3

We have 20 location and about 150 laptop clients, each location has Cisco WLC 5508. Right now everyone is using same password which is individually configured on all WLCs.

Is there any management software that allows to set WiFi password automatically on all laptops remotely? - I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason)

The ideal is: - I configure username/password in ACS - I somehow send (set) username/password (from ACS) on user PCs (THAT IS THE PROBLEM) - User connects to a network (if user is in WiFi group in AD and authenticated through ACS).
- if i decide to change network password, I update wifi credentials in ACS and all users get this updated credentials on their laptops.

Right now every time we change the password we go through headache of updating it for users.

Update: Thanks for our reply. I was thinking about this and actually configured machine based authentication. And it works through PEAP. Then I though what if someone who not suppose to have wifi access logs in to that laptop (since employees always leave laptops laying on a table unattended). I tried to find a way to perform Machine AND User authentication, but could not find a solution, unless I add all laptops to ACS and create host group and then use User authentication through PEAP. I was thinking more about 2 step process. Step 1: A software or hardware (WHAT I NEED) that takes care of credentials for the device and saves it (lets say only laptops have credentials for WiFi) Step 2: ACS checks against allowed users in AD group, time, location, etc. P.S. May be I want too much, but I think there should be a solution.

1
  • FYI, EAP-TLS provides password-less machine and Windows user authentication. This will require you to manage your own local CA, so you can issue / revoke SSL Certificates, as-required. Aug 30, 2014 at 10:39

2 Answers 2

3

I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason)

As you mentioned Windows and ACS, you can still use user credentials via dot1X and not allow them to connect via phones. As long as you're doing Machine auth in ACS and requiring computer authentication in Windows in the wireless profile, then only computers joined to your AD domain tied to ACS would be allowed.

ACS Machine Access Restrictions

In the Windows wireless profile, under Advanced Settings, the authentication mode would be "User or computer authentication". This setting is poorly named as it can be both user and computer authentication. When Windows is started but before user login, and assuming an existing wireless profile, computer authentication takes place with the computer account tied to AD. After a user login, then another dot1X AuthN event takes place with the user account. The time between the computer AuthN and the user AuthN must be in the window specified by the Aging time in the ACS Machine Access Restrictions shown above or the user AuthN will repeatedly fail. I keep this aging time wide to prevent issues, and this obviously needs to mirror your security tolerance for your org.

Windows wirless profile computer-user AuthN

3
  • Thanks. I'll try that again. I tried before to do same thing and after Machine Authentication succeeded - it never made it to User authentication. Then I found somewhere that through PEAP you can do Machine OR User, but never both.
    – Dranik
    Aug 30, 2014 at 19:47
  • Windows7 802.1x supplicant default setting is to have just "computer authentication". Sep 1, 2014 at 2:43
  • User and computer authentication works. I will continue testing. But if i boot Linux from same machine - it still passes machine authentication. That's weird. Thanks
    – Dranik
    Sep 2, 2014 at 21:55
0

Haven't messed around with OUs in AD for some time but if I recall correctly, you could update the passwords on all windows clients with Group Policy.

I would seriously test this before deploying.

A quick google search showed many links and howtos. http://www.techrepublic.com/blog/the-enterprise-cloud/change-local-username-and-password-via-group-policy/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.