Home / server / Questions / 823045
Accepted
Mike Pennington
Asked: 2016-12-29 08:20:41 +0800 CST

Customize Windows8 dot1x / PEAP WiFi username per SSID

  • 772

It's a seemingly simple question.

How can I customize the WPA2 Enterprise username in Windows8, per SSID?

Registry hacks are fine with me.

Hover below for background info (not really required to answer the question):

PROBLEM DETAILS:

We run WPA2 Enterprise (dot1x / PEAP) on our BYOD wlan with rotating credentials; one persistent problem I've not been able to solve is how I can get Windows 8 clients on this network.

The problem is that when people try to join with Windows8, Windows always sends the logged-in user's username by default. That's fine if you're going to use it, but our security policy forces us to use a static BYOD WPA2 Enterprise username and password on our Wireless Controller (rotated regularly).

It's not very hard to change this behavior in Windows 7, but Windows 8 introduced a new level of insanityGUI which makes it very hard to find how you customize the wlan's WPA2 Enterprise username.

ENVIRONMENT DETAILS:

1. People are encouraged to bring their own devices and use two factor IPSec VPN through the BYOD WiFi to their company desktop as they like.

2. This means that the logged in username on the BYOD device cannot be predicted... That's part of the reason for static BYOD WiFi credentials.

3. Even though Windows 8 asks for a WPA2 Enterprise username when you join, by default it overrides it and still uses the wrong username

4. The company network and BYOD network are firewalled from each other for all the obvious reasons.

5. Authentication stores are outside the scope of this question.

@EEAA correctly pointed out that parts of the security policy aren't helpful, but I still need to solve the problem. The problem exists regardless of whether we use a static username or rotating username.

networking wifi windows-8

1 Answers

  1. Best Answer

    Try this:

    1. Open the Control Panel > Network and Sharing Center
    2. Select your network ID, click on Wireless Properties > Security tab.
    3. Ensure that WPA2 Enterprise is selected as the security type.
    4. Under "Select a network authentication method", select Microsoft: Protected EAP (PEAP).
    5. Next to this drop-down menu, click Settings.
    6. Under "Select Authentication Method", select Secured Password (EAP-MSCHAP v2)
    7. Next to this drop-down menu, click Configure.
    8. Deselect the box that says, "Automatically use my Windows login name and password option (and domain, if any)".
    • 3