1.   On one of your computers, click Start, click My Network Places, and in Network Tasks, click Set up a wireless network for a home or small office to launch the Wireless Network Setup Wizard.

The Welcome to Wireless Network Setup Wizard page is displayed, as shown in the following figure.

Click Next.

Note

In some cases, you might be redirected to the Network Setup Wizard and asked to provide an Internet connection method, your network name (workgroup name), and to indicate whether the network should be enabled for file and printer sharing. You must complete these tasks before you resume wireless setup.

If this is the first time the Wireless Network Setup Wizard has been launched on the computer, the Create a name for your wireless network page is displayed.

Specify the following:

a.   In Network name (SSID), type a name for your wireless network. In the following example, the wireless network is named WiFi Test.

b.   Select Automatically assign a network key.

c.   Select the wireless encryption for your network.

Note

WPA is much stronger than WEP, but not all wireless devices are compatible with WPA.

If all of your wireless devices support WPA (recommended), select Use WPA encryption instead of WEP.

Click Next.

If the Wireless Network Setup Wizard has been launched on the computer before, the What do you want to do? page will be displayed. Select Set up a new wireless network, and then click Next.

2.   On the How do you want to set up your network? page, select Use a USB flash drive, as shown in the following figure.

Click Next.

3.   On the Save settings to your flash drive page, the wizard prompts you to insert your UFD so that it can create the files you will use to configure your other Windows Connect Now-capable wireless devices.

Note

When you plug your UFD into a USB port, the Wireless Network Setup Wizard will automatically detect the UFD and display the drive letter assigned to it in Flash drive. The drive letter that is displayed depends on the hardware configuration of each computer; it will not necessarily be G:\.

Click Next.

4.   The Wireless Network Setup Wizard copies the wireless network settings and several other XML files to the UFD, and then displays the Transfer your network settings to your other computers or devices page, as shown in the following figure.

Important

Do not click Next at this time.

1.   Plug the UFD into your Windows Connect Now-capable wireless device.

For Windows Connect Now-capable wireless devices that have a monitor or readout display, select from the options provided by the wireless device.

For Windows Connect Now-capable wireless devices that do not have a monitor or readout display, watch the WLAN or USB LED on the indication panel of the wireless device. The LED will flash three times to indicate the configuration is complete for that wireless device.

Important

Some manufacturers use the WLAN or USB LED for other purposes, which may cause it to flash for reasons other than Windows Connect Now configuration. It is recommended that you leave the UFD in each wireless device for 30 seconds to ensure configuration is complete.

2.   Remove the UFD from the device.

3.   Configure your remaining Windows Connect Now-capable wireless devices using steps 1 and 2 in this procedure.

1.   When you plug the UFD into a computer running Windows XP with SP2, the Removable Disk page opens, and the following message is displayed:

This disk or device contains more than one type of content. What do you want Windows to do?

Select Wireless Network Setup Wizard using the program provided on the device.

Note

If the Removable Disk page fails to launch automatically, you must launch the Wireless Network Setup Wizard manually:

a.   Right-click Start, select Explore, and then navigate to the drive letter for your UFD.

b.   Click your UFD drive, and in the right pane, under Name, double-click setupSNK.exe to launch the Wireless Network Setup Wizard.

c.   Go to step 3.

2.   Click OK to launch the Wireless Network Setup Wizard.

3.   When prompted to add the computer to the wireless network, click OK.

4.   When the wizard displays the message, You have successfully added this computer to the wireless network, click OK.

5.   Configure your remaining wireless computers using steps 1 - 4 in this procedure.

1.   When you have finished configuring all of your Windows Connect Now-capable wireless devices, plug the UFD back into the computer on which the Wireless Network Setup Wizard was initially launched.

2.   On the Transfer your network settings to your other computers or devices page, click Next.

3.   The Wireless Network Setup Wizard displays the following page, which lists the wireless computers and devices that have been configured by the Wireless Network Setup Wizard and the UFD.

Click Print Network Settings to print the wireless network settings that were configured by the wizard. Use these settings to manually configure the wireless devices on your network that do not support Windows Connect Now.

If you want to use the UFD to configure wireless computers or devices later, clear the For security reasons, remove network settings from my flash drive check box and store the UFD in a secure location.

To remove the wireless network settings from the UFD, select the For security reasons, remove network settings from my flash drive check box.

4.   Click Finish.

1.   Click Start, click Connect to, and then click Show all connections to open Network Connections.

2.   Right-click your wireless network connection, and then click Properties.

3.   On the General tab, in This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties.

4.   On the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Obtain an IP address automatically. Click OK twice, and then close Network Connections.

1.   Click Start, click Run, in Open type dcpromo.exe, and then click OK to start the Active Directory Installation Wizard.

2.   On the Welcome to the Active Directory Installation Wizard page, click Next.

3.   On the Operating System Compatibility page, review the information, and then click Next.

4.   On the Domain Controller Type page, select Domain Controller for a new domain, as shown in the following figure.

Click Next.

5.   On the Create New Domain page, select Domain in a new forest, as shown in the following figure.

Click Next.

6.   On the Install or Configure DNS page:

·      If DNS is already running on another computer on your network, click Next.

·      If DNS is not running on another computer on your network, select No, just install and configure DNS on this computer, as shown in the following figure.

Click Next.

7.   On the New Domain Name page, type the full name for your domain, as shown in the following figure.

8.   On the NetBios Domain Name page, click Next.

9.   On the Database and Log Folders page, click Next.

10.  On the Shared System Volume page, click Next.

11.  On the Permissions page:

·      If you run server programs on server operating systems earlier than Windows 2000 Server, select Permissions compatible with pre-Windows 2000 server operating systems.

·      If your network servers are running only Windows 2000 Server or Windows Server 2003, select Permissions compatible only with Windows 2000 or Windows Server 2003, as shown in the following figure.

12.  On the Directory Service Restore Mode Administrator Password page, under Password, type a strong administrator password. Under Confirm Password, type the password again, and then click Next.

13.  On the Summary page, review the information, and then click Next.

14.  On the Completing the Active Directory Installation Wizard page, click Finish, and then click Restart Now to restart your computer.

1.   Click Start, point to All Programs, point to Administrative Tools, and then click Active Directory Domains and Trusts.

2.   In the Active Directory Domains and Trusts console, in the details pane, under Name, right-click your domain controller computer, and then click Raise Domain Functional Level.

3.   On the Raise Domain Functional Level page, under Select an available domain functional level, select either Windows 2000 native or Windows Server 2003, and then click Raise.

The following figure shows a domain functional level of Windows Server 2003.

4.   When you raise the domain functional level, the Raise Domain Functional Level warning page appears, as shown in the following figure.

Click OK.

5.   On the notification page that informs you the functional level was successfully raised, click OK.

6.   Close the Active Directory Domains and Trusts console.

1.   Click Start, click All Programs, click Administrative Tools, and then click Active Directory Users and Computers.

2.   In the console tree, expand the domain controller.

The following figure shows a domain controller named example.com.

3.   Right-click Computers, click New, and then click Computer.

4.   In the New Object - Computer dialog box, type the computer name for any domain member computer.

The following figure shows a domain member computer named Client1.

Click Next.

5.   In the Managed dialog box, click Next.

6.   In the New Object - Computer dialog box, click Finish.

7.   Repeat steps 1 - 6 of this procedure to create computer accounts for all the computers on your network.

1.   In the Active Directory Users and Computers console tree, expand the domain controller.

The following figure shows a domain controller named example.com.

2.   Click the Computers folder, and then right-click any computer account.

The following figure shows a computer account named client1.

3.   Click Properties, and on the Dial-in tab, select Allow access, as shown in the following figure.

Click OK.

4.   Repeat steps 1 - 3 for every computer to which you want to allow wireless access.

1.   In the Active Directory Users and Computers console tree, expand the domain controller.

The following figure shows a domain controller named example.com.

2.   In the Active Directory Users and computers console tree, right-click Users, click New, and then click User.

3.   In the New Object - User dialog box, specify the following:

For First name, Last name, and Initials, type the user's name. When you type data in First name and Last name, Full name is populated automatically.

In User logon name, type the account name the user will use to log on to the network.

The following figure shows an example.

Click Next.

4.   In the New Object - User dialog box, type and confirm the password the user will use when logging on to the network, select the option for deploying passwords to the account, click Next, and then click Finish.

5.   Repeat steps 1 - 4 to create user accounts for all the users who connect to your network.

1.   In the Active Directory Users and Computers console tree, expand the domain controller.

The following figure shows a domain controller named example.com.

2.   Right-click Users, click New, and then click Group.

3.   On the New Object – Group dialog box, in Group Name, type WirelessGroup, as shown in the following figure.

Click OK.

1.   In the Active Directory Users and Computers console tree, expand the domain controller.

The following figure shows a domain controller named example.com.

2.   Click Users, and in the details pane, double-click WirelessGroup.

3.   Click the Members tab, and then click Add.

4.   In the Select Users, Contacts, Computers, or Groups dialog box, in Enter the object names to select, type the user account name.

The following figure shows a user account name of UserOne.

Click OK.

5.   If the Multiple Names Found dialog box appears, click OK.

6.   The wireless user's account is added to WirelessGroup, as shown in the following figure.

7.   Click Add to add other users. When you are finished, click OK to save changes to the wireless group.

1.   In the Active Directory Users and Computers console tree, expand the domain controller.

The following figure shows a domain controller named example.com.

2.   In the details pane, double-click WirelessGroup.

3.   Click the Members tab, and then click Add.

4.   In the Select Users, Contacts, Computers, or Groups dialog box, in Enter the object names to select, type the computer account name for any computer to which you want to permit wireless connections to your network.

The following figure shows a computer named Client1.

5.   Click Object Types, and on the Object Types dialog box, clear the Users check box, and then select the Computers check box, as shown in the following figure.

6.   Click OK, and then click OK again. The client computer account is added to WirelessGroup.

The following figure shows the client computer account named Client1.

7.   Click Add to add other computers, and then click OK to save changes to WirelessGroup.

You can repeat these procedure steps at any time to add computer accounts to WirelessGroup.

1.   On your domain controller, click Start, click Control Panel, click Add or Remove Programs, and then click Add Remove Windows Components to launch the Windows Components Wizard.

2.   In Windows Components, select Networking Services, as shown in the following figure.

Click Details.

3.   Under Subcomponents of Network Services, select Windows Internet Name Service (WINS), as shown in the following figure.

Click OK, and then click Next.

4.   If prompted, type the full path to the Windows Server 2003 distribution files (for example, a CD drive containing your Windows Server 2003 CD ROM disk).

5.   On the Completing the Windows Components Wizard page, click Finish.

1.   On your domain controller, click Start, click Control Panel, click Add or Remove Programs, and then click Add Remove Windows Components to launch the Windows Components Wizard.

2.   In Windows Components, select Networking Services, as shown in the following figure.

Click Details.

3.   Under Subcomponents of Network Services, select Dynamic Host Configuration Protocol (DHCP), as shown in the following figure.

Click OK, and then click Next.

4.   If prompted, type the full path to the Windows Server 2003 distribution files (for example, a CD drive containing your Windows Server 2003 CD ROM disk).

5.   On the Completing the Windows Components Wizard page, click Finish.

1.   Click Start, click All Programs, click Administrative tools, and then click DHCP.

2.   In the DHCP console tree, click the DHCP server.

The following figure shows a DHCP server named dc1.example.com [172.16.0.1].

3.   On the Action menu, click New Scope to launch the New Scope Wizard.

4.   On the Welcome to the New Scope Wizard page, click Next.

5.   On the Scope Name page, in Name, type a name for the scope, and in Description, type a brief scope description.

The following figure shows an example.

Click Next.

6.   On the IP Address Range page, in Start IP address and End IP address, define your IP address range. Specify your subnet mask by length or by subnet mask.

The following figure shows a Start IP address of 172.16.0.1; an End IP address of 172.16.0.254; a Length of 24; and a Subnet mask of 255.255.255.0.

Note

The IP address range in this figure is intended for demonstration purposes only. You must determine the IP address range for your network.

Click Next.

7.   On the Add Exclusions page, add an exclusion range for your network devices that will have static address configurations (your wireless APs, domain controller, file servers, and network printers).

For example, if you need to statically assign 10 IP addresses from the address range 172.16.0.1 through 172.16.0.254, you could define your exclusion range as 172.16.0.1 through 172.16.0.10.

The following figure shows a Start IP address of 172.16.0.1 and an End IP address of 172.16.0.10.

8.   Click Add to add the exclusion range, and then click Next.

Note

When deploying wireless technology, the default lease duration of eight days is, in most cases, too long and should be shortened considerably.

9.   On the Lease Duration page, modify the lease duration as appropriate.

The following figure shows a lease duration set to 0 days, 3 hours, and 30 minutes.

Click Next.

10.  On the Configure DHCP Options page, select Yes, I want to configure these options now, and then click Next.

11.  On the Router (Default Gateway) page, enter the IP address for your network router.

The following figure shows an IP address of 172.16.0.5.

12.  Click Add to add the default gateway, and then click Next.

13.  On the Domain Name and DNS Servers page, in Parent domain, type the name of your domain. In Server name, type the computer name of your domain controller.

The following figure shows a parent domain of example.com and a server name of DC1.

14.  Click Resolve to resolve the domain controller IP address. The IP address field is automatically populated with the IP address of the domain controller.

The following figure shows an IP address of 172.16.0.1.

Note

If the DHCP server is not available and the IP address field is not populated automatically, in IP address, type the IP address for your domain controller.

15.  Click Add, and then click Next.

16.  On the WINS Servers page, in Server name, type the server name for your domain controller, and then click Resolve.

The following figure shows a server name of DC1.

Note

If the WINS server is not available and the IP address field is not populated automatically, in IP address, type the IP address for your WINS server.

17.  Click Add, and then click Next.

18.  On the Activate Scope page, select Yes, I want to activate this scope now, as shown in the following figure.

19.  Click Next, and then click Finish.

1.   Click Start, click All Programs, click Administrative tools, and then click DHCP.

2.   In the DHCP console tree, expand the applicable DHCP server.

The following figure shows a DHCP server named dc1.example.com [172.16.0.1].

3.   Right-click the desired scope, and then click Properties.

4.   On the Properties page for the scope, in Lease duration for DHCP clients, select Limited to, and then modify the lease duration as appropriate.

The following figure shows an example lease duration set to 0 days, 3 hours, and 30 minutes.

5.   Click OK to save the settings, and then close the DHCP console.

1.   On your DHCP server, click Start, click All Programs, click Administrative tools, and then click DHCP.

2.   In the DHCP console, click the DHCP server.

The following figure shows a DHCP server named dc1.example.com [172.16.0.1].

3.   On the Action menu, click Authorize.

4.   If prompted, type the name or IP address of the DHCP server to be authorized, and then click OK.

1.   Follow the configuration steps included in the product documentation for your wireless AP.

2.   Determine whether your wireless AP requires the configuration of VSAs, and if so, keep the VSA configuration information readily available when you configure IAS. VSA configuration is covered in two procedures later in this paper:

·      Configure a remote access policy for wireless

·      Configure vendor-specific attributes for remote access policy

3.   Keep a record of the settings that you configure on your APs, in particular:

·      Wireless AP IP address (static)

·      DNS name, wireless AP name

·      Wireless AP subnet mask

·      RADIUS shared secret for each wireless AP

You will need to have this information available when you configure wireless APs as RADIUS clients in the IAS console.

1.   Using an administrator account, log on to your domain controller computer.

2.   Use your Internet browser to navigate to the VeriSign Wireless LAN Server Certificates Web page at http://www.verisign.com/products-services/security-services/ssl/wireless-lan-security/index.html.

3.   On the Wireless LAN Server Certificates page, click Buy Now to begin the enrollment and payment process.

4.   In Select Options, under Validity Period, select either One Year or TwoYear.

Note

After you select the validity period, you can check certificate pricing by clicking Recalculate.

Click Continue.

5.   Review the information that you will need to supply to VeriSign to complete the certificate purchase, and then click Continue.

6.   Under Technical Contact Information, type your contact information. When you have completed the form, click Continue.

7.   On Wireless LAN Server Certificate Information, under Common Name, type the fully-qualified domain name of your domain server.

For example, for a domain server named DC1 in the test.com domain, the fully-qualified domain name is DC1.test.com.

Note

VeriSign server certificates are issued specifically for your server; they will not work on another computer.

8.   Type the following information:

·      Company

·      Division

·      City

·      State

·      Country

Note

All of the fields on this page are required; however, if a particular field does not apply, you can type Not applicable.

9.   At this point, you might receive a Potential Scripting Violation warning that informs you that the VeriSign Web site is requesting a new certificate on your behalf. Click Yes to request a certificate.

10.  Under Creating a new RSA exchange key, click OK.

11.  On the following Web page, under Certificate Information, verify the certificate information. Under Challenge Phrase, type a password phrase, and then confirm the password. Under Reminder Question, enter a short description to remind you of your challenge phrase. Click Continue.

12.  Under Organizational Contact Information, type the contact information, and then click Continue.

13.  Under Payment Type, select the payment method you will use to purchase the certificate.

·      If the billing contact is the same as the technical contact information entered in step 7 of this procedure, select Copy the Technical Contactinformation.

·      If the billing contact is the same as the organizational contact information entered in step 12 of this procedure, select Copy the Organizational Contact information.

·      If the billing contact differs from either the technical or organizational contact information, select New Contact, and then type the contact information.

14.  Click Continue to submit and finish the certificate purchase.

1.   Print a copy of the e-mail message that contains the URL and PIN needed to retrieve your certificate.

2.   Using an account that has local administrator permissions, log on to the domain controller computer that you used to complete the VeriSign enrollment.

Note

In the next procedure, the VeriSign WLAN server certificate is automatically installed in the Local Computer certificate store. For this reason, you must use a Local Administrator account.

3.   Use the Internet browser to access the Web location specified in the e-mail message.

4.   When prompted, type and submit the PIN.

1.   When prompted, click the button to install the certificate.

2.   You should see a Potential Scripting Violation warning message that indicates that the Web site is adding certificates to the computer. Click Yes to proceed with the installation.

You now have a WLAN Server Certificate installed in your Certificates (Local Computer)\Personal\Certificates folder.

3.  

1.   Click Start, click Run, type mmc, and then click OK.

2.   On the File menu, click Add/Remove Snap-In, and then click Add.

3.   Under Snap-In, double-click Certificates, click Computer Account, and then click Next.

4.   Select Local Computer, and then click Finish.

5.   Click Close, and then click OK.

6.   You will see that Certificates (Local Computer) appears in the list of selected snap-ins for the new console.

7.   In the console tree, expand Certificates (Local Computer), expand Personal, and then click Certificates.

8.   In the details pane, you will see a certificate with the Issued To name set to the name specified during the enrollment process.

9.   To view the details of the certificate, in the details pane, double-click the certificate.

1.   On your domain controller, click Start, click Control Panel, click Add or Remove Programs, and then click Add Remove Windows Components to launch the Windows Components Wizard.

2.   In Components, select Networking Services, and then click Details.

3.   In Subcomponents of Networking Services, select the Internet Authentication Service check box, as shown in the following figure.

4.   Click OK, and then click Next.

5.   When the components are configured, click Finish.

1.   Click Start, point to All Programs, point to Administrative Tools, and then click Internet Authentication Service.

The Internet Authentication Service snap-in is shown in the following figure.

Note

Because IAS was just installed, the Internet Authentication Service snap-in might not be listed alphabetically in the Administrative Tools list.

2.   Right-click Internet Authentication Service, and then click Register Service in Active Directory.

3.   When the Register Internet Authentication in Active Directory dialog box appears, click OK.

4.   In the Server registered dialog box, click OK.

1.   In the Internet Authentication Service console tree, right-click RADIUS Clients, and then click New RADIUS Client.

2.   On the New RADIUS Client dialog box, in Friendly name, type a descriptive name for your wireless AP. In Client address (IP or DNS):

·      If you are using the IP address of the wireless AP, type the IP address you used to configure your wireless AP.

·      If you are using the DNS name of the wireless AP, type the name and then click Verify.

The following figure shows a Friendly name of Access Point1 and a Client address (IP or DNS) of 172.16.0.3.

Click Next.

3.   On the Additional Information dialog box:

·      If you are planning to use wireless AP-specific remote access policies for configuration (for example, a remote access policy that contains vendor-specific attributes) in Client Vendor, select the wireless AP manufacturer from the list.

·      If you do not know the manufacturer or if the manufacturer is not in the list, click RADIUS Standard.

In Shared secret, type the shared secret that was used when you configured the wireless AP, and then type it again in Confirm shared secret.

In the following figure, RADIUS Standard is selected to represent an unknown or unlisted wireless AP vendor.

Click Finish.

4.   Repeat steps 1 - 4 of this procedure for every wireless AP that you want to add to your network as an IAS RADIUS client.

1.   In the Internet Authentication Service console, right-click Remote Access Policies, and then click New Remote Access Policy.

2.   On the Welcome to the New Remote Access Policy Wizard page, click Next.

3.   On the Policy Configuration Method page, select Use the wizard to set up a typical policy for a common scenario. In Policy name, type Wireless access, as shown in the following figure.

Click Next.

4.   On the Access Method page, select Wireless, as shown in the following figure, and then click Next.

5.   On the User or Group Access page, select Group, and then click Add.

6.   On the Select Groups dialog box, in Enter the object names to select, type WirelessGroup.

Verify that your domain computer name appears in From this location.

The following figure shows example.com in From this location.

Click OK.

7.   On the User or Group Access page, the group is added to the Group name list.

The following figure shows EXAMPLE\WirelessGroup in Group name.

Click Next.

8.   On the Authentication Methods page, Protected EAP (PEAP) is selected by default and is configured to use PEAP-MS-CHAP v2.

Click Configure.

9.   On the Protected EAP Properties dialog box, in Certificate issued, your VeriSign server certificate is selected by default. Select Enable Fast Reconnect, as shown in the following example.

Click OK.

10.  On the Authentication Methods page, click Next.

11.  The Completing the New Remote Access Policy page provides a summary of the wireless access policy, as shown in the following figure.

12.  Click Finish to close the wizard.

13.  In the Internet Authentication Service console tree, click Remote Access Policies, and in the details pane, identify your new wireless access policy and the two default remote access policies:

·      Connections to Microsoft Routing and Remote Access server

·      Connections to other access servers

The following figure shows an example.

Note

If you are using these steps to create subsequent remote access policies, the two default policies, Connections to Microsoft Routing and Remote Access server and Connections to other access servers, will have already been deleted.

14.  Delete the two default remote access policies.

a.   Right-click Connections to Microsoft Routing and Remote Access server, and then click Delete.

b.   Right-click Connections to other access servers, and then click Delete.

Important

Do not delete the new policy, Wireless Access.

The result is shown in the following figure.

Important

For this scenario, you do not need to configure connection request processing. In the Connection Request Processing container, do not modify either Connection Request Policies or Remote RADIUS Server Groups. Do not delete the default policy named Use Windows authentication for all users; this scenario uses this policy.

1.   In the Internet Authentication Service console, click Remote Access Policies, and then select your new wireless access policy.

Note

The Wireless access policy name applies only to the first remote access policy configured in this scenario. If you create additional remote access policies to support wireless AP VSAs, the policy names will be different.

The following figure shows a policy named Wireless access.

2.   Right-click the wireless access policy, and then click Properties.

3.   On the Settings tab, click Add.

4.   On the Select Attribute dialog box, in Attribute types, select the attribute you want to configure.

Note

Do not configure VSAs for your wireless AP at this time. You will configure VSAs in the next procedure, Configuring vendor-specific attributes for an IAS remote access policy.

a.   For example, to restrict the hours when wireless users are allowed to connect to the network, select Day And Time Restrictions.

Click Add.

b.   On the Time of day constraints dialog box, select the times wireless access is allowed, and then select Permitted.

Click OK.

c.   To configure other policy attributes, click Add, select the desired attribute from the list, and then configure.

5.   When you are finished, click OK.

1.   In the Internet Authentication Service console, click Remote Access Policies, and then select the policy for the wireless AP that requires VSA configuration.

The following figure shows a policy named Wireless access.

2.   Right-click the policy, and then click Properties.

3.   Confirm Grant remote access permission is selected, as shown in the following figure.

4.   Click Edit Profile, and on the Edit Dial-in Profile dialog box, click the Advanced tab, as shown in the following figure.

5.   Click Add. Review the list to see whether your VSA is already in the list of attributes.

A portion of this list is shown in the following figure.

If the VSA is in the list

a.   Select the attribute, click Add, and on the Multivalued Attribute Information dialog box, click Add.

b.   Configure the attribute as described in your wireless AP documentation.

c.   Go to step 6 of this procedure.

If the VSA is not in the list

a.   From the list, select Vendor-Specific, as shown in the following figure.

Click Add.

a.   On the Multivalued Attribute Information dialog box, click Add.

a.   On the Vendor-Specific Attribute Information dialog box, specify the following information.

6.   Click OK or Close to close all open dialog boxes.

1.   In the Internet Authentication Service console, right-click Internet Authentication Service, and then click Properties.

2.   On the General tab, verify that Rejected authentication requests and Successful authentication requests are selected, and then click OK.

3.   Click Remote Access Logging, as shown in the following figure.

4.   In the details pane, double-click Local File.

5.   On the Local File Properties dialog box, on the Settings tab, select Accounting requests, Authentication requests, and Periodic status, as shown in the following figure:

6.   On the Log File tab, in Format, select Database-compatible.

7.   Under Create a new log file, select the log file frequency setting you prefer, as shown in the following figure.

Click OK.

1.   On your domain controller, DC1, click Start, point to All Programs, click Administrative Tools, and then click Active Directory Users and Computers.

The following figure shows an example.

Right-click the domain system container that contains your wireless computer accounts, and then click Properties.

2.   On the Group Policy tab, click the appropriate Group Policy object.

The following figure shows the default object, Default Domain Policy.

3.   Click Edit.

4.   In the console tree, expand Computer Configuration, expand Windows Settings, expand Security Settings, and then click Wireless Network (IEEE 802.11) Policies, as shown in the following figure.

5.   Right-click Wireless Network (IEEE 802.11) Policies, and then click Create Wireless Network Policy.

6.   On the Welcome to theWireless Network Policy Wizard page, click Next.

7.   On the Wireless Network Policy Name page, in Name, type WirelessGroup Policy. In Description, type a brief description of the policy, as shown in the following figure.

Click Next.

8.   On the Completing the Wireless Network Policy Wizard page, confirm Edit properties is selected, as shown in the following figure.

Click Finish.

9.   On the WirelessGroup Policy Properties dialog box, on the General tab, select one of the following from the Networks to access drop-down list:

·      Any available network (wireless AP preferred) specifies that wireless computers attempt connections to a wireless AP (infrastructure) network before attempting computer-to-computer (ad hoc) connections. Recommended only for wireless policies in which either infrastructure or ad-hoc connections are desirable.

·      Wireless AP (infrastructure) networks only specifies that wireless computers only attempt connections to a wireless AP (infrastructure) network. This is the recommended wireless policy for networks in which ad-hoc connections are not desirable.

·      Computer-to-computer (ad hoc) networks only specifies that wireless computers only attempt computer-to-computer (ad hoc) wireless connections. This wireless policy is used only in networks in which it is not desirable for wireless devices to make wireless connections to the network infrastructure.

Important

The Computer-to-computer (ad hoc) networks only option conflicts with the purpose of this deployment scenario. Therefore, it is not recommended. If you select this option, connection attempts to your wireless infrastructure will fail.

Make sure that Use Windows to configure wireless network settings for clients is selected, as shown in the following figure.

10.  On the Preferred Networks tab, click Add to add a preferred network.

11.  On New Preferred Networks, on the Network Properties tab:

a.   In Network Name (SSID), type the network name for your wireless network.

b.   In Description, type a description.

c.   To specify that a network key is used for authentication to the wireless network, from the drop-down list in Network authentication, select either WPA (recommended) or Open (discouraged).

By default, open system authentication is used.

Note

Although available in the drop-down list, do not select Shared or WPA-PSK. Neither should be used in this scenario.

d.   To specify that a network key is used to encrypt the data that is sent over the network, from the drop-down list in Data encryption, select one of the following:

Note

By default, WEP is selected in Data encryption.

e.   If available, select The key is provided automatically.

The following figure shows an example of New Preferred Setting Properties with these settings:

SSID: WiFiTest

Description: Sample Description for wireless network.

Network Authentication: WPA

Data encryption: TKIP

The key is provided automatically: (selected)

This is a computer-to-computer (ad hoc) network; wireless access points are not used: (not selected)

12.  Click the IEEE 802.1x tab.

13.  Confirm Enable network access control using IEEE 802.1X is selected. (This is the default setting.)

From the EAP type drop-down list, select Protected EAP (PEAP).

These settings are shown in the following figure.

14.  Click Settings.

15.  On the Protected EAP Properties dialog box, do the following:

a.   Verify that Validate server certificate is selected.

b.   In Trusted Root Certification Authorities, select the certificate you obtained from VeriSign.

c.   From the Select Authentication Method drop-down list, select Secured password (EAP-MS-CHAP v2).

d.   Select Enable Fast Reconnect.

These settings are shown in the following figure.

Click Configure.

16.  On the EAP MSCHAPv2 Properties dialog box, make sure Automatically use my Windows logon name and password (and domain if any) is selected.

17.  Click OK, and then close the Group Policy Object Editor.

1.   Log on to a wireless computer using the domain user account.

2.   Wait until you are prompted to select the wireless network.

3.   In the notification area, right-click the wireless network connection icon, and then click View Available Wireless Networks.

Note

You can right-click the icon for the wireless adapter in either the notification area or in Network Connections.

4.   On the Choose a wireless network page, select your network, and then click Connect.

When connected, the Choose a wireless network page will display the status of the connection as Connected.

1.   Right-click the wireless network connection icon in either the notification area or in Network Connections, and then click View Available Wireless Networks.

2.   Under Related Tasks, click Change advanced settings.

3.   On the Wireless Network Connection Properties dialog box, click the Wireless Networks tab.

4.   In Preferred Networks, select the appropriate wireless network, and then click Properties.

5.   On the Association tab, verify that both Network Authentication and Data encryption are set correctly, and confirm that the correct network key is being used.

6.   On the Authentication tab, confirm the following settings:

Enable IEEE 802.1x authentication for this network is selected.

EAP type is set to Protected EAP (PEAP).

Authenticate as computer when computer information is available is selected.

7.   On the Connection tab, make sure that Connect when this network is in range is selected.

8.   After authentication is successful, use Network Connections to check the TCP/IP configuration for the wireless adapter. It should have an address within the range of the DHCP scope.