PEAP Authentcation order, before Win Login

[oguarisco]

Hello,

I've noticed a problem and I've not found any suitable information...maybe anyone has already experienced this scenario

I'm using PEAP Auth on both Wired and Wireless Networks for authenticating client (XP SP1) to Win AD/SAM via Radius (appliance ACS 3.2)

If I use Win XP 802.1x Native support I register the following problem...

Authentication works fine ONLY when I'm logged locally in on the client.

When I boot the PC, it seems that XP first try to authenticate user on AD/SAM and ONLY then try to authenticate it via PEAP (only when the desktop is been loaded)...Due to the fact that when it tried to authenticate the user, the network is not available the client register the classic error mesages that states "PDC/BDC is not available and to use local profiles"...

What I want to do is that PEAP authentication happen before user authentication so that I can run correctly our Logonscript and access to the correct Profile...

If I use AEGIS client it happen the same...but there is a fundamental difference; AEGIS can be configured to choose when PEAP Authentication happen: at boot, at logon(pre-Desktop) or at Desktop....Windows seem to use ONLY at Desktop

Do I have to setup something special in Windows ???

Thnaks

Omar

[dsidley]

That is why not many Enterprise's will even consider using Windows XP's wireless supplicant. It doesn't have the capabilities to setup the network prior to the logon process...

We use Funk's Odyssey client which has that capability.

Dave S.

[rsumpter]

Do you have "computer" authentication on? The computer should authenticate to AD with the machine authentication 1st (before the windows logon). This is the way it happens on a wired connection. Once the computer authentication occurs the login script, etc will run when the user logs in.

[oguarisco]

Hi,

Thanx a lot for the info...so basically you should configure on both ACS and client side Machine authentication...and then you should be able to do authentication 1x before contacting PDC/BDC and downloading the user profile and run loginscript.

Machine authentication happen, if I remember correctly, with the value host/namepc to the AD/SAM...isn't it ?

By the way ...why did you enphasize that this happen on WIRED connections? Is in Wireless topology different ?

Saluti

Omar