802.1x Wireless

Question

When we use 802.1x for wired we can choose the authentication will be based on 'user' or 'computer' or 'user or computer'. But for wireless why there no option like that?

Answer 1

Hello,

The difference you’re noticing between wired 802.1X and wireless 802.1X comes down to how the supplicant and the authentication framework are implemented in Windows. On wired LAN, the 802.1X configuration allows you to explicitly choose “user,” “computer,” or “user or computer” authentication because the supplicant can bind to the physical NIC and negotiate authentication independently of the wireless profile. This is exposed in the wired 802.1X settings under the advanced tab in the NIC properties.

For wireless, the Windows native WLAN AutoConfig service does not expose the same “user or computer” toggle. Instead, wireless 802.1X authentication is tied to the wireless profile itself, and the supplicant behavior is determined by whether you configure the profile for machine authentication (using certificates in the computer store) or user authentication (using credentials or certificates in the user store). If you need both, the supported method is to enable “Single Sign-On” in the wireless profile properties. That allows the computer to perform machine authentication at boot, and then switch to user authentication once the user logs on. This effectively achieves the “user or computer” behavior, but it’s not presented as a direct option like in wired 802.1X.

In practice, if your requirement is to ensure devices are validated before logon and then users are authenticated after logon, you should configure the wireless profile with machine certificate authentication and enable Single Sign-On. That way, the system authenticates at startup using the computer account, and then reauthenticates with the user account once the user session begins. This is the Microsoft-supported approach for wireless 802.1X scenarios.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.

Answer 2

Wireless does have that capability in Windows 802.1X profiles.

For 802.1X profiles, the Authentication Mode setting supports:

• User or computer authentication
• Computer authentication
• User authentication
• Guest authentication

In Windows, machineOrUser is the default for 802.1X.

For wireless specifically, Microsoft’s wireless deployment guidance also describes the same client authentication choices in wireless network policies:

• User re-authentication: uses computer credentials before sign-in, then user credentials after sign-in
• Computer only
• User authentication

So the option is not unique to wired 802.1X. Wireless supports equivalent authentication modes as well.

If the option is not visible in a particular UI, that is a limitation of that management interface or profile type, not a limitation of 802.1X wireless itself.

---

• Extensible Authentication Protocol (EAP) for network access
• Wireless Access Deployment Planning