Share via

Wifi Profile Authentication Mode - GPO vs Intune

Sebastian Cerazy 306 Reputation points
2020-10-04T08:08:32.033+00:00

That is not to discuss what option is better/more secure etc

Using GPO I do set Authentication Mode to: Computer

https://dailysysadmin.com/KB/Article/714/create-a-group-policy-to-deploy-a-company-wireless-access-point/
http://www.hospitableit.com/howto/wireless-802-1x-for-machine-auth-only-using-nps/

So only machine certificate is needed to access WiFi

With Intune WiFi Policy

https://learn.microsoft.com/en-us/mem/intune/configuration/wi-fi-settings-windows

I can not replicate the same behaviour.

I am using this "workaround" - https://social.technet.microsoft.com/Forums/lync/en-US/7c6dcb5c-7e24-4a10-89d0-3f8fcec55877/ndes-scep-certificate-to-connect-to-enterprise-wifi-nps-radius?forum=microsoftintuneprod

At login screen (before user logon) machine connects to WiFi (using machine certificate)
The very moment user logs in, connection is dropped (if user has no certificate, ie local only user).
If user has certificate issued (again by NDES Connector), then connection swaps to user certificate & all fine.

Is there a way to make Intune WiFi Policy to be for Computer only ? So local user can also connect (issue kind of like this: https://social.msdn.microsoft.com/Forums/en-US/06b38091-644b-4405-ad70-fbe789e3ea04/issues-with-nps-computer-certificate-and-local-admin-account?forum=winserverNAP )

Seb

Microsoft Intune Configuration
Microsoft Intune Configuration
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Configuration: The process of arranging or setting up computer systems, hardware, or software.
1,770 questions
0 comments
Accepted answer
  1. Sebastian Cerazy 306 Reputation points
    2020-10-06T09:21:28.637+00:00

    Tested above and indeed, if I import GPO created WiFi profile and apply it to Intune only machines (that do have NDES Connector issued certificate from my internal CA), I can have MACHINE ONLY authentication for WiFi connectivity

    So local user (no certificate issued) stays connected to WiFi

    No idea why Intune own WiFi profile does not have this option available!

    Seb

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. AndyLiu-MSFT 586 Reputation points
    2020-10-05T02:36:56.947+00:00

    @Sebastian Cerazy

    To my knowledge, Intune Wi-Fi profile do support PEAP authentication, and can be configured for certificate authentication with SCEP and PKCS.

    For SCEP profile, you can configure the device certificate type, which allows to deploy the computer certificate on the client device. Please click the following link for more info about SCEP device certificate type.

    Create and assign SCEP certificate profiles in Intune

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  2. Sebastian Cerazy 306 Reputation points
    2020-10-05T17:28:28.887+00:00

    I can see that exported xml (netsh wlan export profile) from Intune only & GPO only respective machines are quite different, especially

    <authMode>machine</authMode>

    is missing from Intune config

    Also section <EAPConfig> ....
    is quite different

    I will test import of GPO version into Intune Custom Profile (as per this - https://allthingscloud.blog/deploy-wifi-profile-with-pre-shared-key-to-windows-10-using-microsoft-intune/ ) and see if it works

    Seb

    0 comments