Active Directory integrated MAC based wireless authentication with Internet Authentication Service
Published: June 2007
Author
Charlie Mongoho
MCSE:Messaging, MCTS:SQL Server 2005, CCNA, Security+, Network+, A+
ciphernet@gmail.com
This paper describes steps to implement an Active Directory/Internet Authentication Service (RADIUS) integrated solution for MAC address based authentication for wireless devices using a RADIUS and MAC address authentication capable Access Point. We used Windows Server 2003 R2 SP2 and Proxim AP 600 Wireless Access Point.
? Install IAS on a domain controller. Make sure that domain controller is a member of RAS and IAS Servers group. IAS is installed by going to Add/Remove Program ? ADD/Remove Windows Components ? Networking Services ? Internet Authentication Service.
? Create a Security Group in Active Directory that will contain the MAC Address of Laptops Wireless Cards. In this case we called it ?Wireless MACS?
? Create users with the MAC address as usernames and the Access Point shared secret as the password. Make these users members of the Security group you created in the previous step.
? Create a Remote Access Policy in the IAS that will grant Remote Access by the membership in the Windows group you created above. In this case we called the policy ?Authenticate wireless MAC accounts based on Group Membership? as below:
? Add the Wireless Access Point as a RADIUS client in IAS.
? Add the User Identity Attribute key to the Registry, to allow MAC address authentication.
Edit the Registry and add the following key with the Hexadecimal DWORD value of 31.
HKEY_LOCAL_MACHINE ? SYSTEM ? ControlSet001 — Services ? Remote Access ? Policy ? User Identity Attribute
We can set the Override User-Name registry value to 1 to always use the MAC address as the user identity. This solution allows a centralized solution for managing Wireless connections using the Windows Infrastructure. For better optimization and based on every organization particular need we may want to implement this solution for consultants, contractors or short term employees in conjunction with a certificate based wireless access solution for permanent employees.
Resources:
Wireless Deployment Best Practices
http://technet.microsoft.com/en-us/library/bb457091.aspx
IAS resources
http://www.microsoft.com/technet/network/ias/default.mspx
How IAS works
http://technet2.microsoft.com/windowsserver/en/library/e9a30a60-7f8b-435f-b210-d47c3b7ecb961033.mspx?mfr=true
Charlie Mongoho
MCSE, MCSA: Messaging, CCNA, Security+, Network+, A+
ciphernet@gmail.com