Wireless and RADIUS

[jamin100]

Just a quick question.

 

I have quite a few DLINK Access points and a couple of mobile laptop suites.

They are currently configured for WPA would a RADIUS server speed up logging on?

[plexer]

Nope would probably slow it down.

 

Ben

[srochford]

It would slow it down but you're probably only talking milliseconds - there's not much involved in the authentication process.

[contink]

Remember it has the benefit of authenticating the machine before the user logs in though which means things like GPO updates are applied quicker.

[srochford]

Remember it has the benefit of authenticating the machine before the user logs in though which means things like GPO updates are applied quicker.

 

How??

 

the machine has to authenticate before the user logs in - otherwise you'll get "Domain not available" messages

 

The GPO updates for the machine should get applied before the user logs on if you have it set to wait for network at startup; the user bits of GPO can't apply until after the user has logged on (because they depend on the user!)

[contink]

How??

 

the machine has to authenticate before the user logs in - otherwise you'll get "Domain not available" messages

Ugh... Did I miss something then when I was reading up on this...?

 

I was under the impression that the RADIUS approach improved computer authentication compared to WPA-PSK which only seems to authenticate on the user level. Perhaps I just assumed on the basis that the connection seems to go on in the desktop half the time.

 

The GPO updates for the machine should get applied before the user logs on if you have it set to wait for network at startup; the user bits of GPO can't apply until after the user has logged on (because they depend on the user!)

True enough... Seems I made some basic errors...

[SYNACK]

Ugh... Did I miss something then when I was reading up on this...?

 

I was under the impression that the RADIUS approach improved computer authentication compared to WPA-PSK which only seems to authenticate on the user level. Perhaps I just assumed on the basis that the connection seems to go on in the desktop half the time.

 

It depends on the way that you set RADIUS up, if you set it up to authenticate via a computer certificate it can quite happily connect to the wireless before a user logs in. If it is setup to authenticate via a user certificate of username/password then it will not be able to connect to the network untill the user has logged in.

[srochford]

I think we're getting two kinds of authentication mixed up - there's the computer authenticating to get a network connection via wireless - you want this to happen before the user logs on but (as far as I know) this will happen even with a standard WEP key after the first time it's been entered. the other authentication is the computer account authenticating with active directory - this needs a network connection to be in place (kind of hard for the computer to talk to a DC without it :-))

[contink]

I think we're getting two kinds of authentication mixed up - there's the computer authenticating to get a network connection via wireless - you want this to happen before the user logs on but (as far as I know) this will happen even with a standard WEP key after the first time it's been entered. the other authentication is the computer account authenticating with active directory - this needs a network connection to be in place (kind of hard for the computer to talk to a DC without it :-))

 

Aye... makes sense when you think about it.. I wasn't entirely sure though... For myself I've setup Radius to authenticate the computer and then allow users to login...

 

Simplifies things somewhat