Enabling WPA2-Enterprise in Windows

Windows Vista/7

1. In Windows, navigate to Control Panel > Network and Internet > Network and Sharing Center.
2. Click Manage Wireless networks.
3. Click Add.
4. Choose Manually create a network profile.
   
    
5. On the next page, enter the following:
   • Network name: This is the SSID name. It is case sensitive.
   • Security type: Choose WPA2-Enterprise.
   • Encryption type: Choose AES.
   • Check Start this connection automatically if you want Windows to connect to this network automatically.
   • Check Connect even if the network is not broadcasting if the SSID is hidden and you want Windows to connect to this network automatically.
      
6. Click Next.
   
   Note: If the RADIUS server has a certificate that may not be trusted by the wireless client or is not a member of the domain in which the RADIUS server resides, on the "Successfully added" page, click Change connection settings.
    
7. Choose the Security tab.
    
8. Click Settings.
    
9. Uncheck Validate server certificate if the wireless client may not trust the RADIUS server certificate.
   
10. For the Authentication Method, choose EAP-MSCHAP v2.
     
11. Click Configure.
     
12. Uncheck Automatically use my Windows logon on name and password if the computer is not on the domain.
    
13. Click OK.
    Note: It may be required to specify user or computer authentication based on whether the client is part of the domain or if machine or user authentication is a condition of the RADIUS policy.
    
    To choose user or computer authentication, from the Security tab,
    1. Click Advanced settings.
    2. Select the 802.1X settings tab.
    3. Check Specify authentication mode.
    4. Choose User or computer authentication. Or choose an alternate option if required.
       
    5. Click OK to close out.
        

Windows 10/11

1. Navigate to Control Panel > Network and Sharing Center.
2. Click Set up a new connection or network.
3. Select Manually connect to a wireless network.
   
    
4. On the next page, enter the following:
   1. Network name: This is the SSID name. It is case sensitive.
   2. Security type: Choose WPA2-Enterprise.
   3. Encryption type: Choose AES.
   4. Check Start this connection automatically if you want Windows to connect to this network automatically.
   5. Check Connect even if the network is not broadcasting if the SSID is hidden and you want Windows to connect to this network automatically.
       
5. Click Next.
   
    
6. Click Change connection settings.
   
    
7. Choose the Security tab.
    
8. Click Settings.
   
   Note: Make sure that Microsoft: Protected EAP (PEAP) has been selected under 'Choose a network authentication method:'
    
9. Uncheck Verify the server's identity by validating the certificate if the wireless client may not trust the RADIUS server certificate
   
   Note: Make sure that Secured password (EAP-MSCHAP v2) has been selected under 'Select Authentication Method:'
    
10. Click Configure...
     
11. Uncheck Automatically use my Windows logon name and password (and domain if any) if the computer is not on the domain.
    
     
12. Click OK.
    Note: It may be required to specify user or computer authentication based on whether the client is part of the domain or if machine or user authentication is a condition of the RADIUS policy.
     
13. Back at the security tab, click on Advanced settings.
    
     
14. Check 'Specifiy authentication mode:' 
    
     
15. Click Ok.
     

Note: Your computer will use your Windows logon credentials and domain unless you uncheck the box as shown in the Step 12 screenshot.

1. WPA2-Enterprise with 802.1X Authentication
   https://documentation.meraki.com/MR/Encryption_and_Authentication/Wireless_Encryption_and_Authentication_Overview
    
2. RADIUS: Configuring PEAP EAP-MSCHAPv2
   /Wireless_LAN/Encryption_and_Authentication/Enterprise_(802.1X)/RADIUS:_WPA2-Enterprise_With_PEAP-MSCHAPv2_Using_Microsoft_NPS