Adding Supportability of EAP-TEAP to Windows Server 2019 Group Policy

[rezaalikhani]

• Overview
• Group Policy Preparation for EAP-TEAP
• Configuring Group Policy for Wireless Connections
• Step 1. Create A New Wireless Connection based on EAP-TEAP
• Step 2. Export the configuration of the newly created wireless connection to an XML file
• Step 3. Extract the EAP-TEAP specific configuration from the XML file
• Step 4. Create Group Policy to push “TEAP” configuration to wireless endpoints
• Step 5. Backup the configuration of the GPO
• Step 6. Replace the EAP configs section of the backup file with the extracted configs from Step 3
• Step 7. Import the modified backup file to the created GPO in Step 4
• Configuring Group Policy for Wired Connections
• Step 1. Start “Wired AutoConfig” service
• Step 2. Configure EAP-TEAP based on your current security policy
• Step 3. Export the configuration of the newly created wired connection to an XML file
• Step 4. Extract the EAP-TEAP specific configuration from the XML file
• Step 5. Create Group Policy to push “TEAP” configuration to wired endpoints
• Step 6. Backup the configuration of the GPO
• Step 7. Replace the EAP configs section of the backup file with the extracted configs from Step 4
• Step 8. Import the modified backup file to the created GPO in Step 5

Overview

With Windows 10 build 2004 and ISE 2.7 Patch 2, EAP-TEAP is now supported. However, if you are using Microsoft Active Directory based on Windows Server 2019 and below operating systems, EAP-TEAP can only be configured manually for non-domain joined workstations. This is because the "TEAP" option is not available under the group policy configuration for domain-managed workstations.

In this document, I will introduce a workaround to resolve this limitation. However, if you upgrade your domain controllers' operating system to Windows Server 2022, you won't need this workaround, as this version supports configuring EAP-TEAP through Group Policy natively.

This article is based on "TEAP for Windows 10 using Group Policy and ISE TEAP Configuration" with the following additions and modifications:

• More clarification to the steps involved in configuring Wired network connections based on EAP-TEAP
• New section related to Wireless network connections based on EAP-TEAP
• New section related to ongoing configuration and modification of created GPO related to EAP-TEAP

Group Policy Preparation for EAP-TEAP

Configuring Group Policy support for EAP-TEAP varies slightly between wired and wireless connections, but the main steps are essentially the same.

Configuring Group Policy for Wireless Connections

The steps to prepare Group Policy based EAP-TEAP deployment for wireless connections are as follows:

1. Create a wireless connection on a Windows 10 with at least build 2004 (the client must have a wireless network adapter installed) and configure on it your required EAP-TEAP related settings
2. Export the configuration of the newly created wireless connection to an XML file using “netsh” command in Windows CLI
3. Extract the EAP-TEAP specific configuration from the XML file and save it as a text file and then transfer the text file containing the extracted configuration to one of your Active Directory domain controllers
4. Create a new Organizational Unit (OU), then create a new Group Policy Object (GPO) and link it to the OU. Afterwards, modify the GPO using the procedures mentioned later
5. Backup the configuration of the GPO
6. Replace the EAP configuration section of the backup file with the extracted configuration from Step 3
7. Import the modified backup file to the created GPO in Step 5.
8. The GPO is now ready with the EAP-TEAP configuration for deployment in production network

Step 1. Create A New Wireless Connection based on EAP-TEAP

Select your internal Root CA name from the "Trusted Root Certification Authorities" section. If you do not have internal Public Key Infrastructure (PKI), after importing the ISE certificates on the system using Group Policy or manually, select both ISEs certificates (if your clients configured to speak with two PSNs) from the mentioned section (doing this operation is beyond this document).

 

Step 2. Export the configuration of the newly created wireless connection to an XML file

After finishing the configuration above, open Windows CLI with an administrative credentials and then export the configuration above into an XML file. To do so, follow the steps below:

Step 3. Extract the EAP-TEAP specific configuration from the XML file

Open up the XML file and copy everything within <EAPConfig> ..... </EAPConfig> store in a text file to be used later.

Transfer the extracted configuration above and save in a text file to one your domain controllers.

Step 4. Create Group Policy to push “TEAP” configuration to wireless endpoints

Using Group Policy Management Console (gpmc.msc) on one of the existing domain controllers, create a new Group Policy Object (GPO) and then configure it based on the following configurations:

 As the below configurations may disrupt the current network operations on endpoints, create the GPO on an empty OU.

  

  

Leave the configuration as default as this configuration is dummy and will be overridden by the configuration exported from the Step 3.

Step 5. Backup the configuration of the GPO

Navigate to the folder where the backup was saved and open up the Backup.xml file in notepad.

Step 6. Replace the EAP configs section of the backup file with the extracted configs from Step 3

Replace the <EAPConfig> ... </EAPConfig> section with the generated "EAPConfig" and saved previously and then save the file:

Step 7. Import the modified backup file to the created GPO in Step 4

Now, with the above configuration, if you take a look at the configured settings done previously (mentioned in Step 4) to the created GPO, you'll find that the settings have disappeared. That is expected because Windows Server 2019 Group Policy does not support EAP-TEAP. By implementing the procedures done in Step 7, it assumes that the currently applied configurations have been corrupted.

Now, the easiest way to configure EAP-TEAP settings from now on is through a Windows 10 with at least build 2004, Windows 11 or Windows Server 2022 joined to the domain and that has the Group Policy Management Console installed locally.

Configuring Group Policy for Wired Connections

The steps to prepare Group Policy for wired connections are as follows:

1. Start “Wired AutoConfig” service in a client with Windows 10 with at least build 2004
2. Configure your required EAP-TEAP related options on the client specified in Step 1
3. Export the configuration of the newly created wired connection to an XML file using “netsh” command in Windows CLI
4. Extract the EAP-TEAP specific configuration from the XML file and save it as a text file and then transfer the text file containing the extracted configuration to one of your Active Directory domain controllers
5. Create a new Organizational Unit (OU), then create a new Group Policy Object (GPO) and link it to the OU. Afterwards, modify the GPO using the procedures mentioned later
6. Backup the configuration of the GPO
7. Replace the EAP configuration section of the backup file with the extracted configuration from Step 3
8. Import the modified backup file to the created GPO in Step 5
9. The GPO is now ready with the EAP-TEAP configuration for deployment in production network

Step 1. Start “Wired AutoConfig” service

Step 2. Configure EAP-TEAP based on your current security policy

Select your internal Root CA name from the "Trusted Root Certification Authorities" section. If you do not have internal Public Key Infrastructure (PKI), after importing the ISE certificates on the system using Group Policy or manually, select both ISEs certificates (if your clients configured to speak with two PSNs) from the mentioned section (doing this operation is beyond this document).

Step 3. Export the configuration of the newly created wired connection to an XML file

The name specified in front of the “interface=” parameter is shown in the second figure of Step 2.

Step 4. Extract the EAP-TEAP specific configuration from the XML file

Open up the XML file and copy everything within <EAPConfig> ..... </EAPConfig> Store in a text file to be made available later.

Transfer the extracted configuration above and save in a text file to one of your domain controllers.

Step 5. Create Group Policy to push “TEAP” configuration to wired endpoints

Using Group Policy Management Console (gpmc.msc) on one of your Active Directory domain controllers, create a new Group Policy Object (GPO) and then configure it based on the following configurations:

As the below configurations may disrupt the current network operations on endpoints, create the GPO on an empty OU.

Step 6. Backup the configuration of the GPO

Navigate to the folder where the backup was saved and open up the Backup.xml file in notepad.

Step 7. Replace the EAP configs section of the backup file with the extracted configs from Step 4

Replace the <EAPConfig> ... </EAPConfig> section with the generated "EAPConfig" and saved previously and then save the file:

Step 8. Import the modified backup file to the created GPO in Step 5

Now, with the above configuration, if you take a look at the configured settings done previously (mentioned in Step 4) to the created GPO, you'll find that the settings have disappeared. That is expected because Windows Server 2019 Group Policy does not support EAP-TEAP. By implementing the procedures done in Step 8, it assumes that the currently applied configurations have been corrupted.

According to the above statement, the only supported way to configure EAP-TEAP settings is through a Windows 10 with at least build 2004, Windows 11 or Windows Server 2022 joined to the domain and that has the Group Policy Management Console installed locally.