Cross Domain Certificate Authentication

question:  possible perform machine based certificate authentication via nps across domains in same forest?

environment:

• two tier domain (parent / child)
• server 2008 enterprise ca in parent domain
• server 2008 r2 nps server in child domain configured 802.1x wireless authentication
• authentication via computer certificate perferred, peap allowed non-domain members
• comptuers in both parent , child have ca trusted root
• comptuers in both parent , child autoenroll workstation authentication certificate
• client workstations run windows xp sp3 pro and windows 7 pro

current situation:

• child domain member computers authenticate via computer certificate
• non-child domain computers can authenticate via user credentials domain in forest.
• parent domain computers not authenticate via computer certificate, can authenticate parent domain user account.

desired outcome:

it desired have systems in forest able authenitcate via computer certificate.  allow system connect network prior user being authenticated.  allowing various individuals use system wirelessly that may not have logged onto. (no cached credentials)

occassionally event logs on nps server report following when attempting use parent domain computer:

log name: security

source: microsoft-windows-security-auditing

date: 4/28/2011 1:14:16 pm

event id: 6273

task category: network policy server

level: information

keywords: audit failure

user: n/a

computer: <computer name>

description:

network policy server denied access user.

contact network policy server administrator more information.

user:

security id: null sid

account name: <machine name>\administrator

account domain: <machine name>

fully qualified account name: <machine name>\administrator

client machine:

security id: null sid

account name: -

fully qualified account name: -

os-version: -

called station identifier: 00-26-0b-dc-6d-27:<wap mac>

calling station identifier: 00-24-2c-2b-94-cd

nas:

nas ipv4 address: <ip address>

nas ipv6 address: -

nas identifier: -

nas port-type: wireless - ieee 802.11

nas port: 0

radius client:

client friendly name: <wap name>

client ip address: <ip address>

authentication details:

connection request policy name: nap 802.1x (wireless)

network policy name: -

authentication provider: windows

authentication server: <nps server name>

authentication type: peap

eap type: -

account session identifier: -

logging results: accounting information written local log file.

reason code: 262

reason: supplied message incomplete. signature not verified.

machine auth must use eap/tls not peap. failure because auth type peap

brian

Windows Server  >  Security