Laptop Wireless setup through GPO

[sultan966]

Today I tried to configure wireless settings of a laptop through GPO. I could not find a dialogue box where I could put the actual key. I tried as follows:

 

Computer Configurations -->Windows Settings -->Security Settings -->Wireless Network (IEEE 802.11) Policies-->Right Click Create Wireless Network Policy .

On the properties of the new policy there are only two tabs: General and Preferref Network.

 

On the preferred network tab I can add a network. I added a network with SSID. In the wireless network key section the options are:

 

Network authentication - Open/Shared/WPA/WPA-PSK

Data Encription: WEP/TKIP/AES

The key is provided automatically.

 

I do not see an option where I can put the actual key. It only mentions the method but nothing about key itself.

 

If anybody has done this before please let me know.

 

Regards,

 

SU

[nicklec]

I dont think you can set a pre shared key even though it seems to indicate you can! We have a wireless GPO but that is using 802.1x and certificates for the authentication/encryption (managed APs).

[MicrodigitUK]

I do it with an exe and a start up script. The exe is a tool from Aruba networks that will do what you want. Ther is also a free version of the exe somewhere without Aruba branding. Think There is an xp version and a vista/7 version. Will try to dig out the link to the free version but I am shore iv seen it on a old post on edugeek.

[MicrodigitUK]

I do it with an exe and a start up script. The exe is a tool from Aruba networks that will do what you want. Ther is also a free version of the exe somewhere without Aruba branding. Think There is an xp version and a vista/7 version. Will try to dig out the link to the free version but I am shore iv seen it on a old post on edugeek.

Just had a look at the script in our gpo and the exe is called WifiCfg_XP.exe

[maniac]

As @nicklec said, you can't setup a wireless with a pre shared key using GPO. However, it's not actually that hard to setup your wireless network to use a RADIUS server if your access points support authenticating to one, then you can use a GPO to push your wireless settings to your clients - it does save a lot of hassle if you get this working.

[jamesfed]

As I understand the reason you can't put the key in the GPO is that GPOs are stored in the Sysvol folder - as the GPOs themselves aren’t encrypted and sysvol is readable by everyone on your network anyone would then potentially be able to read that key.

 

We use 802.1x authentication here with our Aerohive WiFi - works like a treat and I don't ever have to worry about putting keys in manually as everything is looked after by the GPO.

If you at all can look into 802.1x and RADIUS – it makes life so much simpler than playing around with scripts and once its setup it is very hard to break.

[sultan966]

Any link to radius setup will be highly appreciated. I will go for radius.

 

Regards,

 

SU

[jamesfed]

Any link to radius setup will be highly appreciated. I will go for radius.

 

Regards,

 

SU

 

What Wireless system is it that you are using?

[sultan966]

We are currently using Linksys WAP54G wireless access point. This access point supports radius authentication.

Regards,

 

SU

[SW-ICT]

Sounds silly... If its a brodcom driver you may need SP3 installed..

 

That helps us out big time... and installed it by fluke aswell

 

Tried it a few more time to make sure it was not luck and all the laptops would connect up to the wireless

 

Hope this helps you (fingers crossed)

[k-strider]

if you are using windows 7 you could use the netsh wlan add profile command

 

netsh wlan add profile filename=LocationOfFile\WIRELESS.xml

 

you would need to first export the profile using "netsh wlan export profile" command to get the XML of course

 

you could run this from a GPO script

[DellOughta]

Just thought I'd share this with you (I know its not GPO) but will help you set up wireless connection in a click if you copy the file to your laptop. I've just incorpoarted into my windows 7 image and it works a treat

 

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Originally Posted by eean

I use the Wireless Setup Wizard on the control panel. This copies a exe and a ini file onto a pen drive. You can run it from a folder on the hard drive but you have to use the subst command to create a drive letter to that folder (to trick it). I made the following script. This is a .bat file that creates a temporary drive letter. Then it calls an AutoIt script file that automates all the OKs etc...

Use on the end of our automated cd setup. It has never skipped a beat.

 

 

Bat file here:

 

Code:

@echo OFF

ECHO Setup in progress. Please do not touch.

 

REM This script runs the windows xp wireless setup wizard.

 

REM This 'maps' the t: drive to c:\windows\setuptemp\03_setupwireless

SUBST T: %SystemRoot%\SetupTemp\03_SetupWireless

 

ECHO Installing Wireless Network

 

REM Start the Windows Wireless setup wizard.

START /W %systemroot%\SetupTemp\Autoit3.exe %systemroot%\SetupTemp\03_SetupWireless\Setup.au3Auto it file here:

 

Code:

;This script automates the instillation windows wireless setup wizard

Splashtexton("Setup", "Setting up wireless connection. Please do not touch.", 500, 100)

 

;Prevent user sending any keystrokes

BlockInput(1)

 

Run ("t:\setupSNK.exe")

 

WinWait ("Wireless Network Setup Wizard", "Do you want to add")

 

Send ("{ENTER}")

 

WinWaitClose ("Wireless Network Setup Wizard", "Do you want to add")

 

WinWait ("Wireless Network Setup Wizard")

 

Send ("{ENTER}")

 

;Allow Keystrokes to be sent by user

BlockInput(0)You need to put the bat file and autoit3.exe in c:\windows\setuptemp.

You need to put the autoit script and setupsnk.exe and all the other wireless setup files in c:\windows\setuptemp\03_setupwireless

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

[sultan966]

if you are using windows 7 you could use the netsh wlan add profile command

 

netsh wlan add profile filename=LocationOfFile\WIRELESS.xml

 

you would need to first export the profile using "netsh wlan export profile" command to get the XML of course

 

you could run this from a GPO script

 

 

Many thanks for directing me towards this solution. It is the simplest and best solution. The key=clear word must be specified while exporting the profile. Works like magic. I have done as follows:

 

netsh wlan export profile name="MyProfileName" folder=c:\Temp interface="Wireless Network Connection" key=clear

 

 

Then imported the profile in another laptop as follws:

netsh wlan add profile filename="location of xml file" interface="Wireless Network Connection" user=all

 

It works fine. Does not ask for a key. key=clear must be mentioned during export otherwise it asks for a key after importing.

 

I have put the file on the server. From there it works as well.

 

Many thanks.

[mattpenner]

Many thanks for directing me towards this solution. It is the simplest and best solution. The key=clear word must be specified while exporting the profile. Works like magic. I have done as follows:

 

netsh wlan export profile name="MyProfileName" folder=c:\Temp interface="Wireless Network Connection" key=clear

 

 

Then imported the profile in another laptop as follws:

netsh wlan add profile filename="location of xml file" interface="Wireless Network Connection" user=all

 

It works fine. Does not ask for a key. key=clear must be mentioned during export otherwise it asks for a key after importing.

 

I have put the file on the server. From there it works as well.

 

Many thanks.

 

This is indeed incredibly easy. We have about 120 netbooks that we give to students to use, but many of them keep removing the campus wireless settings when they connect at their houses. Having a script that would drop and recreate the campus wireless on startup would solve this issue. What options do we have to either encrypt the password or put the xml file in a directory that only admins have access to so that the students can't view the contents? It can't be on a network share because without the wireless settings in place the network would be unavailable.

 

Thanks,

Matt Penner

[SYNACK]

This is indeed incredibly easy. We have about 120 netbooks that we give to students to use, but many of them keep removing the campus wireless settings when they connect at their houses. Having a script that would drop and recreate the campus wireless on startup would solve this issue. What options do we have to either encrypt the password or put the xml file in a directory that only admins have access to so that the students can't view the contents? It can't be on a network share because without the wireless settings in place the network would be unavailable.

 

Thanks,

Matt Penner

 

As long as the students don't have admin rights on the netbooks (eeek) then you could simply change the permissions on the file to only allow read from SYSTEM and Administrators. You could then just run the script using a machine startup script or even as a scheduled task. As long as the specified user for the scheduled task (on startup) has the right privilages to read the file your sorted.

[mattpenner]

Thanks, this indeed probably would work. No, no admin rights on the netbooks.