How to Connect to a Domain When 802.1X Authentication Is Enabled

For networks with 802.1X authentication, joining a domain is slightly more complicated. During 802.1X authentication, the client authenticates the server's identity by ensuring that the server certificate is valid and was issued by a trusted certification authority (CA). However, if you used an internal CA (such as one hosted by Windows Server 2003 certificate services) to issue the server certificate, the CA will not be trusted by default until the computer joins a domain. Therefore, to join the domain, you must temporarily configure the client computer to ignore the 802.1X authentication server's certificate.

Note If you have configured your 802.1X authentication servers with a server certificate issued by a public CA that is trusted by Windows by default, you can leave the Validate Server Certificate check box selected.

To join a domain with 802.1X authentication enabled, follow these steps:

1. Start the Services console, start the Wired AutoConfig service, and set the Wired AutoConfig service to start automatically.
2. Open Network And Sharing Center and then click Manage Adapter Settings.
3. Right-click the network adapter and then click Properties.
4. In the Properties dialog box, click the Authentication Tab. Click the Choose A Network Authentication Method list and then click Microsoft: Protected EAP (PEAP).
5. Click Settings. In the Protected EAP (PEAP) Properties dialog box, clear the Validate Server Certificate check box. Click OK twice.
6. Follow the standard instructions for joining the computer to a domain, as described in the previous section.
7. After the computer has joined the domain and is restarted, perform steps 2 though 5 again. This time, in step 5, select the Validate Server Certificate check box.

To automate this process partially, configure a computer running Windows 7 to not validate the server certificate. Then use the Netsh lan export profile command to export a profile for the configured network adapter. You can create a script to import that profile on other client computers to allow them to join a domain without validating a server certificate.