Network Center for IT Pros

Network and Sharing Center is the main client-side portal into Windows networking components. Network and Sharing Center provides features that enable you to:

  • View computers and devices on your network.

  • Configure Sharing and Discovery settings.

  • Connect to virtual private networks (VPNs) as well as wired and wireless networks.

  • Set up a new network.

  • Manage network connections.

  • Diagnose and repair file sharing and network connectivity problems.

Learn from the full set of documentation available for Network and Sharing Center, available at http://go.microsoft.com/fwlink/?LinkID=94384.

Management and Operations

The Network and Sharing Center Operations Guide provides information and procedures for common tasks that you can use to configure and use Network and Sharing Center and the Network Map.

The Network and Sharing Center Operations Guides is available on the Web at http://go.microsoft.com/fwlink/?linkid=63530.

Technical Reference

The Network and Sharing Center Technical Reference provides technical reference information for the Network and Sharing Center and Network Map. It includes conceptual information, information about dialing phone numbers in Windows, and references for the various tools, Group Policy settings, and events that are part of the Network and Sharing Center in Windows.

The Network and Sharing Center Technical Reference is available on the Web at http://go.microsoft.com/fwlink/?LinkId=71748.

Troubleshooting

The Network and Sharing Center Troubleshooting Guide provides troubleshooting information for Network and Sharing Center and Network Map that can help you identify and resolve network connectivity problems.

The Network and Sharing Center Troubleshooting Guide is available on the Web at http://go.microsoft.com/fwlink/?LinkId=105689.


New XP Wireless Network Policy Properties - General

Wireless network settings in Wireless Network (IEEE 802.11) Policies include global wireless settings, the list of preferred networks, Wired Equivalent Privacy (WEP) settings, and IEEE 802.1X settings. These settings encompass all of the items on the Association and Authentication tabs in the properties dialog box for a wireless network on a wireless client running Windows XP with Service Pack 3 (SP3), Windows XP with SP2, Windows XP with SP1, or Windows Server 2003, as well as additional settings.

General - configuration items

Item Details

XP Policy Name

Provides a location for you to type a friendly name for the wireless network policy.

Note

When you name the wireless network policy, the name you specify is displayed as the title of its properties page, and under XP Policy Name in the details pane in the Group Policy Management Console (GPMC) for that policy.

Description

Provides a location for you to type a description for your network policy.

Note

The description you type is displayed under Description in the details pane of the Group Policy Management Console (GPMC) for that policy.

Networks to access

Specifies the types of wireless networks to which the wireless client is allowed to create connections:

  • Any available network (access point preferred)

  • Access point (infrastructure) networks only

  • Computer-to-computer (ad hoc) networks only

Use Windows WLAN AutoConfig service for clients

Enables the Wireless Zero Configuration service. When enabled, the Wireless Zero Configuration service is used to configure and connect clients running Windows XP to wireless networks.

Note

Clients running Windows XP use Wireless Zero Configuration while clients running Windows Vista® or Windows® 7 use the WLAN AutoConfig service.

Automatically connect to non-preferred networks

Specifies that wireless clients can attempt to automatically connect to wireless networks that are not configured as preferred networks.

If selected, your domain-member wireless clients can connect to a non-preferred network after first attempting to connect to preferred networks.


New Profile Properties - Security

You can use security settings that are provided in Wireless Network (IEEE 802.11) Policies to specify the authentication parameters that your wireless network clients use to initiate requests for 802.1X authenticated wireless access.

On the Security tab of New Wireless Network Policy Properties:

  • Security settings are separated into two groups of configuration items: Select the security methods for this network and Select a network authentication method.

  • You must enable WPA2-Enterprise, WPA-Enterprise, or Open with 802.1X to expose Extensible Authentication Protocol (EAP) authentication settings.

  • You must enable WPA2-Enterprise, WPA-Enterprise, WPA2-Personal or Open with 802.1X to access Advanced security settings. If you select WPA2-Personal, Perform cryptography in FIPS 140-2 certified mode is the only setting available for configuration.

  • Fast Roaming is a feature of WPA2-Enterprise. You must enable WPA2-Enterprise to expose the Fast Roaming settings on the Advanced security settings tab.

Security - configuration items

Network Security Method - Configuration Items pertain to the authentication and security that the client uses to exchange data with the wireless access point.

Network Authentication Method - Configuration Items pertain to the EAP method that is used for 802.1X authenticated network access.

Network security method - configuration items

Item Details

Authentication

Specifies the security authentication method to use when the wireless client associates with the wireless access point.

  • Open

  • Shared

  • WPA-Enterprise

  • WPA-Personal

  • WPA2-Enterprise

  • WPA2-Personal

  • Open with 802.1X

Default = the most secure setting supported by the wireless hardware and drivers.

Encryption

Specifies the security encryption to use for the selected network security authentication method.

If the Authentication is set to WPA-Enterprise, WPA-Personal, WPA2-Enterprise, or WPA2-Personal, the encryption options are AES (Advanced Encryption Standard) or TKIP (Temporal Key Integrity Protocol).

If Authentication is set to Open, Shared, or Open with 802.1X, then encryption options are either WEP (Wired Equivalent Privacy) or Disabled.

Network authentication method - configuration items

Item Details

Select a network authentication method

Specifies the network authentication method that connecting wireless clients use:

  • Microsoft: Smart Card or other certificate (EAP-TLS)

  • Microsoft: Protected EAP (PEAP), which, by default, supports both “Smart card or other certificates” and “MS-CHAP v2” authentication types.

Default = Protected EAP (PEAP) with MS-CHAP v2, and Windows logon credentials.

Properties

Opens the properties page of the selected network authentication method.

For setting information for network authentication methods, see:

Network Authentication Methods Properties

Authentication Mode

Specifies how network authentication is performed:

  • User or Computer authentication. An 802.1X-compliant device always uses security credentials based on the current state of the computer. Authentication is performed by using the computer credentials when no users are logged on to the computer. When a user logs on to the computer, authentication is always performed by using the user credentials.

    This is the recommended setting.

  • Computer authentication. Authentication is always performed by using only the computer credentials.

  • User authentication. Specifies that when users are not logged on to the computer, authentication is performed by using the computer credentials. After a user logs on to the computer, authentication is still based on the computer credentials. Authentication is performed by using the user credentials if the user travels to a new wireless access point.

  • Guest authentication. Allows connections to the network which are regulated by the restrictions and permissions set for the Guest user account.

Default = User or Computer authentication

Max Authentication Failures

Specifies the maximum number of failed authentication attempts that can occur with a specific set of credentials before notification is displayed to indicate that authentication has failed.

Default = 1

Cache user information for subsequent connections to this network

Specifies that when the user logs off, the user credential data is saved in the registry. The next time the user logs on, the user is not prompted for their credentials (such as user name and password).

Default = enabled

Advanced

Provides access to advanced security settings.


New Wired Network Policy Properties - Security

Security configuration items include all of the settings on the Security tab. These settings specify whether to perform 802.1X authentication for connecting clients and which network authentication method to use.

Security - configuration items

Item Details

Enable use of IEEE 802.1X authentication for network access

Specifies that 802.1X authentication is performed for access requests to the wired network.

You must select Enable use of IEEE 802.1X authentication for network access to expose Extensible Authentication Protocol (EAP) authentication method settings and the settings on the Advanced security settings tab.

Default = enabled

Select a network authentication method

Specifies the network authentication method that connecting clients use:

  • Microsoft: Smart Card or other certificate (EAP-TLS)

  • Microsoft: Protected EAP (PEAP)

Default = Microsoft: Protected EAP (PEAP)

Properties

Opens the properties page of the selected network authentication method.

For setting information specific to network authentication methods, see:

Network Authentication Methods Properties

Authentication Mode

Specifies how network authentication is performed:

  • User or Computer authentication. An 802.1X-compliant device always uses security credentials based on the current state of the computer. Authentication is performed by using the computer credentials when no users are logged on to the computer. When a user logs on to the computer, authentication is always performed by using the user credentials.

    This is the recommended setting.

  • Computer only. Authentication is always performed by using only the computer credentials.

  • User authentication. Specifies that when users are not logged on to the computer, authentication is performed by using the computer credentials. After a user logs on to the computer, authentication is still based on the computer credentials. Authentication is performed by using the user credentials if the moves the computer to a location on your network that is connected to a different 802.1X-capable switch.

  • Guest authentication. Allows connections to the network that are regulated by the restrictions and permissions set for the Guest user account.

Default = User or Computer authentication

Cache user information for subsequent connections to this network

Specifies that when the user logs off, the user credential data is saved in the registry. The next time the user logs on, the user is not prompted for their credentials (such as user name and password).

Default = enabled

Advanced

Provides access to advanced security settings.


Network Authentication Methods Properties

This topic presents information about Extensible Authentication Protocol (EAP) settings. You can access the EAP properties for 802.1X authenticated wired and wireless access in the following ways:

  • By configuring the Wired Network (IEEE 802.3) Policies and Wireless Network (IEEE 802.11) Policies extensions in Group Policy Management.

  • By manually configuring wired or wireless connections on client computers.

You can access the EAP properties for virtual private network (VPN) connections in the following ways:

  • By using Connection Manager Administration Kit (CMAK) to configure VPN connections.

  • By manually configuring a VPN connection on client computers.

By default, you can configure EAP settings for two network authentication methods: Microsoft: Smart Card or other certificate (EAP-TLS) or Microsoft: Protected EAP (PEAP).

Authentication methods

This topic contains configuration information specific to the following authentication methods:

  • EAP-Transport Layer Security (TLS): Smart Card or Other Certificate Properties - Configuration Items for EAP-TLS

  • Protected EAP (PEAP): Protected EAP (PEAP) Properties- Configuration Items

    Additionally, this section contains setting information for two EAP types within PEAP:

    • EAP-TLS: Smart Card or Other Certificate Properties - Configuration Items for EAP-TLS

    • EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2): Secure password (EAP-MSCHAP v2) Properties - Configuration Items

Smart Card or other Certificate Properties - configuration items for EAP-TLS

Item Details

Use my smart card

Specifies that clients making authentication requests must present a smart card certificate for network authentication.

Defaults:

  • Wired and wireless = not enabled

  • VPN = enabled

Use a certificate on this computer

Specifies that authenticating clients must use a certificate located in the either the Current User or Local Computer certificate stores.

Defaults:

  • Wired and wireless = enabled

  • VPN = not enabled

Use simple certificate selection (Recommended)

To limit the list of available certificates when prompting the user to select a certificate, this setting specifies whether Windows filters out certificates that are unlikely to meet authentication requirements.

Defaults:

  • Wired and wireless = enabled

  • VPN = not enabled

Validate server certificate

Verifies that the server certificates presented to the client computers have the correct signature, have not expired, and were issued by a trusted root certification authority (CA).

Important

Do not disable this check box or else client computers cannot verify the identity of your servers during the authentication process. If server authentication does not occur, users are exposed to severe security risks, including the possibility that users might unknowingly connect to a rogue network.

Default = enabled

Connect to these servers

Allows you to specify the name for Remote Authentication Dial-In User Service (RADIUS) servers that provide network authentication and authorization.

Note

You must type the name exactly as it appears in the Subject field of each RADIUS server certificate, or use regular expressions to specify the server name. The complete syntax of regular expression can be used to specify the server name, but to differentiate a regular expression with the literal string you must use at least one '*' in the string specified. For example, you can specify nps*.example.com to specify the RADIUS server nps1.example.com or nps2.example.com.

Defaults:

  • Wired and wireless = not enabled

  • VPN = enabled

Note

Even if no RADIUS servers are specified, the client will still verify that the RADIUS server certificate was issued by a trusted root CA.

Trusted Root Certification Authorities

The list in Trusted Root Certification Authorities is built from the trusted root CAs installed in the computer and user certificate stores. You can specify which trusted root CA certificates that supplicants use to determine whether they trust your servers, such as your server running Network Policy Server (NPS) or your provisioning server. If no trusted root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by an installed trusted root CA. If one or multiple trusted root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by a selected trusted root CA.

If you have a public key infrastructure (PKI) on your network, and you use a RADIUS server certificate, that certificate is automatically added to the list of trusted root CAs. The root CA is installed on a client computer when the computer is joined to a domain against which the RADIUS certificate is verified.

You can also purchase a server certificate from a third-party vendor. Some third-party trusted root CAs provide software with your purchased certificate that automatically installs the purchased certificate into the Trusted Root Certification Authorities store; in this case the trusted root CA automatically appears in the list of trusted root CAs.

Notes
  • The trusted root CA certificates that you designate must already be installed on client computers. Do not specify a trusted root CA certificate that client computers do not already have in the Trusted Root Certification Authoritiesstores for Current User and Local Computer.
  • If you designate a certificate that is not installed on client computers, authentication will fail.

Default = not enabled, no trusted root CAs selected.

Note

Even if no trusted root CAs are selected, the client will still verify that the RADIUS server certificate was issued by a trusted root CA.

View Certificate

Enables you to view the properties of the certificate selected in the Trusted Root Certification Authorities list.

Use a different user name for the connection

Specifies whether to use a user name for authentication that is different from the user name in the certificate. If enabled, the user is prompted to select a user certificate, even if only one user certificate is installed. The certificate is used until the user terminates the session.

Default = not enabled

Do not prompt user to authorize new servers or trusted certification authorities

Prevents the user from being prompted to trust a server certificate if that certificate is incorrectly configured, is not already trusted, or both. It is recommended that you select this check box in order to simplify the user experience and to prevent users from inadvertently choosing to trust a server deployed by an attacker.

Default = not enabled

Protected EAP Properties - configuration items

Important

When you deploy both PEAP and EAP unprotected by PEAP, do not use the same EAP authentication type with and without PEAP. For example, if you deploy PEAP with EAP-TLS (PEAP-EAP-TLS), do not also deploy EAP-TLS without PEAP. Deploying authentication methods with the same type — one with and the other without the protection of PEAP — creates a security vulnerability.

Item Details

Validate server certificate

Verifies that the server certificates presented to the client computers have the correct signature, have not expired, and were issued by a trusted root CA.

Important

Do not disable this check box or else client computers cannot verify the identity of your servers during the authentication process. If server authentication does not occur, users are exposed to severe security risks, including the possibility that users might unknowingly connect to a rogue network.

Default = enabled

Connect to these servers

Allows you to specify the name for RADIUS servers that provide network authentication and authorization.

Note

You must type the name exactly as it appears in the Subject field of each RADIUS server certificate, or use regular expressions to specify the server name. The complete syntax of regular expression can be used to specify the server name but to differentiate a regular expression with the literal string you must use at least one '*' in the string specified. For example, you can specify nps*.example.com to specify the RADIUS server nps1.example.com or nps2.example.com.

Defaults:

  • Wired and wireless = not enabled

  • VPN = enabled

Note

Even if no RADIUS servers are specified, the client will still verify that the RADIUS server certificate was issued by a trusted root CA.

Trusted Root Certification Authorities

The list in Trusted Root Certification Authorities is built from the trusted root CAs installed in the computer and user certificate stores. You can specify which trusted root CA certificates that supplicants use to determine whether they trust your servers, such as your NPS server or your provisioning server. If no trusted root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by an installed trusted root CA. If one or multiple trusted root CAs are selected, then the 802.1X client verifies that the computer certificate of the RADIUS server was issued by a selected trusted root CA.

If you have a public key infrastructure (PKI) on your network, and you use a RADIUS server certificate, that certificate is automatically added to the list of trusted root CAs. The root CA is installed on a client computer when the computer is joined to a domain against which the RADIUS certificate is verified.

You can also purchase a server certificate from a third-party vendor. Some third-party trusted root CAs provide software with your purchased certificate that automatically installs the purchased certificate into the Trusted Root Certification Authorities store; in this case the trusted root CA automatically appears in the list of trusted root CAs.

Notes
  • The trusted root CA certificates that you designate must already be installed on client computers. Do not specify a trusted root CA certificate that client computers do not already have in the Trusted Root Certification Authorities stores for Current User and Local Computer.
  • If you designate a certificate that is not installed on client computers, authentication will fail.

Default = not enabled, no trusted root CAs selected.

Note

Even if no trusted root CAs are selected, the client will still verify that the RADIUS server certificate was issued by a trusted root CA.

Do not prompt user to authorize new servers or trusted certification authorities.

Prevents the user from being prompted to trust a server certificate if that certificate is incorrectly configured, is not already trusted, or both. It is recommended that you select this check box in order to simplify the user experience and to prevent users from inadvertently choosing to trust a server deployed by an attacker.

Default = not enabled

Select Authentication Method

Allows you to select the EAP type to use with PEAP for network authentication.

Note

By default two EAP types are available, Secured password (EAP-MSCHAPv2) and Smart card or other certificate (EAP-TLS). However, EAP is a flexible protocol that allows inclusion of additional EAP methods, and is not restricted to these two types.

For information about Secured password (EAP-MSCHAPv2) or Smart card or other certificate (EAP-TLS) configuration settings, see:

  • Secure password (EAP-MSCHAP v2) Properties - configuration items

  • Smart Card or other Certificate Properties - configuration items for EAP-TLS

Default = Secured password (EAP-MSCHAP v2)

Configure

Provides access to property settings for the specified EAP type.

Enable Fast Reconnect

Allows users to roam with their wireless computers between access points without being reauthenticated each time they encounter a new access point.

Fast reconnect works only when access points are configured as Remote Authentication Dial-In User Service (RADIUS) clients to the same computer running Network Policy Server (NPS); if a client computer associates with an access point that is configured as a RADIUS client to a different NPS server, the authentication process occurs in full, including client authentication of the NPS server.

Default = enabled

Enforce Network Access Protection

Specifies that before connections to a network are permitted, system health checks are performed on EAP supplicants to determine if they meet system health requirements.

Default = not enabled

Disconnect if server does not present cryptobinding TLV

Specifies that connecting clients must end the network authentication process if the RADIUS server does not present cryptobinding Type-Length-Value (TLV).

Note

Cryptobinding TLV increases the security of the TLS tunnel in PEAP by combining the inner method and the outer method authentications together so that attackers cannot perform man-in-the-middle attacks by redirecting an MS-CHAP v2 authentication by using the PEAP channel.

Default = not enabled

Enable Identity Privacy

Specifies that clients are configured so that they cannot send their identity before the client has authenticated the RADIUS server, and, optionally, provides a place to type an anonymous identity value. For example, if you select Enable Identity Privacy and type “guest” as the anonymous identity value, the identity response for a user with identity alice@example is guest@example. If you select Enable Identity Privacy but do not provide an anonymous identity value, the identity response for the user alice@example is @example.

This setting applies only to computers running Windows 7 and later versions of Windows.

Default = not enabled

Secure password (EAP-MSCHAP v2) Properties - configuration items

Secure password EAP-MS-CHAP v2 is an EAP type that is used with PEAP-MS-CHAP v2, for password-based network authentication.

Item Details

Automatically use my Windows logon name and password (and domain if any)

Specifies that the current user-based Windows logon name and password are used as network authentication credentials.

Defaults:

  • Wired and wireless = enabled

  • VPN = not enabled

See Also

  • New Wired Network Policy Properties - Security
  • New Profile Properties - Security
  • New Preferred Setting Properties - IEEE 802.1X


New Preferred Setting Properties - IEEE 802.1X

IEEE 802.1X settings specify the behavior of wireless clients when connecting to an infrastructure wireless network that is configured for 802.1X authentication. Settings include authentication methods, such as Extensible Authentication Protocol (EAP), authentication mode, and 802.1X-specific parameters.

802.1X - configuration items

Item Details

Enable network access control using IEEE 802.1X

Specifies whether you want to use Institute of Electrical and Electronics Engineers (IEEE) 802.1X to perform authentication for your wireless network. If you clear this check box, all of the other settings on this tab become unavailable.

EAP Type

Specifies the network authentication method that connecting wireless clients use:

  • Microsoft: Smart Card or other certificate (EAP-TLS)

  • Microsoft: Protected EAP (PEAP)

Default = Microsoft: Protected EAP (PEAP)

Settings

Opens the properties page of the selected network authentication method.

For setting information for network authentication methods, see:

Network Authentication Methods Properties

Eapol-Start message

EAPOL is the Extensible Authentication Protocol (EAP) over local area network (LAN) protocol.

This setting specifies the transmission behavior of EAPOL-Start messages when authenticating. You can select from the following:

  • Do not transmit. Specifies that EAPOL-Start messages are not sent.

  • Transmit. Specifies that the client determines when to send EAPOL-Start messages and, if needed, sends an EAPOL-Start message.

  • Transmit per IEEE 802.1X. Specifies that, upon detection of a connection to an 802.1X-capable wireless access point, an EAPOL-Start message is automatically sent to initiate the 802.1X authentication process.

Authentication Mode

Specifies how network authentication is performed:

  • User authentication. Specifies that when users are not logged on to the computer, authentication is performed by using the computer credentials. After a user logs on to the computer, authentication is still based on the computer credentials. Authentication is performed by using the user credentials if the user travels to a new wireless access point.

  • User or Computer authentication. An 802.1X-compliant device always uses security credentials based on the current state of the computer. Authentication is performed by using the computer credentials when no users are logged on to the computer. When a user logs on to the computer, authentication is always performed by using the user credentials.

    This is the recommended setting.

  • Computer only. Authentication is always performed by using only the computer credentials.

Default = User or Computer authentication

Authenticate as computer when computer information is available

Specifies whether the computer will attempt to authenticate using computer credentials when the user is not logged on.

Computer credentials are typically a computer certificate.

Default = enabled

Authenticate as guest when user or computer information is unavailable

Specifies that client connection requests that cannot meet computer or user authentication requirements can connect to the network by using permissions configured for the Guest account.

Default = not enabled

Max Eapol-Start Msgs

If no response is received to the initial EAPOL-Start message, this setting specifies the maximum number of subsequent EAPOL-Start messages sent.

Default = 3

Held Period (seconds)

After a client has received notification of authentication failure, this setting specifies the number of seconds an authenticating client waits before it performs another 802.1X authentication request.

Default = 1

Start Period (seconds)

If no response is received to the initial EAPOL-Start message, this setting specifies the number of seconds an authenticating client waits before it performs another 802.1X authentication request.

Default = 5

Auth Period (seconds)

After end-to-end 802.1X authentication is initiated, this setting specifies the number of seconds authenticating clients must wait before retransmitting any 802.1X requests.

Default = 18


New Wireless Network Policy Properties - General

Use the General tab of Wireless Network (IEEE 802.11) Policy to create and manage wireless network profiles and to define a list of preferred wireless networks, which prioritizes the order in which your domain-member clients attempt to connect. You can also specify whether the WLAN AutoConfig service is used to configure 802.11 wireless adapters to connect to wireless networks.

General - configuration items

Item Details

Policy Name

Provides a location for you to type a friendly name for the wireless network policy that is applied to your clients running Windows® 7 and Windows Vista®.

Note

When you name the wireless network policy, the name you specify is displayed as the title of its properties page, and under Name in the details pane in the Group Policy Management Console (GPMC) for that policy.

Description

Provides a location for you to type a description for your wireless network policy.

Note

The description you type is displayed under Description in the details pane of the Group Policy Management Console (GPMC) for that policy.

Use Windows WLAN AutoConfig service for clients

Specifies that the WLAN AutoConfig service is used to configure and connect clients running Windows 7and Windows Vista to the wireless network.

Default = enabled

Connect to available networks in the order of profiles listed below

Displays the preferred order of wireless networks for clients to attempt connections, which you can change by using the Move Up and Move down buttons.

Note

Profiles for ad-hoc networks cannot be prioritized higher than infrastructure profiles.

Add

Allows you to add a wireless network profile and specify the profile properties.

When you click Add, you have two options:

  • Ad Hoc. Specifies a computer-to-computer network. Access points are not used.

  • Infrastructure. Specifies a network that uses one or more wireless access points.

Edit

Opens the properties of the selected wireless network profile.

Remove

Deletes the selected wireless network profile from the list.

Import

Enables you to incorporate an existing wireless network profile, from a location you specify, into the list of available networks.

Export

Enables you to save a configured profile as an Extensible Markup Language (XML) file.

Import and export wireless network profiles

You can use Import a profile to add a wireless network profile, from a location you specify, into the list of available wireless networks.

Import a profile

Item | Details
Look in | Specifies the location of a profile.
Name | Lists saved wireless profiles that you can select for import.
File name | Provides a location for you to type a profile name.
Files of type | Specifies the profile file type.

Save exported profile as

You can use Save exported profile as to export any profile listed under Connect to available networks in the order of profiles listed below on the General tab, and save it to a location you specify.

Item | Details
Save in | Specifies the location of a saved profile.
Name | Lists saved profiles.
File name | Provides a location for you to type a new name or modify the existing profile name.
Files of type | Specifies the file type for file you are exporting. By default, .xml is selected.


Advanced Security Settings

You can use advanced security settings that are provided in Wired Network (IEEE 802.3) Policies and in Wireless Network (IEEE 802.11) Policies to modify the behavior of your network clients that initiate requests for 802.1X authenticated network access.

In the Wireless Network (IEEE 802.11) Policies, the advanced security settings are only exposed by enabling WPA2-Enterprise, WPA-Enterprise, or Open with 802.1X as the network authentication setting on the Security tab.

Advanced security settings are separated into three groups of configuration items: IEEE 802.1X, Single Sign On, and Fast Roaming. Fast Roaming settings are present in Wireless Network (IEEE) 802.11 Policies for wireless computers running Windows® 7 and Windows Vista®. Fast Roaming settings are not present in Wired Network (IEEE 802.3) Policies.

IEEE 802.1X - configuration items

IEEE 802.1X settings specify the behavior of wired and wireless client requests for 802.1X authenticated access.

Item Details

Enforce advanced 802.1X settings

Specifies that the settings listed are enforced as configured:

  • Max Eapol-Start Msgs

  • Held Period (seconds)

  • Start Period (seconds)

  • Auth Period (seconds)

  • Eapol-Start Message (Wired Network (IEEE 802.3) Policies only)

Max Eapol-Start Msgs

EAPOL is the Extensible Authentication Protocol (EAP) over local area network (LAN) protocol.

If no response is received to the initial EAPOL-Start message, this setting specifies the maximum number of subsequent EAPOL-Start messages sent.

Default = 3

Held Period (seconds)

After a client has received notification of authentication failure, this setting specifies the number of seconds the authenticating client must wait before it performs another 802.1X authentication request.

Default = 1

Start Period (seconds)

If no response is received to the initial EAPOL-Start message, this setting specifies the number of seconds between the retransmission of subsequent EAPOL-Start messages.

Default = 5

Auth Period (seconds)

After end-to-end 802.1X authentication is initiated, this setting specifies the number of seconds between the retransmission of subsequent EAPOL-Start messages.

Default = 18

Eapol-Start Message

Specifies the transmission behavior of EAPOL-Start messages, and provides the following options:

  • Do not transmit. Specifies that EAPOL-Start messages are not sent.

  • Transmit. Specifies that the client determines when to send EAPOL-Start messages and, if needed, sends an EAPOL-Start message.

  • Transmit per IEEE 802.1X. Specifies that, upon detection of a connection to 802.1X-capable hardware, such as an 802.1X-capable Ethernet switch, an EAPOL-Start message is automatically sent to initiate the 802.1X authentication process.

Default = Transmit per IEEE 802.1X.

Single Sign On - configuration items

In Windows 7 and Windows Vista, Single Sign On performs 802.1X authentication based on the network security configuration during the user logon process. This feature enables scenarios — such Group Policy updates, the running of login scripts, and the joining of wireless clients to domains — that require network connectivity prior to user logon.

You can use Group Policy settings to configure Single Sign On for a wireless network profile. When Single Sign On is configured, 802.1X authentication is conducted prior to computer logon to the domain; users are only prompted for credential information if needed.

Item Details

Enable Single Sign On for this network

Specifies that Single Sign On is activated for the network profile for this network.

Default = not enabled

Perform immediately before User Logon

Specifies that Single Sign On performs 802.1X authentication before user logon completes.

Default = not enabled

Perform immediately after User Logon

Specifies that Single Sign On performs 802.1X authentication immediately upon successful user logon.

Default = not enabled

Max delay for connectivity (seconds)

Specifies the maximum time, in seconds, in which 802.1X authentication must complete and authorize network access. This setting allows the network administrator to define the maximum length of time a user waits at the logon screen.

Default = 10, if Enable Single Sign On for this network is enabled.

Allow additional dialogs to be displayed during Single Sign On

Specifies whether to display a dialog box for prior to user logon.

Default = enabled, if Enable Single Sign On for this network is enabled.

This network uses different VLAN for authentication with machine and user credentials

Specifies that wireless computers are placed on one virtual local area network (VLAN) at startup, and then — based on user permissions — transitions to a different VLAN network after the user logs on to the computer.

This setting is used in scenarios where you want to separate traffic by using VLANs. For example, one VLAN, "VLAN-a," allows access only to authenticated computers, which contains a restricted set of network resources. A second VLAN, "VLAN-b," provides authenticated and authorized users with access to a broader set of network resources, such as e-mail, build servers, or the intranet.

Default = not enabled

Fast Roaming settings

Fast Roaming is a feature of Wi-Fi Protected Access 2 (WPA2) that uses pre-authentication and Pairwise Master Key (PMK) caching to enable wireless clients to roam more quickly among wireless access points (APs).

Fast Roaming settings are only exposed by enabling WPA2-Enterprise on the Security tab in Windows Vista Wireless Network (IEEE 802.11) Policy.

Item Details

Enable Pairwise Master Key (PMK) Caching

Specifies that PMK caching is used for WPA2 Fast Roaming.

Default = Enabled

PMK time to Live (Minutes)

Specifies the duration, in minutes, that the PMK is held in cache.

Default = 720

Number of Entries in PMK Cache

Specifies the maximum number of PMK entries that are stored in cache.

Default = 128

This network uses pre-authentication

Specifies that pre-authentication is used for WPA2 Fast Roaming.

Pre-authentication enables WPA2 wireless clients that are connected to an 802.1X-capable wireless AP to perform 802.1X authentication with other wireless APs within its range. Pre-authentication stores the PMK and its associated information in the PMK cache. When the wireless client connects to a wireless AP with which it has pre-authenticated, it uses the cached PMK information to reduce the time required to authenticate and connect.

Note

WPA2 client pre-authentication is only possible with wireless access points that broadcast pre-authentication capability in Beacon and Probe Response messages.

Default = not enabled

Maximum Pre-authentication attempts

Specifies the maximum allowed pre-authentication attempts that your wireless clients can initiate with other wireless APs on the network that are within its range.

Default = 3, if This network uses pre-authentication is enabled

Perform cryptography in FIPS 140-2 certified mode

Specifies that wireless transmissions adhere to the Federal Information Processing Standard (FIPS) 140-2 mode for cryptography. FIPS 140-2 is a U.S. government computer security standard that is used to certify cryptographic modules.

Default = 3, if This network uses pre-authentication is enabled


New Permission Entry

Use the New Permission Entry dialog box in Wireless Network (IEEE 802.11) Policy to add new wireless networks to the permission list on the Networks Permissions tab. You can use the New Permission dialog box to specify, by service set identifier (SSID), which wireless networks your wireless domain members are allowed to connect to, and which are denied.

New Permission Entry configuration items

Items | Details
Network Name (SSID) | Provides a location for you to type the name for the wireless network for which you want to set permissions.
Network Type | Specifies whether the network is infrastructure (uses a wireless access point) or ad-hoc (computer-to-computer).
Permission | Specifies whether to allow or deny connections to the selected network.


New Profile Properties - Connection

The Connection tab for Wireless Network (IEEE 802.11) Policy allows you to create wireless network profiles and specify the name of each wireless network to which domain-member wireless clients can connect. Each network is saved as a profile. A profile is the collection of configuration settings for a wireless networks, saved as an Extensible Markup Language (XML) file.

Connection - configuration items

Item Details

Profile Name

Specifies the friendly name for the wireless network profile.

Network Name(s) (SSID)

Specifies one or more service set identifiers (SSIDs). The value that you type must match the SSID configured on the wireless access points for your network.

Connect automatically when this network is in range

Specifies that Windows will automatically attempt to connect to the wireless network when the computer is within broadcast range of any wireless access points that are broadcasting the SSID.

Note

Windows attempts connections to wireless networks in the order they are listed as preferred networks.

Connect to a more preferred network if available

Specifies that clients will attempt to connect to wireless networks in the order specified under Connect to available networks in the order of profiles listed below on the General tab.

Connect even if the network is not broadcasting

Specifies that wireless clients will actively probe for wireless access points with the specified SSID, in case wireless access points are configured to suppress beacon broadcasts.


New Wired Network Policy Properties - General

Use the General tab of Wired Network (IEEE 802.3) Policies to specify whether the Wired AutoConfig service is used to configure local area network (LAN) adapters to connect to the wired network. You can also specify the policy name and description.

General - configuration items

Item Details

Policy Name

Provides a location for you to type a friendly name for the network policy that is applied to your wired clients running Windows® 7 and Windows Vista®.

Note

When you name the wired network policy, the name you specify is displayed as the title of its property pages, and under Name in the details pane in the Group Policy Management Console (GPMC) for that policy.

Description

Provides a location for you to type a description for your wired network policy.

Note

The description you type is displayed under Description in the details pane of the Group Policy Management Console (GPMC) for that policy.

Use Windows Wired AutoConfig service for clients

Specifies that the Wired AutoConfig service is used to configure and connect clients running Windows 7 and Windows Vista to the 802.3 wired Ethernet network.

Default = enabled

Windows 7 Policy Settings

Windows 7 Policy Settings apply only to client computers running Windows 7 and Windows Server 2008 R2, and to which the Wired Network (IEEE 802.3) Policies apply. Earlier versions of Windows ignore these settings.

Item Details

Don't allow shared user credentials for network authentication

Specifies that users with computers running Windows 7 are not allowed to store their user credentials (such as user name and password), which the computer can then use to log on to the network (even though the user is not actively logged on to the computer).

Default = not selected. Users are allowed to enter and store their user credentials in profiles that they configure.

The following statements summarize the behavior of this setting:

  • This setting is provided in both the Wired Network (IEEE 802.3) Policies and the version of the Wireless Network (IEEE 802.11) Policies that you can configure for client computers running Windows Vista® and subsequent releases of Windows.

  • This setting is per-Group Policy object (GPO), and within each GPO it is specific to the Wired Network (IEEE 802.3) Policies and Wireless Network (IEEE 802.11) Policies.

  • For as long as the default setting remains unchanged, the local administrator can use the netsh lan set allowexplicitcreds command on client computers running Windows 7 to allow or disallow users to store their user credentials.

  • After the first time that the default is changed the administrator can use this setting to enable or disable the capability for users to configure non-Group Policy based user profiles to store their user credentials. User credentials cannot be stored with Group Policy profiles.

Enable Block Period

Specifies whether to prohibit computers running Windows 7 from making auto connection attempts to the network for a specified amount of time.

Default = not enabled

Block Period (minutes)

Specifies the number of minutes for which you want the block period to apply. The valid range of minutes is 1-60.

Default = 20, if Enable Block Period is enabled.


New XP Wireless Network Policy Properties - Preferred Networks

You can use the settings on the Preferred Networks tab to add wireless networks, by name, to a prioritized list. That list specifies the order in which your domain-member wireless clients will attempt to connect to wireless networks.

If a client cannot connect to a preferred wireless network, and the wireless network is configured to prevent automatic connection to wireless networks that are not in the preferred list (which is the default configuration), then the Wireless Zero Configuration service places the wireless network adapter in infrastructure mode by using a random wireless network name. At this point, the wireless adapter is not connected to any wireless networks and continues to scan for preferred wireless networks.

Preferred Networks - configuration items

Item Details

Networks

Displays the prioritized list of preferred wireless networks, and general profile information, such as the service set identifier (SSID), IEEE 802.1X status Enabled or Disabled, and the wireless encryption standard that is associated with each Network Name, for example, AES, TKIP, or WEP.

Add

Allows you to add a wireless network profile, and specify the profile properties.

When you click Add, you have two options:

  • Ad-hoc. Specifies a computer-to-computer network. Access points are not used.

  • Infrastructure. Specifies a network that uses one or more wireless access points.

Edit

Allows you to change the configuration settings for the selected preferred wireless network profile.

Remove

Deletes the selected network from the list of preferred networks.

Up arrow

Moves a selected network to a higher connection priority in the list of preferred networks.

Note

Profiles for ad hoc networks cannot be prioritized higher than infrastructure profiles.

Down arrow

Moves a selected network to a lower connection priority in the list of preferred networks.


New Preferred Setting Properties - Network Properties

You can use Wireless Network (IEEE 802.11) Policy for clients running Windows XP to specify the name of the wireless network, network security authentication, such as Wi-Fi Protected Access 2 (WPA2), and Fast Roaming features.

Network Properties - Configuration Items

Item Details

Network Name (SSID)

Provides a location for you to type the wireless local area network (LAN) network name, also known as the service set identifier (SSID).

Description

Provides a location for you to type a description of the wireless LAN network.

Connect even if network is not broadcasting

Specifies that wireless clients will actively probe for wireless access points with the specified SSID, if wireless access points are configured to suppress beacon broadcasts.

Authentication

Specifies the security authentication method that is used between the wireless access point and the wireless client:

  • Open

  • Shared

  • WPA-Enterprise

  • WPA-Personal

  • WPA2-Enterprise

  • WPA2-Personal

  • Open with 802.1X

Note

Network authentication methods and advanced settings are only exposed if you select WPA-Enterprise, WPA2-Enterprise, or Open with 802.1X for the network security authentication method.

Default = the most secure setting supported by the wireless hardware and drivers.

Encryption

Specifies the security encryption to use for the selected network security authentication method.

If Authentication is set to WPA-Enterprise, WPA-Personal, WPA2-Enterprise, or WPA2-Personal, the encryption options are AES (Advanced Encryption Standard) or TKIP (Temporal Key Integrity Protocol).

If Authentication is set to Open, Shared, or Open with 802.1X, then encryption options are WEP (Wired Equivalent Privacy) or Disabled.

Enable Pairwise Master Key (PMK) Caching

Specifies that PMK caching is used for WPA2 Fast Roaming.

Notes
  • Fast Roaming is a feature of WPA2 that uses pre-authentication and PMK Caching to enable wireless clients to roam more quickly among wireless access points (APs). Fast Roaming settings are only exposed if WPA2 is selected as the network security method.
  • Default = enabled

PMK Time to Live (minutes)

Specifies the duration, in minutes, that the PMK is held in cache.

Default = 720

Number of Entries in PMK Cache

Specifies the maximum number of PMK entries that are stored in cache.

Default = 128

This network uses pre-authentication

Specifies that pre-authentication is used for WPA2 Fast Roaming.

Pre-authentication enables WPA2 wireless clients that are connected to a wireless AP to perform 802.1X authentication with other wireless APs within its range. Pre-authentication stores the PMK and its associated information in the PMK cache. When the wireless client connects to a wireless AP with which it has pre-authenticated, it uses the cached PMK information to reduce the time required to authenticate and connect.

Note

WPA2 client pre-authentication is only possible with wireless access points that broadcast pre-authentication capability in Beacon and Probe Response messages.

Default = not enabled

Maximum Pre-authentication attempts

Specifies the maximum allowed pre-authentication attempts that your wireless clients can initiate with other wireless APs on the network that are within its range.

This setting is available only when This network uses pre-authentication is selected.

Default = 3


New Wireless Network Policy Properties - Network Permissions

Use the Network Permissions tab of Wireless Network (IEEE 802.11) Policy to list and configure wireless networks that are not defined on the General tab in the Connect to available networks in the order of profiles listed below list. You can use these settings to define additional wireless networks and specify whether you want to allow or deny connections by your domain-member wireless clients. Alternatively, you can block specific wireless networks from being displayed to your domain-member wireless clients. These settings are specific to the wireless networks listed on the Network Permissions tab under Network Name (SSID).

Connections to the wireless networks that are listed under Network Name (SSID) on the Network Permissions tab are only possible if the permission is set to Allow. If the permission is set to Allow, your domain-member wireless clients first attempt to connect to a preferred network, before attempting to connect to non-preferred networks. However, domain members can attempt a connection to any listed networks that have permissions set to Allow.

Network Permissions - configuration items

Item Details

Network Name (SSID)

Lists wireless networks for which you want to allow or deny permissions, but that are not defined on the General tab in Connect to available networks in the order of profiles listed below.

Add

Opens the New Permission Entry dialog box, for adding a new wireless network to the permission list.

When you click Add, you have two options:

  • Ad hoc. Specifies a computer-to-computer network. Access points are not used.

  • Infrastructure. Specifies a network that uses one or more wireless access points.

Remove

Deletes the selected wireless network from the permission list.

Prevent connections to ad-hoc networks

Specifies that domain-member wireless clients cannot form a new ad-hoc network or connect to any ad-hoc networks in the permission list.

Default = not enabled

Prevent connections to infrastructure networks

Specifies that domain-member wireless clients cannot connect to any infrastructure networks in the permission list.

Default = not enabled

Allow user to view denied networks

Specifies whether domain-member wireless clients can view wireless networks in the permission list that have permissions set to Deny.

Default = enabled

Allow everyone to create all user profiles

Specifies that any user on the local computer to which this wireless network policy applies can create all user wireless profiles only for users on the local computer. When this setting is not selected, only users in the Network Administrators group or Network Operators group can create all user wireless profiles.

All user profiles are wireless profiles that can connect to a specific wireless network and that can be started by any user with an account on the local computer. Every user with an account on the computer is contained within the computer-wide access control list (ACL) named Everyone.

Default = enabled

Only use Group Policy profiles for allowed networks

Specifies that wireless clients can only use wireless profiles that configured in Group Policy Management to connect to allowed networks.

Default = not enabled

Windows 7 Policy Settings

Windows 7 Policy Settings apply only to client computers running Windows 7 and Windows Server 2008 R2, and to which the Wireless Network (IEEE 802.11) Policies apply. Earlier versions of Windows ignore these settings.

Item Details

Don't allow hosted network

Specifies that users are prohibited from hosting a wireless network on computers running Windows 7.

Default = not selected. Users are allowed to enable a hosted network.

For as long as the default setting remains unchanged, the local administrator can use the netsh wlan set hostednetwork command on client computers running Windows 7 to allow or disallow hosting a wireless network on the computer.

Don't allow shared user credentials for network authentication

Specifies that users with computers running Windows 7 are not allowed to store their user credentials (such as user name and password), which the computer can then use to log on to the network (even though the user is not actively logged on to the computer).

Default = not selected. Users are allowed to enter and store their user credentials in profiles that they configure.

The following statements summarize the behavior of this setting:

  • This setting is provided in both the Wired Network (IEEE 802.3) Policies and the version of the Wireless Network (IEEE 802.11) Policies that you can configure for client computers running Windows Vista® and subsequent releases of Windows.

  • This setting is per-Group Policy object (GPO), and within each GPO it is specific to the Wired Network (IEEE 802.3) Policies and Wireless Network (IEEE 802.11) Policies.

  • For as long as the default setting remains unchanged, the local administrator can use the netsh wlan set allowexplicitcreds command on client computers running Windows 7 to allow or disallow users to store their user credentials.

  • After the first time that the default is changed the administrator can use this setting to enable or disable the capability for users to configure non-Group Policy based user profiles to store their user credentials. User credentials cannot be stored with Group Policy profiles.

Enable Block Period

Specifies whether to prohibit computers running Windows 7 from making auto connection attempts to the network for a specified amount of time.

Default = not enabled

Block Period (minutes)

Specifies the number of minutes for which you want the block period to apply. The valid range of minutes is 1-60.

Default = 20, if Enable Block Period is enabled.