Setting Up Windows 2012 Single Sign on

If you are using WiFi access in your business or school network, you should be configured to use Enterprise mode WiFi with AES encryption. Using Enterprise mode provided a number of advantages over Personal mode with a pre-shared key

Windows single sign on allows users to use their Active Directory domain account information to logon to wireless Access Points. The advantages to this over a single pre-shared wireless password are:

• Users only have to authenticate once to get both network and computer access. One password when they logon to the computer, and that’s it!
• Ability to allow or deny wireless access on a per user basis, as well as revoke access to a single user when they leave the organization without having to send everyone a new wireless password or key.
• When users change their windows password, the wireless password changes for them too.
• It is less susceptible to brute force attacks. Users get unique keys for each session, which also prevents snooping from other authenticated users.
• Better VLAN management. If you use VLAN’s they can be assigned on a per user basis while still using the same SSID.
• No need to share wireless passwords with all your users, as everyone has their own.

The disadvantage to Enterprise mode is it requires a little more upfront configuration, but it’s worth it for the added security and easy password maintenance. If you already have a Windows 2012 domain controller, you already have the services available, they just need to be configured.

Here are steps to enable wireless 802.1x authentication with Windows Server 2012

This assumes you already have a working Windows 2012 server with Active Directory.

First we need to install the RADIUS server (Microsoft includes a RADIUS implementation in NAP, Network Access Protection)

Installing Certificate server

1. Server Manager
   1. Add roles
   2. Role-Based
   3. Select Active Directory Certificate Services
2. Close when finishes.
3. Go to flag, and select Post deployment Configuration
   
   1. Select – Configure Active Directory Certificate Services
4. Configure AD Certificate Services
   1. Accept the default Credentials
   2. Check Certification Authority
      
   3. Enterprise SA
      
   4. Root CA
      
   5. Create new Private key
      
   6. SHA1
      
   7. Validity period 20 years
      
   8. Choose default database locations
   9. Configure
5. Request Domain Controller Certificate
   Now that you have the CA up and running, you can get the certificate required by PEAP for authentication server
   
   1. Run – MMC
      
   2. Add or remove snap-in
      
   3. Certificates
      
      1. Computer account
         
      2. Local computer
         
      3. OK
   4. Expand Certificates -> Personal -> Certificates
      1. Right click Certificates and select All Tasks -> Request new certificate
         
      2. On the information window click Next
         
      3. On Certificate Enrollment click Next
         
      4. Select: Domain Controller and choose Enroll
         
   5. TODO – is the exporting step needed if the domain will be trusting certificates?
      Right click new certificate and select all tasks – export
      
   6. Next
      
      1. Do not export private key
         
      2. Use DER binary x.509 (.cer)
         
      3. Save to a secure location
         
      4. Finish
         
   7. This certificate will be installed on all domain computers in another series of steps. TODO
      1. Use AD group policy to set this certificate to be a trusted root certificate
6. Install Certificate to domain computers
   Use Group Policy to install the new certificate as a trusted root certificate for all domain computers
   1. Open Group Policy Management
   2. Right click Group Policy Objects -> New
      
   3. Right Click new Group Policy -> Edit
   4. In the Group Policy Management Console (GPMC), go to Computer Configuration-> Policies -> Windows Settings -> Security Settings -> and then click Public Key Policies.
   5. Right-click the Trusted Root Certification Authorities store and select Import
      
   6. Next
      
   7. Browse to the certificate you exported before
      
   8. Next
      
7. Edit the policy to include wireless settings
   
   1. While in Group Policy Management Editor:
   2. Expand Computer Configuration -> Policies -> Windows Settings -> Security Settings ->Wireless Network (IEEE 802.11) Policies
      Right click Wireless Network (IEEE 802.11) Policies and select Create a new Wireless Network Policy for Windows Vista and Later Releases
      
   3. Name the policy
   4. Click Add -> Infrastructure
      
   5. Name the profile
   6. Add your SSID
      
   7. Select the Security tab
      
   8. Select the Advanced button
   9. Checkbox Enable Single Sign On for this network
      
   10. Click OK to close Advanced security settings
   11. Click OK to close New Profile properties
   12. Click OK to close Network Policy window
8. Apply the wireless group policy to required computers
   1. In Group Policy Management:
   2. Select your Wireless group policy, and drag to the container you want to apply it to
      

   The PEAP certificate will now be installed and the wireless network will be configured via group policy

Install Network Policy and access service role

1. Server manager
   1. Add roles and features
   2. Role-Based
   3. Checkbox Network Policy and Access Services
      
   4. Add Features
      
   5. Checkbox DHCP server (if not already installed)
   6. Next
   7. Checkbox Network Policy Server
      
   8. Install
      
2. Run mps.msc
   
   1. Under Standard Configuration select configuration: RADIUS server for 802.1x wireless
      
   2. Click Configure 802.1x
      1. Secure Wireless Connections
         
      2. Add RADIUS clients (the access points)
         
         1. Give it a descriptive name
         2. Enter the IP address of the Access Point
         3. Create a secure Shared Secret or generate a secure secret
         4. Copy and save Shared Secret to a secure location, you will need it when configuring the access point.
            
         5. Repeat steps above for each Access Point
      3. Next
         
      4. Select EAP Type: EAP PEAP
         
      5. Add AD security group you want to grant access to wireless
         
      6. Next
         
      7. Confirm settings, and select Finish
         
   3. Note: to add more access points later go to NPS(local) -> Radius Clients and servers -> Right click Radius Clients and select New
      
   4. Open CMD prompt
      1. Netsh ras add registeredserver
         
3. Configure Wireless Access Points
   
   1. This depends on the specific model of AP you have, but the settings should be Enterprise WPA2 with AES encryption and the pre shared key from above (one unique for each AP)
4. Configure clients to connect to network
   1. In AD new group policy
   2. Set network name
   3. Set to authenticate using user or group
   4. Do not prompt user to authorize new servers or trusted certification authorities
   5. Automatically use my windows logon name and password