand...
process
the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
if you mean from the client side, the user you will be
Click to expand...
prompted
to
enter
his
credentials before getting access to the network

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
you can do it both ways:
without installing an AD, add a local user to the IAS
Click to expand...
server
and
use
that
user to connect from the client ( don't forget in the
wireless
configuration
of the client to uncheck " use winlogon credentials"
Click to expand...
option)
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
Just want to use MS windows 2000 IAS service to show
Click to expand...
my
boss
that
how
this service can be used as a wireless authentication server.

Play it for a while. My question is that my demo is very
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly connect
to
this
PC through the AP, using PEAP authentication. What I
Click to expand...
want
to
do
is to
group the PC and the notebook into one workgroup, install
IAS
service
and certificate service in this PC, get a certificate for
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish
this
job?

Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user
Click to expand...
that
the
current wireless connection is in 802.1x condition when
Click to expand...
users
use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
do you see 2 evnets one for the machine and one for the username? or only
one the access reject for the machine?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
PEAP


"Wajihy [MSFT]" <[email protected]> wrote in message
are you using EAPTLS or PEAP?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found the IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to connect into
the wired network.

Any comments?




"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already
Click to expand...
have
a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate
Click to expand...
(Shows
as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?
Click to expand...
confers
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use
Click to expand...
local
machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with
Click to expand...
this
EAP"
I also have problem to get a certificate from certificate console

run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will process
the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
if you mean from the client side, the user you will be prompted
to
enter
his
credentials before getting access to the network

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
you can do it both ways:
without installing an AD, add a local user to the
Click to expand...
IAS
server
and
use
that
user to connect from the client ( don't forget in the
wireless
configuration
of the client to uncheck " use winlogon credentials" option)
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a
Click to expand...
domain
user
let me know if you need more help
Click to expand...
and
confers
NO
rights
Just want to use MS windows 2000 IAS service to
Click to expand...
show
my
boss
that
how
this service can be used as a wireless
Click to expand...
authentication
server.
Play it for a while. My question is that my demo
Click to expand...
is
very
simple.
One
PC sit behind an Ap, one notebook trying to
Click to expand...
wirelessly
connect
to
this
PC through the AP, using PEAP authentication.
Click to expand...
What I
want
to
do
is to
group the PC and the notebook into one workgroup, install
IAS
service
and certificate service in this PC, get a
Click to expand...
certificate
for
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish
this
job?

Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show
Click to expand...
user
that
the
current wireless connection is in 802.1x condition
Click to expand...
when
users
use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
Your question give me some hints.

There are 2 events. One for the machine and one for the username. If
I uncheck AUTHENTICATE AS COMPUTER WHEN COMPUTER INFORMATION IS
AVAILABLE in 802.1x client

then, no machine is authenticated.

The check or uncheck this box has no effect for PEAP authentication,
when should I select AUTHENTICATE AS COMPUTER WHEN COMPUTER
INFORMATION IS AVAILABLE?

and in what situation, should I select AUTHENTICATE AS GUEST WHEN USER
OR COMPUTER INFORMATION IS UNAVAILABLE?



Wajihy said:
do you see 2 evnets one for the machine and one for the username? or only
one the access reject for the machine?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
PEAP


"Wajihy [MSFT]" <[email protected]> wrote in message
are you using EAPTLS or PEAP?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found the IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to connect into
the wired network.

Any comments?




"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already
Click to expand...
have
a
windows2003 give it a shot and let me know the result

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I did what you said. Unfortunately, it didn't work. The problem is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to have a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use the AD to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate
Click to expand...
(Shows
as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the key exportable

Hit Submit
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I can request a
certificate by using //server/certsrv and specify "use
Click to expand...
local
machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with
Click to expand...
this
EAP"
I also have problem to get a certificate from certificate
console

run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will
process
the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
if you mean from the client side, the user you will be
prompted
to
enter
his
credentials before getting access to the network

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights
message
you can do it both ways:
without installing an AD, add a local user to the IAS
server
and
use
that
user to connect from the client ( don't forget in the
wireless
configuration
of the client to uncheck " use winlogon credentials"
option)
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a
Click to expand...
domain
user
let me know if you need more help
Click to expand...
and
confers
NO
rights
Just want to use MS windows 2000 IAS service to show
my
boss
that
how
this service can be used as a wireless
Click to expand...
authentication
server.
Play it for a while. My question is that my demo
Click to expand...
is
very
simple.
One
PC sit behind an Ap, one notebook trying to
Click to expand...
wirelessly
connect
to
this
PC through the AP, using PEAP authentication. What I
want
to
do
is to
group the PC and the notebook into one workgroup, install
IAS
service
and certificate service in this PC, get a
Click to expand...
certificate
for
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a domain to finish
this
job?

Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show user
that
the
current wireless connection is in 802.1x condition when
users
use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
you should check the " authenticate as computer when computer ..." if you
want to do machine auth
and you should enable " authenticate as guest when user or ..." if you want
the client to connect as guest ( after 3 failed auths if this option is
checked and if the guest account is enabled on the AD, the client will
connect as guest"

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
Your question give me some hints.

There are 2 events. One for the machine and one for the username. If
I uncheck AUTHENTICATE AS COMPUTER WHEN COMPUTER INFORMATION IS
AVAILABLE in 802.1x client

then, no machine is authenticated.

The check or uncheck this box has no effect for PEAP authentication,
when should I select AUTHENTICATE AS COMPUTER WHEN COMPUTER
INFORMATION IS AVAILABLE?

and in what situation, should I select AUTHENTICATE AS GUEST WHEN USER
OR COMPUTER INFORMATION IS UNAVAILABLE?



"Wajihy [MSFT]" <[email protected]> wrote in message
do you see 2 evnets one for the machine and one for the username? or only
one the access reject for the machine?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
PEAP


"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
are you using EAPTLS or PEAP?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found the IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to connect into
the wired network.

Any comments?




"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you
Click to expand...
already
have
a
windows2003 give it a shot and let me know the result
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I did what you said. Unfortunately, it didn't work. The
Click to expand...
problem
is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to
Click to expand...
have
a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use
Click to expand...
the AD
to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer
Click to expand...
certificate
(Shows
as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the
Click to expand...
key
exportable
Hit Submit
Click to expand...
confers
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I
Click to expand...
can
request a
certificate by using //server/certsrv and specify "use local
machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a wireless policy :

double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used
Click to expand...
with
this
EAP"
I also have problem to get a certificate from certificate
console

run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority that will
process
the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
if you mean from the client side, the user you will be
prompted
to
enter
his
credentials before getting access to the network
Click to expand...
and
confers
NO
rights
message
you can do it both ways:
without installing an AD, add a local user to
Click to expand...
the
IAS
server
and
use
that
user to connect from the client ( don't forget
Click to expand...
in
the
wireless
configuration
of the client to uncheck " use winlogon credentials"
option)
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a domain
user

let me know if you need more help
Click to expand...
warranties
and
confers
NO
rights
Just want to use MS windows 2000 IAS service
Click to expand...
to
show
my
boss
that
how
this service can be used as a wireless authentication
server.

Play it for a while. My question is that my
Click to expand...
demo
is
very
simple.
One
PC sit behind an Ap, one notebook trying to wirelessly
connect
to
this
PC through the AP, using PEAP authentication. What I
want
to
do
is to
group the PC and the notebook into one
Click to expand...
workgroup,
install
IAS
service
and certificate service in this PC, get a certificate
for
this
PC,
install the root CA certificate and IAS server certificate
into
this
notebook. Then I think I can demo EAP-PEAP authentication.

Can this be done? Do I have to set up a
Click to expand...
domain to
finish
this
job?

Appreciate any suggestions/comments from this group.

KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can
Click to expand...
show
user
that
the
current wireless connection is in 802.1x condition when
users
use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
But, even though I check the " authenticate as computer when computer
...." I still can get connected and use the resources in the wired
section when the machine authentication fail and the user
authentication success.

To check this box seems meaningless.



Wajihy said:
you should check the " authenticate as computer when computer ..." if you
want to do machine auth
and you should enable " authenticate as guest when user or ..." if you want
the client to connect as guest ( after 3 failed auths if this option is
checked and if the guest account is enabled on the AD, the client will
connect as guest"

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
Your question give me some hints.

There are 2 events. One for the machine and one for the username. If
I uncheck AUTHENTICATE AS COMPUTER WHEN COMPUTER INFORMATION IS
AVAILABLE in 802.1x client

then, no machine is authenticated.

The check or uncheck this box has no effect for PEAP authentication,
when should I select AUTHENTICATE AS COMPUTER WHEN COMPUTER
INFORMATION IS AVAILABLE?

and in what situation, should I select AUTHENTICATE AS GUEST WHEN USER
OR COMPUTER INFORMATION IS UNAVAILABLE?



"Wajihy [MSFT]" <[email protected]> wrote in message
do you see 2 evnets one for the machine and one for the username? or only
one the access reject for the machine?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

PEAP


"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
are you using EAPTLS or PEAP?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found the IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to connect into
the wired network.

Any comments?




"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already
have
a
windows2003 give it a shot and let me know the result
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I did what you said. Unfortunately, it didn't work. The
Click to expand...
problem
is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4 to
Click to expand...
have
a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I use
Click to expand...
Click to expand...
the AD
to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate
(Shows
as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer certificate store"

[optional] You might want to mark the
Click to expand...
key
exportable
Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers
NO
rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
IS IT a stand alone CA or an entreprise CA?

--

This posting is provided "AS IS", with NO warranties and confers
NO
rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC. I
Click to expand...
Click to expand...
can
request a
and
confers the
IAS in
the to
show workgroup,
install
Click to expand...
domain to
finish
show
user
Click to expand...
Click to expand...
 
you will check it if you want to do machine auth first and if it fails it
fall back to user auth

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
But, even though I check the " authenticate as computer when computer
..." I still can get connected and use the resources in the wired
section when the machine authentication fail and the user
authentication success.

To check this box seems meaningless.



"Wajihy [MSFT]" <[email protected]> wrote in message
you should check the " authenticate as computer when computer ..." if you
want to do machine auth
and you should enable " authenticate as guest when user or ..." if you want
the client to connect as guest ( after 3 failed auths if this option is
checked and if the guest account is enabled on the AD, the client will
connect as guest"

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication using IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

kc said:
Your question give me some hints.

There are 2 events. One for the machine and one for the username. If
I uncheck AUTHENTICATE AS COMPUTER WHEN COMPUTER INFORMATION IS
AVAILABLE in 802.1x client

then, no machine is authenticated.

The check or uncheck this box has no effect for PEAP authentication,
when should I select AUTHENTICATE AS COMPUTER WHEN COMPUTER
INFORMATION IS AVAILABLE?

and in what situation, should I select AUTHENTICATE AS GUEST WHEN USER
OR COMPUTER INFORMATION IS UNAVAILABLE?



"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
do you see 2 evnets one for the machine and one for the username? or only
one the access reject for the machine?

--

This posting is provided "AS IS", with NO warranties and confers NO rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
Click to expand...
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

PEAP


"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
are you using EAPTLS or PEAP?
Click to expand...
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is another simple scenario :

One PC install Windows 2000 sp4, IAS, and certificate service. The PC
is configured as a DC. One AP ( support WPA ), and one notebook.

domain name : mydomain.com

notebook name : compaq1

one user name : kc

add compaq1 and kc into AD.

create a wireless user group, and add compaq1 and kc into this group.

create a wireless group policy

IAS successfully authenticates user kc, and kc can wirelessly connect
to Internet through IAS authentication.

When looking up the log file through IAS Log Viewer, I found
Click to expand...
the
IAS
also authenticate the computer ( it shows the user name is
host/compaq1.mydomain.com ). However, the result is IAS_NO_SUCH_USER,
and the connect result shows rejected.

However, this reject message has no effect for a user to
Click to expand...
connect
into
the wired network.

Any comments?




"Wajihy [MSFT]" <[email protected]> wrote in message
Click to expand...
it is weird because we have tried it and it works
PEAP Mschap v2 using a stand alone CA
I have tried it using windows2003
I will try using windows 2000 and get abck to you ( if you already
have
a
windows2003 give it a shot and let me know the result
Click to expand...
confers
NO
rights
Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I did what you said. Unfortunately, it didn't work. The problem
is
the same.

I reinstall the Windows 2000 server and upgrade it to SP 4
Click to expand...
to
have
a
clean 2000 server to test it again. The problem is the same.

However, IAS and certificate cervice works well when I
Click to expand...
use
the AD
to
set up a small and simple domain.

Any suggestions again?

Will Windows 2003 help?

"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
with a stand alone CA here is how you request the cert:
Login as Member of the local administrators on the machine

Open the cert web page (on your stand alone)

Select request Certificate

Select Advanced certificate request

Select Create and submit request to this CA

In the NAME filed put the FQDN of your machine

In the type of certificate needed select computer certificate
(Shows
as
"Server authentication Certificate")

In the CSP select "Microsoft RSA SChannel Cryptographic Provider"

Check the "Store Certificate in Local computer
Click to expand...
certificate
store"
[optional] You might want to mark
Click to expand...
the
key
exportable
Hit Submit



--

This posting is provided "AS IS", with NO warranties and confers
NO
rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

It is a stand alone CA running Windows 2000 Server SP4.

"Wajihy [MSFT]" <[email protected]> wrote in
Click to expand...
message
IS IT a stand alone CA or an entreprise CA?
Click to expand...
and
confers
NO
rights

Upcoming Event: Tech Chat about "Secure Wireless authentication
using
IAS,
PEAP and EAP"
on September 25th at 10AM PT
http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000081

I install IAS and Certificate service in one PC.
Click to expand...
I
can
request a
certificate by using //server/certsrv and specify "use
local
machine
store" to get a machine certificate for this PC.

However, when I tried to configure EAP in a
Click to expand...
wireless
policy :
double click wireless policy
click edit profile
click authentication tab
check EAP check box
click configure

the error message show up :
"A certificate could not be found that can be used with
this
EAP"

I also have problem to get a certificate from certificate
console

run MMC
add certificate
certificate/personal/all tasks/request new certificate
the error appears:
"Windows cannot find a certification authority
Click to expand...
that
will
process
the
request"
However, I can get a new certificate by using //server/certsrv.

Any suggestions?

KC



message
if you mean from the client side, the user you
Click to expand...
will
be
prompted
to
enter
his
credentials before getting access to the network
Click to expand...
warranties
and
confers
NO
rights
message
you can do it both ways:
without installing an AD, add a local user
Click to expand...
to
the
IAS
server
and
use
that
user to connect from the client ( don't
Click to expand...
forget
in
the
wireless
configuration
of the client to uncheck " use winlogon credentials"
option)
you
can
also
install the CA on the IAS server

use it with an a AD in this case you will use a
domain
user

let me know if you need more help

--

This posting is provided "AS IS", with NO warranties
and
confers
NO
rights
Just want to use MS windows 2000 IAS
Click to expand...
service
to
show
my
boss
that
how
this service can be used as a wireless
authentication
server.

Play it for a while. My question is that
Click to expand...
my
demo
is
very
simple.
One
PC sit behind an Ap, one notebook trying to
wirelessly
connect
to
this
PC through the AP, using PEAP
Click to expand...
authentication.
What I
want
to
do
is to
group the PC and the notebook into one workgroup,
install
IAS
service
and certificate service in this PC, get a
certificate
for
this
PC,
install the root CA certificate and IAS
Click to expand...
server
certificate
into
this
notebook. Then I think I can demo
Click to expand...
EAP-PEAP
authentication.
Can this be done? Do I have to set up a
Click to expand...
domain to
finish
this
job?

Appreciate any suggestions/comments from
Click to expand...
this
group.
KC

Hi Wajihy

Thanks for your reply.

Is there any indication on the screen that can show
user
that
the
current wireless connection is in 802.1x
Click to expand...
condition
when
users
use
Windows 2000 802.1x client?
Click to expand...
Click to expand...
Click to expand...
 
Back
Top