0

I have a windows 7 pro 64-bit reference image running in a Hyper-V client for MDT 2013 deployment on server 2012. The computers are standalone with no AD and I have no control over the network configuration. I want to provision laptops to automatically connect to our wireless ap. These laptops are shared by a large number of young students who do not have single sign-on credentials and are sharing finite number of laptops.

I had successfully used netsh to create and deploy a wireless profile in the past during deployment, but now our school district has upgraded the wireless to a WPA2-enterprise profile with PEAP and I can only add username and password interactively. I tried to export the PEAP profile, and while the profile works, it doesn't contain the username and password even if I use key=clear command in netsh (apparently that doesn't work for PEAP).

I tried to suspend the reference image and add the username and password to the image during deployment, but hyper-v doesn't allow binding a wireless adapter to a hyper-v client, so I can't set up the wireless profile in the reference image interactively.

Is there a way to edit the exported PEAP xml wireless profile file to add the username and password?

I was thinking of pulling a copy of the suspended reference image during a reboot (while image is "off") and transferring that image to a physical computer like the hyper-v server, but with a wireless adapter and then booting and hoping I could bind the adapter to the username and then reboot and transfer image back to server and continue. I can't give wireless password to users, so I would have to physically enter it on every laptop. Any suggestions?

james_time
  • 1
  • 3

1 Answers1

0

If your computers are on a Windows AD domain, the correct way to automatically add wireless profiles would be using a GPO. You can find these setting under: Computer Configuration > Policies > Windows Settings > Security Settings > Wireless Network (802.11) Policies.

I've build networks that have different SSIDs for BYOD and Internal computers. Since I don't want company computers to be manually added to BYOD (DMZ) network, I've

  • Configured the preferred network settings with [x] Use Windows WLAN AutoConfig service for clients and then configured my network in "Connect to available networks..." section. There you can add the network SSID and set the authentication and encryption methods.
  • On "Network Permissions" tab you can hide (add SSID with Permission: deny) the BYOD networks from even showing on the company computers to avoid your users accidentally using them, which would prevent them to use the internal resourses.

Using Computer authentication

As you have WPA2-Enterprise PEAP authentication, you probably have RADIUS server installed (users will authenticate with the same passwords they use for computers). Now, you are trying to automatically save one of user passwords to your client wireless network configuration.

However, the best practice in this situation would be using Computer authentication instead of User authentication (in Authentication Mode of your preferred SSID configuration). With this, you can avoid saving any passwords to your GPO.

In order to use Computer authentication your RADIUS server must allow using computer accounts for authentication. If you are using Microsoft Network Policy Server, just add group Domain Computers (or any other computer group containing these laptops) to your NPS > Policies > Network Policies > Secure Wireless Connections (PEAP) profiles as value of condition Machine Groups.

Esa Jokinen
  • 43,252
  • 2
  • 75
  • 122
  • Thank you. I do not have any control over the network infrastructure, so AD is not an option. These are for laptops that are for young students who share laptops and use a shared username / password. – james_time Mar 26 '17 at 15:16
  • Then it slightly falls out of scope in Server fault but you can still accomplish by using the same settings via Local Group Policy editor `gpedit.msc`. Just create the policy on one machine (or directly to your image) and copy to the others from `%systemroot%\system32\grouppolicy\`. – Esa Jokinen Mar 26 '17 at 15:25
  • Thank you for your help. Does the Wireless Network (802.11) Policies have a place to specify username and password? – james_time Mar 28 '17 at 04:32
  • It seems saving passwords is not an option here, so allowing and using computer authentication is the best way to do this. Is there any chance you could co-operate with the sysadmins as this would also benefit the whole network? Also, Local Group Policy editor `gpedit.msc` seems to be so limited it doesn't even have the Wireless Network (802.11) Policies. So unfortunately I'll have to stick to my original answer. – Esa Jokinen Mar 28 '17 at 06:20