Using Machine Certificates with 802.1x EAP 1

[beridor]

I'm, looking to use my machine certificate to log onto a wireless network using 802.1x EAP. i would then like to log onto thge network and once again present my machine certificate as opposed to my user certificate - does anyone have any suggestions on how this can be achieved?

the idea is that if a user is on an allowed machine has can logonto that machine they should be allowed on to the network, so the machine is authenticated and the user is not.

I suspect that this will be a change within Windows (the client is XP by the way) as opposed to a change within the authenticator or authentication server - any suggestions?

Cheers

Dave

 

[JoshT976]

Ever get this working?

Im looking to set mine up the same way.

Joshua

 

[wanyph]

hi,

do you want to use only the machine certifcate?
windows xp uses default machine+user certificate.

with a reg key you can change it to use only machine certificatre.


mewi

 

[beridor]

Could you post the reg key please - I'd like it to use machine certificate only.

Cheers

Dave

 

[wanyph]

ok,

here is it:

Enabling Computer-only Authentication Using the Registry
To configure computer-only authentication through the registry, all the Windows-based wireless clients must
have the following registry value set:
HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General
\Global\AuthMode=2
With the AuthMode setting set to 2, only computer authentication is attempted. User authentication is never
attempted.


from this source:

http://wireless.com.pt/forum/download.php?id=4079&sid=4c13c30af78fbefa383fc82319837c45

best regards,
mewi

 

[wanyph]

hi,
was it helpful?

mewi

 

[beridor]

yup - thanks very much for the response, solved my problems completely.

One thing to note (this may be implicit to a more experienced Windows Administrator) but the reg edit HKEY_LOCAL_MACHINE\software\microsoft\EAPOL\Parmeters\General\Global\AuthMode=2 is a DWORD

that was about the only thing that caused me any grief.

Thanks once again.

Dave