GPO 802.11 wireless policy gotcha

[KK20]

I have had an 802.1x wireless policy based on computer certificates, ive been running this setup for a long time without issue (plus a fudgy "known user" + certificate for our chromebooks via google wireless profile).  I was setting up a new 802.1x SSID for testing use and set up a new GPO in the computer->policies->windows settings->security settings->wireless Network 802.11 section.  I was pretty sure this is where I had set my "normal SSID secure" gpo before.  No problem so far.  My test machines got the gpo, connected and ran really really slowly, mainly due to the machine now connecting at 54Mb, controller confirmed the client was negotiating at 802.11a at 5Ghz.  Ouch.  Switching between the two secure SSIDs switched the speed back to 500 odd Mb (40Mhz  width).  Both authenticated via our radius server just fine, I could see the accounting being what I expected.   I surmised I was an idiot and probably selected TKIP, WPA, or legacy something in my new SSID.  Except I hadn't because my controller (unleashed) wont let me select TKIP or WPA, only allows WPA2+ .  I almost ran out of ideas until I exported the two profiles on the test machine and looked for differences.  Low and behold my "new" profile had line

<FIPSMode xmlns="http://www.microsoft.com/networking/WLAN/profile/v2">true</FIPSMode> 

But seemingly no way in the GPO of disabling this.  There SHOULD be an option to disable "perform cryptography in FIPS 140-2 certified mode." but I cannot see this in the security/advance section.   Luckily I could tweak the XML and import the XML into the GPO.  As long as I didn't edit any settings in the GPO (and simply imported), this seemed to stick and roll out to my test clients (overwriting the wireless profile on the client).  

[psydii]

Wow. Great tip, I don't think I've ever needed to export the profile, so would never have thought to that to compare the settings. Hope to never see this though.

 

Just for reference, what release of windows did you use to create the profile, what release was the profile applied to? Were any other versions used to edit or update the profiles?

 

Is it possible the machine that created the profile (or edited it) had the

"System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" setting applied to it?

[KK20]

I created the new (seemingly faulty) profile on a 2022 domain controller via GPO, the domain controller has no WIFI device and has no netsh wlan profiles as a base (not that I thought GPO would take into account anyway).  The ORIGINAL secure SSID has been there for a number of years, lord knows how that was done.   I used the same test client (W11 25H2 newish laptop) as a testbed, this machine was freshly imaged and would behave the same as any other machine on the network.  I exported both profiles on this machine and compared side by side.  Since they are GPO assigned profiles I cannot manually drill down into them via the client side GUI screens.

 

In the past I am almost positive that I created a GPO and rolled to clients (freshly minted clients would connect via ethernet after deployment, grab GPOs as appropriate and go on their merry wireless way when ethernet disconnects), but now I come to think of it, I could well have scripted this as a netsh import as part of the installation.  I did have a niggle in my brain that I had come up against this as a problem before.

 

Either way, dont trust the GPO for setting an IEEE 802.11 profile.  I will create one in intune and roll that to a test device to see what intune does.