Got it!
? Login to the computer as Local Administrator
? Get into the Wireless Connection Configuration through Start, Settings, Network?
? Under Preferred Networks, Click ADD
? type in your SSID Name - Ours is XX-Secure
? Under Network Authentication, select WPA
? Under Data Encryption, select TKIP
Click on the Authentication Tab and go to the next step
Under the Authentication tab, Select ?Protected EAP (PEAP)? as the EAP type.
Make sure that the Authenticate as computer when computer information is available has a check-mark next to it.
You will receive an error message when you try to login that the Domain is not available if this is not checked
This is what allows the computer to authenticate against the Domain BEFORE the user logs in. If this is not checked, then un-cached user accounts will not be able to login on the PC.
Click on the Properties button to change the EAP/PEAP Properties
When you click on the Properties button The Protected EAP (PEAP) properties page opens up.
I did not check the "Validate server certificates" box here
Check mark in enable fast reconnect
select secured Password (EAP-MSCHAPv2)
click on the Configure button next to Secured password (EAP-MSCHAPv2)
Here, make sure there is a check-mark in the box for ?Automatically use my Windows logon name and password (and domain if any).
This allows for the user to automatically authenticate to the Wireless LAN and your Domain by passing the username and password that they logged into the computer with.
On the ACS Server, do this
Click on External User Databased
Click on Database Configuration
Click Windows Database
Click Configure
MSCHAP Settings
Checkbox in Enable Password Changes using MS-CHAP-version 2
Windows EAP Settings
Checkbox for Enable Password changes inside PEAP or EAP-FAST
Machine Authentication
Checkbox for Enable PEAP Machine Authentication
Checkbox for Enable EAP-TLS and Authentication
EAP-TLS and PEAP Machine Authentication name prefix = host/
Leave the rest as default
That did it for me. When the computers are configured as above, and they boot up, you'll see that they register in the Passed Authentications log under Reports and Activities. The steps should be that the Computer authenticates, then the user. For logouts, the user logs out, then the computer de-authenticates. This shows that the computer is pulling AD Computer Policies, then the user based policies for startup/login and logout/shutdown
let me know if you're successful
DCM
