1. Make wttsvc service to manual.
2. Apply desired MCU policy to machine pool, this will reboot the machine
3. After reboot wait for ECP Node creation (5 minutes) and then start wttsvc.

Step 3 is applicable whenever machine gets rebooted.

Machine will get rebooted:

• whenever first job is scheduled as it runs "WDK prepare client for submission".
• whenever dimensions are applied i.e. when machine is removed and moved back to the machine pool

Ujjawal Bagga

Windows Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]

MS-PEAP standard has support for fragmentation of PEAP packets. However, MS-PEAP implementation in OS'es prior to Windows 7 supported fragmentation only during phase 1. Starting from Windows 7 MS-PEAP implementation has support for fragmentation in all phases.

MS-PEAP implementation in Windows7 with support for fragmentation ensures the following:

1.       PEAP-Client and PEAP-Server with/without support for fragmentation interoperate with each other for packet size lesser than EAP MTU.

2.       WIN7 MS-PEAP Client interoperates with PEAP-Server supporting fragmentation for packet size greater than EAP MTU.

3.       PEAP-Client with support for fragmentation interoperates with WIN7 MS-PEAP Server for packet size greater than EAP MTU.

4.       WIN7 MS-PEAP Client has diagnostic logs to identity the failure in authentication due to PEAP-Server's inability to process fragmented packets.

5.       WIN7 MS-PEAP Server has diagnostic logs to identity the failure in authentication due to PEAP-Clients inability to process fragmented packets.

Support for 4) and 5) is provided through a negotiation protocol between the PEAP-Client and PEAP-Server. The negotiation protocol is an enhancement to the MS-Extentions method defined in the PEAP specification. The negotiation protocol will hereafter be referred to as Capabilities Method.

After the completion of phase 1, the PEAP-Server will send an EAP-Identity-Request within the TLS tunnel and will receive an EAP-Identity-Response from the EAP peer.  After getting the identity response within the tunnel, the server will send Capabilities method request packet. If the client supports the Capabilities method then it will send method response with Capabilities data. If the client does not understand the Capabilities method request from the server, then it will NAK the request assuming that server is proposing this method as part of EAP negotiation. After server

receives either of the above packets it proceeds with normal execution of SOH or Inner EAP negotiation. 

For WIN7 MS-PEAP-Client or WIN7 MS-PEAP-Server that talks with 3rd party PEAP-Server or PEAP-Client which already supports fragmentation but does not understand the negotiation method, the MS-PEAP-Client or MS-PEAP-Server can be configured to bypass the negotiation protocol and to force it support fragmentation.

The registry keys BypassNegotiation       and AssumePhase2Fragmentation can be used to configure the MS-PEAP-Client and Server to bypass the negotiation protocol and force it to support fragmentation. BypassNegotiation and AssumePhase2Fragmentation registry values are present under HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\25 registry key.

Trouble Shooting :

 If Microsoft’s windows7 PEAP client is authenticating with a third party Server that supports fragmentation and the fragmentation is still not happening, then ‘AssumePhase2Fragmentation’  key is not set on the client.

 If a third party PEAP client that supports fragmentation is authenticating to Microsoft’s windows7 Server having Microsoft’s PEAP and the fragmentation is still not happening, then ‘AssumePhase2Fragmentation’ key is not set on the server.

Note:

PEAP-Client: MS client side implementation of PEAP in OS'es prior to WIN7 or 3rd party client side implementation of PEAP

PEAP-Server: MS server side implementation of PEAP in OS'es prior to WIN7 or 3rd party server side implementation of PEAP

EAP identity privacy is provided by certain EAP methods where an empty or an anonymous identity (different from the actual identity) is sent in response to the EAP identity request. PEAP method sends the identity twice during the authentication. In the 1^st phase the identity is sent in plain text and this identity will be used for routing purposes and not for client authentication. The real identity is sent within a secure tunnel (established in the 1^st phase) during the 2^nd phase of the authentication.

PEAP Configuration

Support for Identity Privacy in Protected EAP (PEAP) method is introduced in Windows 7. The PEAP identity that is sent in 1^st phase is configurable in the “Protected EAP Properties” dialog.

If the “Enable Identity Privacy” checkbox is checked then the username in the real identity is replaced with the text in the textbox. If the real identity is jdoe@foo.com, “Enable Identity Privacy” checkbox is checked and the textbox contains “anonymous” then the identity sent in 1^st phase will be anonymous@foo.com. The realm portion of the 1^st phase identity will not be modified as it is used for routing purposes.

Troubleshooting

Network policy server (NPS) is sending EAP-failure immediately after sending the identity response

If the NPS policy is created in the “Network Policies” then identity privacy doesn’t work. The NPS policy has to be created in the “Connection Request Policy”. ]]> https://docs.microsoft.com/archive/blogs/eapteam/what-is-ecp-should-i-participate-in-it-how-can-i-participate-in-ecp Thu, 18 Dec 2008 23:49:00 GMT https://blogs.msdn.microsoft.com/eapteam/2008/12/18/what-is-ecp-should-i-participate-in-it-how-can-i-participate-in-ecp/

About the ECP

The EAP Certification Program (ECP) is a new component integrated into Windows Vista SP1, Windows Server 2008 and Windows 7 logo program that enables Microsoft Logo certification and Windows Update distribution of vendor manufactured EAPHost components. The primary goal of the program is to help vendors ensure the quality, security and compatibility to Windows of their EAPHost components as well as facilitate distribution of components and their updates. This is achieved by validating components on the following aspects:

• Compatibility with Windows OS on x86 and x64 architectures.
• Security in the local machine including securing the authenticated credentials.
• Stress tested to ensure the high performance required for network authentication as well as good performance under low resource conditions.

What is EAPHost?

EAPHost is the new Extensible Authentication Protocol (EAP) extensibility framework in Windows 7, Windows Vista, Windows Server 2008 R2 and Windows XP SP3 SDK enabling development of EAP methods and supplicants that provide or consume authentication services from other installed EAPHost components.

It can also be described as a Network Authentication Infrastructure into which different authentication methods can plug into. The authentication methods which plugs into EAPHOST needs to implement a set of API’s. The EAPHOST exposes these set of API’s which can be called by the supplicants. These Supplicants are the Client Modules that accesses and connects to the network and use EAPHOST API’s to get through the network authentication.

Further information regarding EAP on Windows, EAPHost and the Windows SDK is available through the following:

·         EAP in Windows

·         EAPHost framework

·         Windows SDK

EAPHost components applicable to this program include the following:

• EAP Peer Methods – The client side EAP methods used to authenticate to a network.
• EAP Peer Tunnelling Methods - The client side EAP methods used to authenticate to a network which establish an encryption tunnel to facilitate secure information exchange for authentication.
• EAP Authenticator Methods – The server side EAP methods used to terminate a network authentication on Microsoft’s RADIUS and Network Policy Server (NPS).
• EAP Authenticator Tunnelling Methods - The server side EAP methods used to terminate a network authentication on Microsoft’s RADIUS and Network Policy Server (NPS) which establish an encryption tunnel to facilitate secure information exchange for authentication.
• Supplicants - Network supplicants with EAP authentication support using EAPHost.

Value Addition and Proposition

The ECP (EAP Certification Program) certifies EAP Methods and EAP Supplicants meet a pre-determined set of requirements that encompass various functional, interoperability, reliability, security, business and legal dimensions. The goal of these requirements is to provide 3rd parties with the ability to ship their EAP Methods and EAP Supplicants with Windows Operating Systems, while simultaneously ensuring that new EAP Methods and Supplicants meet the overall customary high-expectations that Microsoft customers have of the Windows Operating System.

Consider a typical present day scenario where Network Administrators or Users have a need to deploy the specific supplicant and method for a client machine to be able to securely access their network. For meeting with this requirement, IHV vendors, today, end up developing both EAP based authentication methods as well as supplicants. With ECP, IHV vendors can focus their development efforts on creating only the secure authentication method i.e., only their core component. ECP can potentially add value for resolving such issues.

The ECP is implemented as a series of pre-determined stages that occur in sequential order. EAP Methods and Supplicants are submitted to the EAP Certification Program and proceed through each stage. At the successful conclusion of all stages, EAP Methods and Supplicants are included in the Windows Operating System(s) through Windows Update.

Moreover, the other advantages for authentication method and supplicant developers to go ahead and certify their components are manifold, some of which include:

·         Increase market consumption of your new EAP method by showing that it is fully Windows compatible and offering it to your customers through Windows Update (WU)

·         Ensured great reliability and quality of the certified components developed.

·         Better mindshare to their core components and reassures both users and administrators to adopt their components.

·         Certified components are made available through Windows Update thereby solving the deployment blockage of such components.

·         Any future updates to the certified components can be deployed with great ease and discretion.

Furthermore, even if you decide not to go for Windows Update, your components still enjoy more adaptation because of better mindshare and reliability that certification provides.

ECP Certification

ECP submissions require passing the ECP test requirements in Windows Logo Kit (WLK) and utilize the WinQUAL mechanism like all other Windows Certification Programs. Additional information on the Hardware Logo program requirements and ECP requirements is available through:

• https://winqual.microsoft.com/default.aspx
• https://winqual.microsoft.com/help/
• Windows Logo Program requirements and policies

Further information on obtaining and using WLK:

• https://www.microsoft.com/whdc/DevTools/WDK/WDKpkg.mspx

Components passing the applicable automated test cases detailed in this document are certified by Microsoft as subject the Logo and WinQUAL legal agreements active at the time of submission and are available through the following:

·         Designed For Windows Logo License Agreement V10.0

·         WHQL Testing Agreement V2.1

ECP Certification Blog

For further information of the ECP and how can you participate in the program and get your components certified, please visit the ECP Blog at the following location:

https://blogs.msdn.com/eapteam/default.aspx.

Please feel free to contact me in case you need more information.

Ashish Jain

Program Manager

ashish.jain@microsoft.com

• From Explorer menu select Device console
• Select <New Submission> from Submission drop down
• Select the operating system and architecture you would like to qualify for during this logo run.
• Select the category of the submission, click Next
• Choose the type of the device for the submission, click Next
• Select one of the qualification level(s) from the list, click Next
• Enter the submission name and select the machine pool associated with your submission, click Next
• Select the "I am not providing an INF” check box, click Next
• Choose the ECPNode device under System devices, click Finish

• From Explorer menu select Device console
• Select the submission for which the CPK file to be created
• On Available Devices window select the machine pool created earlier
• Right click and select Create Submission Package, provide name and save.

Note: Before creating CPK file, status of tests can be checked using Status button

• EAP peer methods – client side EAP methods used to authenticate to a network.
• EAP peer tunneling methods - client side EAP methods used to authenticate to a network which establish an encryption tunnel to facilitate secure information exchange for authentication and authorization.
• EAP authenticator methods – server side EAP methods used to terminate a network authentication on Microsoft’s RADIUS and network policy server (NPS).
• EAP authenticator tunneling methods - server side EAP methods used to terminate a network authentication on Microsoft’s RADIUS and network policy server (NPS) which establish an encryption tunnel to facilitate secure information exchange for authentication and authorization.
• IP based network supplicants with EAP authentication support using EAPHost.

The logical steps are as follows:

1. Prep Phase: The partner evaluates the ECP Program, convinces himself about the value add in participating in ECP. Evaluates the ECP test cases. Does the Setup
2. Test Phase: In this phase the partner runs the test ensures all the test cases are passed. This is likely to be an iterative process, in case there are some failures. Microsoft commits in being helpful to resolve the failures .
3. Submission Phase: After running the test cases successfully Partner needs to submit the test result logs CPK file in winqual site https://winqual.microsoft.com/default.aspx. To do so the partner needs to create an account in this site. Partner may optionally choose make the certified modules available through windows update to have a good deployment story for the certified module. Making the certified module available through the windows update however will be guided entirely by the business interest of the partner.
4. Evaluation Phase: When the CPK file is evaluated by Microsoft. Microsoft may enter into a round of discussion and feedback with the partner to see if the certified module achieves the quality and functionality aspect of ECP. At the end this phase the certified module will be approved and will be made available through windows update (Optional)
5. Maintenance and Servicing: This phase will see much lesser activity. In case there are some critical issues with the certified modules which hinders the business of the joint customers , the module may need to be updated and redistributed.

These two needs – Microsoft’s needs for improved in-box EAP method/supplicant support, for “future-proofing” and ISV/IHV’s desire to ship their methods and supplicant’s in-box with Windows – point to a clear solution: A Microsoft Windows EAP Certification Program. ECP helps vendors ensure the quality, security and compatibility to Windows of their EAPHOST components as well as facilitate distribution of components and their updates. This is achieved by validating components on the following aspects:

• Compatibility with Windows OS on x86 and x64 architectures.
• Security in the local machine including securing the authenticated credentials.
• Compatibility with ECP devices for simple distribution, installation and update.
• Stress tested to ensure the high performance required for network authentication as well as good performance under low resource conditions.