Trouble with Windows 2000 wireless only computers

[jroyster]

I believe there is a known issue with windows 2000 and 802.1x. Something about profiles aren't updated because the machine doesn't have an IP address before the logon screen.

The APs are 1232s and authentication is LEAP. The radius server is then directed to active directory for authentication.

The problem is during the windows startup sequence some things are happening in the background (like profiles and registration) but since the computer doesn't have an IP yet this fails.

any ideas? I think you run into something similar with wired 802.1x as well.

thanks

[dsidley]

We have standardized on Funk/Juniper's Odyssey Client as our supplicant...(I believe Ver 4.3 is currnet)

If configured for AD logon it replaces Microsoft's "GINA" module with it's own and so far has been pretty stable in our environment.

(WPA/EAP-FAST thru a RADIUS Server against AD)

[jroyster]

Thanks. So is this a known issue with 2000 and wireless/802.1x?

These are Dell workgroup bridges for each machine, so maybe that's the problem. The supplicant. For the most part we've been moving away from the funk supplicant and using the one included in wireless cards (intel.) But since these are desktops its a little different.

Basically they are desktop computers on wheeled carts that can be moved.

[will.shaw]

I have trialed a number of clients and cards to try and get round this issue, however the only client I have sucessfully tested in production, that authenticates and obtains the DHCP setting before any windows logon ocours, is the Cisco client. The odessey client worked to a degree, but the results weren't consistent enough to roll out to users and configuration was complex in comparison. I also have some users using the intel Proset wireless inbuilt cards and associated software, which is working ok, however this only seems to work on some versions of the software/hardware, so needs testing.

[jroyster]

Thanks for all the input. Glad to know weren't the only ones facing this.

Our head active directory guy talked to microsoft. Here's the recommendation:

Apply Microsoft hotfix and set registry key to delay policy application.

So we'll try that and see how it goes.

Thanks for all the input. What I'm gathering is you can approach this problem from the wireless adapter perspective (driver modifies GINA) or from the OS level (hotfixes, registry edits to delay some startup activity until after logon)