NPS + WiFi Domain Authentication

NPS + WiFi Domain Authentication

1. PURPOSE

To configure secure WiFi authentication using Microsoft Network Policy Server integrated with Active Directory, enabling domain-based access control.

2. SCOPE

  • Domain-joined client machines
  • Wireless Access Points (e.g., EnGenius, Aruba)
  • NPS Server (RADIUS)
  • Certificate Services (for EAP-TLS)

3. PREREQUISITES

  • Domain Controller operational
  • NPS role installed on Windows Server
  • Clients joined to domain
  • DNS properly configured
  • Time synchronization with DC
  • (For EAP-TLS) Certificate Authority configured

4. ARCHITECTURE

5. IMPLEMENTATION STEPS

STEP 1:

Install NPS Role

On Windows Server:

Install-WindowsFeature NPAS -IncludeManagementTools

Open:

nps.msc

STEP 2:

Register NPS in Active Directory
  • Right-click NPS (Local)
  • Click: Register server in Active Directory

✔ Required to read AD user/computer accounts


STEP 3:

Configure RADIUS Client (Access Point)

Go to:

-> RADIUS Clients → New

Add:

  • Name: AP Name
  • IP Address: AP IP
  • Shared Secret: (must match AP config)

STEP 4:

Configure Connection Request Policy

-> Policies → Connection Request Policies

  • Use default OR create new
  • Ensure authentication is processed locally

STEP 5:

Create Network Policy

->Policies → Network Policies → New

Conditions

Choose based on requirement:

Option A: User-based authentication
  • Add: Domain Users
Option B: Machine-based authentication (recommended)
  • Add: Domain Computers
Constraints
Authentication Methods:

✔ For secure setup (Recommended):

  • Smart Card or other certificate (EAP-TLS)

OR

✔ For basic setup:

  • PEAP (MS-CHAP v2)
Settings
  • Grant access
  • No VLAN (or configure if needed)

STEP 6:

Configure Certificate (For EAP-TLS)

Using Active Directory Certificate Services:

  • Create Computer/User certificate template
  • Enable auto-enrollment via GPO
  • Ensure certificate appears on client:
certlm.msc

STEP 7:

Configure WiFi Access Point

On AP (e.g., EnGenius):

  • Security Mode: WPA2/WPA3 Enterprise
  • RADIUS Server IP: NPS Server
  • Port: 1812
  • Shared Secret: same as NPS

STEP 8:

Configure WiFi via GPO

Open:

gpmc.msc

Navigate:

-> Computer Configuration → Policies → Windows Settings → Wireless Network (IEEE 802.11)

Configure:
  • SSID Name
  • Security: WPA2-Enterprise
  • Authentication Method:
    • EAP-TLS (recommended)
    • or PEAP

STEP 9:

Apply Group Policy

On client:

gpupdate /force

Restart system

6. VALIDATION

✔ WiFi SSID visible
✔ Client connects automatically (machine auth)
✔ No credential prompt (EAP-TLS)
✔ Successful login