Unable to connect using machine certificate

I have setup an enterprise RADIUS server to manage a wireless network. I
created a certificate using the built in certificate authority on the RADIUS
server and am running into trouble connecting a workstation. If I import
the certificate (*.pfx) into the current user's personal certificate store
then that user can connect to the network (the logon script will only work
once that user has logged on using the cached credential then logged off and
back on). If I import the certificate into the local computer certificate
store the computer can't find the certificate to authenticate with the
RADIUS server. The workstation is a Windows xp pro sp2 machine. I think
the RADIUS server is setup correctly because if the certificate is in the
current user certificate store then that user can connect.

I know this is kinda vague but I am hoping someone has run into the same
type of problem.

Thanks,
Bill

Microsoft news

Hi Bill,
There two types of certificates that a machine can use: Computer
certificates and Workstation Authentication Certificates.
I think that a user certificate cann't be used as workstation authentication
certificate.
We have used Autoenrollment features to distribute computer certificates and
workstation authentication certificates.
You also can get a computer certificate from your certificates snap-in
(computer, not user) personal folder.
For example, we have published the wokstation authentication
certificates(W3K), by changing the template security to permit autoenroll
for Domain Computers, after this, on certificate authority mmc, right
clicking on Certificates Templates node, chosing New > Certificate Template
to Issue and selecting the correct templates to be published.

You need only a computer certificate issued to your computer domain account.
With this in place your workstation can open a wireless connection before a
user logon. Your IAS Radius Policy should permit this logon type, if you
have selected specific domain groups, including the Domain Computers group.

I hope that this help you.

TKS

Washington Moreira

"Microsoft news" <> wrote in message
news:...
>I have setup an enterprise RADIUS server to manage a wireless network. I
>created a certificate using the built in certificate authority on the
>RADIUS server and am running into trouble connecting a workstation. If I
>import the certificate (*.pfx) into the current user's personal certificate
>store then that user can connect to the network (the logon script will only
>work once that user has logged on using the cached credential then logged
>off and back on). If I import the certificate into the local computer
>certificate store the computer can't find the certificate to authenticate
>with the RADIUS server. The workstation is a Windows xp pro sp2 machine.
>I think the RADIUS server is setup correctly because if the certificate is
>in the current user certificate store then that user can connect.
>
> I know this is kinda vague but I am hoping someone has run into the same
> type of problem.
>
> Thanks,
> Bill
>

Washington Moreira

[AlonPurim]

[quote=Washington Moreira]Hi Bill,
There two types of certificates that a machine can use: Computer
certificates and Workstation Authentication Certificates.
I think that a user certificate cann't be used as workstation authentication
certificate.
We have used Autoenrollment features to distribute computer certificates and
workstation authentication certificates.
You also can get a computer certificate from your certificates snap-in
(computer, not user) personal folder.
For example, we have published the wokstation authentication
certificates(W3K), by changing the template security to permit autoenroll
for Domain Computers, after this, on certificate authority mmc, right
clicking on Certificates Templates node, chosing New > Certificate Template
to Issue and selecting the correct templates to be published.

You need only a computer certificate issued to your computer domain account.
With this in place your workstation can open a wireless connection before a
user logon. Your IAS Radius Policy should permit this logon type, if you
have selected specific domain groups, including the Domain Computers group.

I hope that this help you.

TKS

Washington,

may I ask you how do enable workstation authenticaton.

We have an OU that contains around 200 kiosks that we want to authenticate themselves before connecting to the domain.

How do I enable it in GPO?

We do intend using autoenrollment...

How do I verify that authentication actually takes place?

Thank you

AlonPurim