Salta al contenuto principale

802.1X authentication. Can I get the rescue media to work with it?

Thread needs solution

I have a rescue flash drive made and it sees the network however in order to get a working IP I have to use 802.1X to authenticate and get a real IP.  Is there anyway to do that with the Acronis rescue flash drive? I can't get the WinPE to work. I looks like it works but then fails to boot. 

0 Users found this helpful

Physical networking is supported in all of the media.  However, it really depends on the NIC you have installed and whether the drivers are available in the default media.  Most Nics will detect just fine with the Linux media, but if not, then WinPE is the best option.  However, the ADK used to build your WinPE makes a lot of difference.  If you have a Windows 7 OS or newer, you want to make sure you're using the latest Windows 10 ADK to build your WinPE as it gives the best out-of-the box driver compatibility.  If drivers are still not there with the default ADK, you need to look into adding them manually... 

The default Linux media has wireless, but he Linux drivers are subpar at best - I've had no luck with my wireless with it.  WinPE does not have wireless built in as a limitation from Microsoft.  

If you have a system that has no network port, you're probably best off using a USB 3.0 to Gigabit ethernet adapter.  It's a small price to pay for such a valuable tool and these come in handy for newer devices that have drivers not yet available in the Linux media and/or that require newer versions of the ADK when building WinPE.

Although a bit more than others, my personal favorite is this one that has 3 USB ports as well.  Comes in very handy for tablest with only one USB port so that you can use it for ethernet, a flash drive and a USB keyboard or mouse in case touch screen is not working. I've used Anker, Startech and CableMatters USB 3.0 to GB ethernet adapters with no issues.  Can't speak for the other no-name brands on Amazon, but the Amazon basics items are usually quite good too for the price.  

 

802.1x has nothing to do with NIC drivers.  The network is setup so that not everybody who has a laptop can just plug into the network.  You should read up on how 802.1X works.  The system gets a temp private IP, it then goes to a RAS server asking for authentication to get a real IP. Once the users cerdentials are authenticated it is then issues a useable IP address. So yes I know about USB NICs and yes I happen to have one that works however all my systems have Interl NICs so that wasn't ever the issue.  

Acronis doesn't appear support 802.1X which means I have to see if I can get approval to get my USB nic on the MAC bypass list.  It isn't likely to happen however as the network security has been beefed up. 

William, please see KB document: 57988: Acronis True Image 2016: Supported Network Protocols which sets out what is and isn't supported, though from your description in the previous post above, this is not an issue related to protocols but rather one of authentication in order to attain a useable IP address.

I suspect that you would need to create and use the Acronis WindowsPE Rescue media in order to do what you need as that provides a Windows Command Shell that you can use to establish the required network credentials, whereas the standard rescue media is based on a simplified Linux OS and has no provision of this type of network credential exchange.

KB document: 45527: Acronis True Image: Troubleshooting Network Connection Issues is another document in this area but looks to be dealing primarily for issues caused by antivirus etc.

I misread the post initially and assumed you were talking about 802.11x wireless.

Everything I've read says that WinPE does not support 802.1x natively and there are lots of forum posts on the web with folks trying to get it to work, but not alot of them saying how to do it successfully.  There is one post that suggests a hotfix for ADK 2.1/3.0 (https://blogs.technet.microsoft.com/deploymentguys/2010/01/15/added-sup…) , but don't see anything for the lastest ADK 5.0 (Windows 8.1) or ADK 10.0/10.1.

Could try building the WinPE with ADK 10.0/10.1 and see how it goes. Ultimately, it does not look like Windows ADK supports this out of the box and other references suggest that Linux doesn't do this well either (and ATI is pretty limited as an OS too).

https://msdn.microsoft.com/en-us/windows/hardware/commercialize/manufac…

To connect to a wired network using 802.1x authentication protocols

  1. Create a custom Windows PE image that includes the WinPE-Dot3Svc optional component. (You would manually have to use ADK DISM commands to add this to the Acronis created boot.wim file)

  2. Boot a PC to Windows PE.

  3. Start the dot3svc service.

    net start dot3svc
    
  4. Add a LAN profile.

    <?xml version="1.0"?>
    <!-- Sample LAN profile: EthernetLANProfile.xml" -->
    <LANProfile xmlns="http://www.microsoft.com/networking/LAN/profile/v1">
      <MSM>
        <security>
          <OneXEnforced>false</OneXEnforced>
          <OneXEnabled>true</OneXEnabled>
          <OneX xmlns="http://www.microsoft.com/networking/OneX/v1">
            <cacheUserData>true</cacheUserData>
            <authMode>user</authMode>
            <EAPConfig><EapHostConfig 
              xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type 
              xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type><VendorId 
              xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType 
              xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId 
              xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config 
              xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap 
              xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
            <Type>25</Type><EapType 
              xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1">
            <ServerValidation>
              <DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation>
              <ServerNames></ServerNames>
              <TrustedRootCA>1a 2b 3c 4d 56 78 90 aa bb cc dd ee ff 1a 2b 3c 4d 5e 6f</TrustedRootCA>
              </ServerValidation><FastReconnect>true</FastReconnect>
              <InnerEapOptional>false</InnerEapOptional><Eap 
                xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
              <Type>26</Type><EapType 
                xmlns="http://www.microsoft.com/provisioning/MsChapV2ConnectionPropertiesV1">
              <UseWinLogonCredentials>false</UseWinLogonCredentials></EapType></Eap>
              <EnableQuarantineChecks>false</EnableQuarantineChecks>
              <RequireCryptoBinding>false</RequireCryptoBinding><PeapExtensions>
              <PerformServerValidation 
                xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false
              </PerformServerValidation><AcceptServerName 
                xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false
                </AcceptServerName><PeapExtensionsV2 
                xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">
              <AllowPromptingWhenServerCANotFound 
                xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV3">true
              </AllowPromptingWhenServerCANotFound></PeapExtensionsV2></PeapExtensions></EapType>
            </Eap></Config></EapHostConfig></EAPConfig>
          </OneX>
        </security>
      </MSM>
    </LANProfile>
    
  5. Link the EAP User Data with the profile.

    <?xml version="1.0"?>
    <!-- Sample EAP user data: EAP_UserData.xml" -->
    <EapHostUserCredentials 
      xmlns="http://www.microsoft.com/provisioning/EapHostUserCredentials" 
      xmlns:eapCommon="http://www.microsoft.com/provisioning/EapCommon" 
      xmlns:baseEap="http://www.microsoft.com/provisioning/BaseEapMethodUserCredentials">
      <EapMethod>
        <eapCommon:Type>25</eapCommon:Type>
        <eapCommon:AuthorId>0</eapCommon:AuthorId>
      </EapMethod>
      <Credentials
        xmlns:eapUser="http://www.microsoft.com/provisioning/EapUserPropertiesV1" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
        xmlns:baseEap="http://www.microsoft.com/provisioning/BaseEapUserPropertiesV1" 
        xmlns:MsPeap="http://www.microsoft.com/provisioning/MsPeapUserPropertiesV1" 
        xmlns:MsChapV2="http://www.microsoft.com/provisioning/MsChapV2UserPropertiesV1">
        <baseEap:Eap>
          <baseEap:Type>25</baseEap:Type>
          <MsPeap:EapType>
            <MsPeap:RoutingIdentity>onex\administrator</MsPeap:RoutingIdentity>
            <baseEap:Eap>
              <baseEap:Type>26</baseEap:Type>
              <MsChapV2:EapType>
                <MsChapV2:Username>actualuser</MsChapV2:Username>
                <MsChapV2:Password>actualpassword</MsChapV2:Password>
                <MsChapV2:LogonDomain>actualdomain</MsChapV2:LogonDomain>
              </MsChapV2:EapType>
            </baseEap:Eap>
          </MsPeap:EapType>
        </baseEap:Eap>
      </Credentials>
    </EapHostUserCredentials>