Back to Contents

Administrator Tool

Set Administrator Password
Administrator Tool Settings
Administrator Packages
Administrator Profiles

• Persistent Profiles
• Pre-Logon/Common Connection
• Common Profiles
• Exclude Networks
• Voice over IP (VoIP)

Application Settings
Adapter Settings
Software
EAP-FAST A-ID Groups
Administrator Tasks

The Administrator Tool is used by the person who has administrator privileges on this computer. This tool is used to configure common (shared) profiles, Pre-logon/Common profiles, and Persistent Connection profiles. The Administrator Tool can also be used by an Information Technology department to configure user settings within the Intel(R) PROSet/Wireless software and to create custom install packages to export to other systems.

The Administrator Tool is located on the Intel(R) PROSet/Wireless Tools menu. It must be selected during a Custom installation of the Intel(R) PROSet/Wireless software or the feature is not displayed in the Tools menu.

Set Administrator Password

Users cannot modify Administrator settings or profiles unless they have the password for this tool. When you first access the Administrator Tool, you are required to enter a password. The password must not exceed 100 characters (although the field will only display up to 56 characters). Null passwords are not allowed.

NOTE: If you do not know the original password, there is no process available to reset the password.

1. Password: Create a password (maximum 56 characters).
2. Confirm Password: Reenter the password.
3. Click OK. The Open Administrator Package displays.

To change the existing password:

1. Click Administrator Tool from the Tools menu.
2. Click Change Password on the password entry form.
3. Old Password: Enter the existing password.
4. New Password: Enter the new password.
5. Confirm Password: Reenter the new password again.
6. Click OK to save the new password and enter the Administrator Tool.

Administrator Tool Settings

An Administrator can determine that order that Administrator profiles are placed in the Administrator Tool's Profiles list.

1. At the main window, click Tools > Administrator Tool.
2. After the Administrator Tool opens, click Tools > Settings.
   • Select Insert on top to always place Administrator profiles at the top of the Administrator Tool's Profiles list.
   • Select Insert on bottom to always place Administrator profiles at the bottom the Administrator Tool's Profiles list.
3. Click OK to close and return to the Administrator Tool.

Administrator Packages

Administrator Packages are used to save administrative profiles and other settings. You can copy or send this self-extracting executable file to clients on your network. When the executable runs, the contents are installed and configured on the destination computer.

To create a new package:

1. On the Tools menu, click Administrator Tool.
2. Enter your password to access the Administrator Tool.
3. Administrator Package: Click one of the following to create a new package or open an existing package.

Name	Description
Create a Windows XP or Windows 2000 package	Create a package that can be exported to a user's computer that has either Microsoft Windows XP* or Microsoft Windows 2000* operating system. This package allows export of all 802.1X authentication EAP-type Pre-Logon/Common and Persistent profiles.
Create a Windows Vista package	Create a package that can be exported to a user's computer that has the Windows Vista* operating system. This package allows export of EAP-TTLS and EAP-SIM Common profiles only.
Open an existing package	Select to browse for and open an existing package.

4. Click OK.
5. Configure the following options to be included in the package:

Name	Description
Profiles	Click Include Profiles in this package. Profiles can be shared with other users.
Application Settings	Click Include Application Settings in this package. Specify application settings to be enabled.
Adapter Settings	Click Include Adapter Settings in this package. Specify initial values for adapter settings used on this computer.
Software	Click Include Software in this package. Define wihch software components are installed on this computer. NOTE: See Software for information to reduce the size of the Administrator Package executable file.
EAP-FAST A-ID Groups	Click Include A-ID Groups. Add A-ID Group to support multiple PACs from multiple A-IDs. NOTE:  This feature is unavailable when creating an Administrator Package for Windows Vista clients.

6. Click Close.
7. You are notified: The current package is changed. Would you like to save the changes?
8. Click Yes. Save the executable file to a directory on the local disk drive.
9. Click Save. The file is created. NOTE: This may take several minutes.
10. Click Finished to view the package contents.
    • Click Apply this package to this computer if you want to use the package configuration on the Administrator's computer.
    • Copy the executable file to any user's computer to install the configuration that has been saved in the package. When you execute the package file, it is a silent install.
11. Click OK.

NOTE: You can also select Save Package on the File menu to save the package.

NOTE: Administrator profiles for Windows Vista are stored in an XML format. These profiles are imported into a Windows Vista system through the Group Policy Manager.

To edit a package:

1. Access the Administrator Tool.
2. On the Open Administrator Package page, click Open an existing package to edit an existing package.
3. Click Browse. Locate the package's executable file.
4. Click Open. Make your updates to the package settings.
5. Click Close.
6. You are notified: The current package is changed. Would you like to save the changes?
7. Click Yes. Save the executable file to a directory on the local disk drive.

NOTE: You can also select Open Package on the File menu to edit an Administrator Package.

Administrator Profiles

Administrator Profiles are owned and managed by the network administrator or the administrator of this computer. These profiles are common or shared by all users on this computer. However, end users cannot modify these profiles. They can only be modified from the Administrator Tool, which is password protected.

There are two types of Administrator Profiles: Persistent and Pre-logon/Common. You can also configure Voice over IP (VoIP) settings for export to a soft-phone application.

NOTE: For Windows Vista packages, only EAP-SIM and TTLS Common profiles can be created.

NOTE: For Windows Vista, EAP-SIM is not supported for Persistent profile types.

Persistent Profiles

Persistent profiles are applied at boot time or whenever no one is logged on the computer. After a user logs off, a Persistent profile maintains a wireless connection either until the computer is turned off or a different user logs on.

NOTE: Unavailable for Windows Vista packages.

Persistent profile key points:

• The following types of profiles can be created as Persistent profiles:
  • All profiles that do not require 802.1X authentication (for example, Open authentication with WEP encryption, Open authentication with no encryption).
  • All profiles with 802.1X authentication that have the credentials saved: LEAP or EAP-FAST.
  • Profiles with security settings that include the "Use the following user name and password" option.
  • Profiles that use the machine certificate to authenticate.
  • WPA*-Enterprise profiles that do not use a user certificate.
  • WPA-Personal profiles.
• Persistent profiles are applied at system power up and after a user logs off.

NOTE: Intel(R) PROSet/Wireless supports machine certificates. However, they are not displayed in the certificate listings.

To create a Persistent profile:

1. Click Include Profiles in this package.
2. Click Persistent.
3. Click Add to open the General Settings.
4. Profile Name: Enter a descriptive profile name.
5. Wireless Network Name (SSID): Enter the name of your wireless network.
6. Operating Mode: Network (Infrastructure) is selected by default.
7. Administrator Profile Type: Persistent: Active when no users are logged on is selected.
8. Click Next.
9. Click Enterprise Security to open the Security Settings. See TLS, TTLS, PEAP, LEAP, or EAP-FAST for 802.1X security configuration information.
10. Click OK.

Pre-Logon Connect

Pre-logon/Common profiles are applied prior to a user log on. If Single Sign On support is installed, the connection is made prior to the Windows log-on sequence (Pre-logon/Common).

NOTE: Unavailable for Windows Vista packages.

If Single Sign On support is not installed, the profile is applied once the user session is active. Pre-logon/Common profiles always appear at the top of the Profiles list. Users can still prioritize profiles that they have created but they cannot reprioritize Pre-logon/Common profiles. Because these profiles appear at the top of the Profiles list, Intel(R) PROSet/Wireless automatically attempts to connect to the Administrator profiles first before any user-created profiles.

NOTE: Only administrators can create or export Pre-logon/Common profiles.

Pre-Logon Connect key points are:

• Pre-Logon Connect is active only at the Windows log on.
• The following types of profiles can be created as Pre-logon/Common profiles:
  • 802.1X PEAP, TTLS or EAP-FAST profiles that use either the "Use Windows Logon user name and password" or "Use the following user name and password" credentials when configuring the profile's security settings.
  • LEAP profiles that use the "Prompt for the user name and password." credentials when configuring the profile's security settings.
  • 802.1X PEAP or TTLS profiles with user or machine certificates (the user must have administrative rights to use machine certificates).
  • TLS profiles that use digital certificates to verify the identity of a client and a server.
  • EAP-SIM profiles that use a Subscriber Identity Module (SIM) card to validate your credentials with the network.
  • All non-802.1X (Open and WEP) Common or User Based profiles.
• A Pre-logon/Common profile is applied at Windows user log-on time.

Pre-Logon/Common Connection Status

Pre-logon/Common profiles support is installed during a Custom install of the Intel(R) PROSet/Wireless software. See Install or Uninstall the Single Sign On Feature for more information.

NOTE: If the Single Sign On or Pre-Logon Connect features are not installed, an administrator is still able to create Pre-logon/Common profiles for export to a user's computer.

The following describes how the Pre-Logon Connect feature functions from system power-up. The assumption is that a saved profile exists. This saved profile has valid security settings marked with "Use Windows Logon user name and password" that are applied at the time of Windows log on.

1. After a system power-up, enter your Windows log on domain, user name, and password.
2. Click OK. The Pre-logon/Common profile status page displays the progress of the network connection. After the wireless adapter is connected to the network access point, the Status page closes and the Windows user logs on.
   • If the corresponding access point rejects your credentials during the Pre-logon/Common connection, you will be prompted for your user credentials.
   • Enter your credentials.
   • Click OK. The profile is applied and the Status page displays the progress of the connection status until you are logged onto Windows.
   • Click Cancel on the Credentials page to select another profile.

NOTE: A user certificate can only be accessed by a user that has been authenticated on the computer. Therefore, a user should log onto the computer once (using either a wired connection, alternate profile or local log in) before using a Pre-logon/Common profile that authenticates with a user certificate.

When you log off, any wireless connection is disconnected and a persistent profile (if one is available) is applied. Under certain circumstances, it is desirable to maintain the current connection (for example, if user-specific data needs to be uploaded to the server post-log off or when roaming profiles are used).

Create a profile that is marked as both Pre-logon/Common and persistent to achieve this functionality. If such a profile is active when the user logs off, the connection is maintained.

To create a Pre-logon/Common Profile:

1. Click Include Profiles in this package.
2. Click Pre-logon/Common.
3. Click Add to open the General Settings.
4. Profile Name: Enter a descriptive profile name.
5. Wireless Network Name (SSID): Enter the network identifier.
6. Operating Mode: Network (Infrastructure) is selected by default.
7. Administrator Profile Type: Pre-logon/Common: Active when a user is logged on. This profile is shared by all users. This profile type is already selected.
8. Click Next.
9. Click Advanced to open the Advanced Settings. Use the Advanced Settings to set the following:

10. Click OK to close the Advanced Settings.
11. Click Enterprise Security to open the Security Settings. See EAP-SIM, TLS, TTLS, PEAP, LEAP, or EAP-FAST for 802.1X security configuration information.
12. Click OK to save the profile and add it to the Administrator profiles list.

NOTE: If a Persistent connection was already established, a Pre-logon/Common profile is ignored unless the profile is configured with both Pre-logon/Common and Persistent connection options.

Common Profiles

Common profiles are applied through the Group Policy Manager. The following types of profiles can be created as Common profiles:

• 802.1X TTLS profiles that use the "Prompt each time I connect" or "Use the following" credentials when configuring the profile's security settings.
• 802.1X TTLS profiles with user or machine certificates (the user must have administrative rights to use machine certificates).
• EAP-SIM profiles that use a Subscriber Identity Module (SIM) card to validate your credentials with the network.

To create a Common Profile:

1. Click Include Profiles in this package (default).
2. Click Common.
3. Click Add to open the General Settings.
4. Profile Name: Enter a descriptive profile name.
5. Wireless Network Name (SSID): Enter the network identifier.
6. Operating Mode: Network (Infrastructure) is selected by default.
7. Click Next.
8. Click Advanced to open the Advanced Settings. Use the Advanced Settings to set the following optional settings:

9. Click OK to close the Advanced Settings.
10. Click Enterprise Security to open the Security Settings. See EAP-SIM or TTLS for 802.1X security configuration information.
11. Click OK to save the profile and add it to the Administrator profiles list.

Exclude Networks

Administrators can designate networks to be excluded from connection. Once a network is excluded, only an administrator can remove the network from the Exclude list. The excluded network is displayed in the Intel(R) PROSet/Wireless Exclude List Management.

NOTE: Unavailable for Windows Vista packages.

To exclude a network:

1. Click Include Profiles in this package.
2. Click Exclude.
3. Click Add to open the Exclude Network (SSID).
4. Network Name: Enter the network name of the network that you want to exclude.
5. Click OK to add the network name to the list.

To remove a network from exclusion:

1. Select the network name in the Exclude list.
2. Click Remove. The network is deleted from the list.

Voice over IP (VoIP) Connection

Intel(R) PROSet/Wireless software supports VoIP third-party soft-phone applications. Third-party VoIP applications support voice codecs. Codecs generally provide a compression capability to save network bandwidth. Intel(R) PROSet/Wireless software supports the following International Telecommunications Union (ITU) codec standards:

Codec	Algorithm
ITU G.711	PCM (Pulse Code Modulation)
ITU G.722	SBADPCM (Sub-Band Adaptive Differential Pulse Code Modulation)
ITU G.723	Multi-rate Coder
ITU G.726	ADPCM (Adaptive Differential Pulse Code Modulation)
ITU G.727	Variable-Rate ADPCM
ITU G.728	LD-CELP (Low-Delay Code Excited Linear Prediction)
ITU G.729	CS-ACELP (Conjugate Structure Algebraic-Code Excited Linear Prediction)

An administrator can export VoIP settings to configure various codec data rates and frame rates to improve voice quality in VoIP transmissions.

To configure VoIP settings:

NOTE: Ensure Voice over IP is not disabled in the Administrator Tool Application Settings. It is enabled by default.

1. Click Include Profiles in this package.
2. Click VoIP.
3. Click Add to open the Create VoIP Profiles page.
4. Select the Codec bandwidth, application usage, and frame rate. For Voice Data:

G711 has 10ms frame rate with 64kbps bit rate
G722 has 10ms frame rate with 64kbps bit rate
G723 has 30ms frame rate with either 5.3kbps or 6.4kbps bit rate
G726-32 has 10ms frame rate with 32kbps bit rate
G728 has 2.5ms frame rate with 16kbps bit rate
G729 has 10ms frame rate with 10kbps bit rate

Select parameters from the drop down menus.

Codec	Usage	Frame Rate
G711_64kbps G722_64kbps G722_56kbps G722_48kbps G722_1_32kbps G722_1_24kbps G722_1_16kbps G726_16kbps G726_24kbps G726_32kbps G726_40kbps G728_16kbps G729a_8kbps G729e_11_8kbps GIPS_iPCM_VARIABLE G722_2_VARIABLE	Interactive Voice Audio Conference Voice Data Video Streaming Audio	20 30

5. Click OK to return to the Profiles list.
6. Click Close to save the profile settings to a package.

Application Settings

An administrator can select what level of control users have over their wireless network connections.

To configure Application Settings:

1. Click Include Application Settings in this package.
2. Enable or disable each setting listed in the table below.

Name	Windows XP/2000 Packages	Windows Vista Packages	Description
802.1X Authentication			Enable a user to create or connect to profiles that support different 802.1X authentication EAP types. Select which 802.1X authentication EAP types you want enabled on a user's computer: EAP SIM, EAP LEAP, EAP TLS, EAP TTLS, EAP PEAP, EAP FAST.
AAA In Control			Notify when another application uses the wireless adapter.
Administrator Tool			Disable access to the Administrator Tool on a user's computer.
Application Auto Launch			Select to start a batch file, executable file, or script automatically when a specific profile connects to the network. For example, start a Virtual Private Network (VPN) session automatically whenever a user connects to a wireless network.
Application On Radio Toggle			Enables a third-party application to disable the Intel(R) PROSet/Wireless Wireless On or Wireless Off switch.
CCXv4			Select Enable CCXv4 to Enable Cisco Compatible Extensions, version 4 (CCXv4) features for EAP-FAST profiles. NOTE: The EAP-FAST Authority Identifier (A-ID) Groups feature in the Administrator Tool is unavailable if CCXv4 is not enabled. Select which of the following prompts to enable or disable on a user's computer for EAP-FAST PAC provisioning: Turn off prompts and warnings for unauthenticated provisioning: Option to turn off prompts and warnings for PAC auto-provisioning if there is no PAC or there is no PAC that matches the A-ID sent by the server that it is connected to. Turn off prompts when switching default server (A-ID): Option to turn off prompts when a client encounters a server that has provisioned a PAC before but is not currently selected as the default server. Turn off unauthenticated provisioning after PAC is provisioned: Option to turn off auto-provisioning automatically after a PAC for that A-ID has been provisioned. NOTE: This feature is not installed through an Administrator Package when a user's computer has an Intel(R) PRO/Wireless 2915ABG Network Connection or an Intel(R) PRO/Wireless 2200BG Network Connection.
Cache Credentials			Select to save credentials after a user logs on. If the wireless connection temporarily disconnects, the saved credentials are used upon reconnection. The credentials are cleared when the user logs off. NOTE: If cleared, the Prompt each time I connect option is unavailable when creating profiles.
Device to Device (ad hoc)			Enable or disable whether a user is able to either create Device to Device (ad hoc) profiles or join Device to Device (ad hoc) networks. Select one of the following to enable or disable whether the user can connect to device to device networks: Enable device to device networking Enable only secure device to device networking Disable device to device networking Select to either allow a user to configure profiles with Device to Device (ad hoc) settings or prevent configuration of Device to Device (ad hoc) profiles. Show device to device application settings Hide device to device application settings To remove the Device to Device (ad hoc) operating mode from the wireless profile General Settings, select both Disable device to device networking and Hide device to device application settings. This prevents a user from creating profiles that support Device to Device (ad hoc) network.
Import and Export			Select to import to or export profiles from a user's computer. Enable permits auto import of user profiles when copied to an auto import folder.
Maintain Connection			Select to hide the Maintain Connection option in the Create Wireless Profile Advanced Settings. The Maintain Connection option maintains the wireless connection with a user profile after log off. NOTE: The Maintain Connection option may be used with Nortel VPN client when it is configured to Logoff on Connect.
Message On Radio Toggle			Enables a third-party application to notify a user that the Intel(R) PROSet/Wireless Wireless On or Wireless Off switch is disabled.
Microsoft Windows XP Coexistence			Select Enable Microsoft Wireless Zero Configuration and Intel PROSet/Wireless to coexist on this system. Enable this option to allow Microsoft Wireless Zero Configuration and Intel(R) PROSet/Wireless to exist together on this system. When you select this option, you prevent Microsoft Windows XP Wireless Zero Configuration Service from being disabled when Intel(R) PROSet/Wireless is enabled. NOTE: This setting is not applicable for Microsoft Windows Vista client.
Persistent Connection			Select Ensure that persistent connection and computer policies are updated prior to user log on. NOTE: Updating policies may delay the log on screen for up to 2 minutes.
Pre-Logon Cisco Mode			Enable Cisco Mode during a Pre-logon/Common connection. Cisco access points have the capability to support multiple wireless network names (SSIDs) but only broadcast one. In order to connect to such an access point, an attempt is made to connect with each profile. This is referred to as Cisco Mode. NOTE: The Pre-logon/Common connection may increase the connection time.
Profile Connectivity			Select the profile connectivity level on a user's computer. Disable user-profile switching. Users are only able to connect with the first Pre-logon/Common profile or connect with Pre-logon/Common profiles only. Allow the user to connect to all administrator profiles. Allow the user to only connect to the first administrator profile.
Security Level			Select the security level on a user's computer. Users are able to connect to profiles only with this security level. Clicking this checkbox enables the following control to be turned on or off. Allow the user to connect to networks with Personal Security only. NOTE: Unavailable for Windows Vista packages.
Shared Folder Notification			Select the shared folder notification setting on a user's computer. Select to automatically unshare shared folders for the duration of a connection to an unsecured network. Disable this notification Notify when connected to an unsecured network (default).
Single Sign On			Select which Administrator Profile types are enabled on a user computer. Persistent Connection: Profiles are active during start up and when no user is logged onto the computer. Pre-Logon/Common Connection: Profiles are active immediately once a user logs onto the computer. Common profiles are enabled if Pre-logon/Common features are not installed on a user's computer. Common profiles are active after a user has logged on and the session becomes active. Persistent and Pre-logon/Common profiles are placed at the top of the user's profiles list. They cannot be changed or deleted by a user.
Support Information			Specify the support information displayed in the About box of the Intel(R) PROSet/Wireless Software. Support URL: Enter the support center web site that you want your customers to access for technical support. Support Phone Number: Enter the telephone number that you want your customers to call for technical support.
Voice over IP			Enables third-party software to use the VoIP application on a user's computer. The default setting enables this feature. NOTE: This feature is not installed through an Administrator Package when a user's computer has an Intel(R) PRO/Wireless 2915ABG Network Connection or an Intel(R) PRO/Wireless 2200BG Network Connection.
Wi-Fi* Manager			Select which Wi-Fi* manager controls a user's wireless connections. Use either the previous logged on user's Wi-Fi manager or allow each user to select their preferred Wi-Fi manager. Allow all users to switch between Intel(R) PROSet/Wireless and Microsoft Windows XP Wireless Zero Configuration after log on. The Wi-Fi manager at log on is determined by the active Wi-Fi manager when the last user logged off.
Wi-Fi Protected Setup*			Intel(R) PROSet/Wireless software can be configured to operate as a registrar for a Wi-Fi Protected Setup* supported access points. The registrar securely transfers the access point key or password automatically or manually with a USB flash drive or other external device. Enable registering other devices (default). Hide Enable Device Registration application setting. Select to enable Intel(R) PROSet/Wireless to register other devices. Also select to hide the Enable Device Registration setting in the Intel(R) PROSet/Wireless Application Settings to block user to change the settings.
Wireless Event Log Viewer Preferences			Select where to save the Intel Wireless Troubleshooter Wireless Event Log Viewer log file. At the Intel(R) PROSet/Wireless main window, click Tools > Intel Wireless Troubleshooter. In the Intel Wireless Event Viewer, click File > Settings to open the Wireless Event Viewer Settings. If it is not enabled already, click Enable Logging. Specify the default folder for saved log files: The default location is the My Documents . Click Browse to locate a new folder location. File Name: The file name is the default machine name. Maximum Size: Enter the size of the file in kilobytes (KB). Click OK to close and apply the new changes. Click Cancel to close without applying any changes. If you want the log file copied to an archive site after a specific number of days: Click Copy the log file to another location. Destination Path: Enter where to store the files. Frequency (days): Select how often you want the files moved to the destination folder.
Wireless On/Off			Control the wireless radio. No change: The radio is not turned on or off. Turn wireless radio Off: The profile turns the radio off. Turn wireless radio On: The profile turns the radio on. Disable Wireless On/Off selection: Select to prevent a user from accessing the Wireless On/Off control on the Intel(R) PROSet/Wireless main window or Taskbar menu. A user is notified that The feature is disabled by the administrator if they attempt to turn on or off the radio control. Add 802.11a Radio On/Off selection: Select to allow the user to turn on/off the 802.11a radio separately from the 802.11b/g radio. If you select this, the Disable 802.11a Radio On/Off selection becomes available. Select this to show the 802.11a radio On/Off control, but disable it. This lets you give the user individual control over the radios. Once this feature is installed on a user's computer, follow the instructions below to turn on or off the 802.11a radio control. To turn off the 802.11a radio: On the Intel(R) PROSet/Wireless Main window, click the Wireless On button. The list of radio options is displayed. Select 802.11a Radio Off. The 802.11a radio is now inactive. To turn on the 802.11a radio: On the Intel(R) PROSet/Wireless Main window, click the 802.11a Radio Off button. The list of radio options is displayed. Select Wireless On. The 802.11a radio is now active. NOTE: The option Add 802.11a Radio On/Off selection is available only for wireless adapters that support 802.11a, 802.11b and 802.11g. This feature is not installed through an Administrator Package when a user's computer has an Intel(R) PRO/Wireless 2200BG Network Connection.
Close	Closes the Administrator Tool.
Help?	Provides help information for this page.

Adapter Settings

To configure Adapter Settings:

1. Click Include Adapter Settings in this package.
2. For each setting listed in the table below, select one of the following options:
   • Use default value: Resets the setting on the user machine to the default value.
   • No change: Maintains the user selected value. The administrator decides not to enforce all the settings on a user's computer. The user can change the adapter setting values from the Intel(R) PROSet/Wireless Advanced menu.
   • Select the value: The administrator selects the value that is to be used on the user's computer.

Software

Select which Intel(R) PROSet/Wireless software components are installed on a user's computer.

1. Click Include Software in this package.
2. Place the Intel(R) PROSet/Wireless installation CD in the CD drive.
3. Specify the Intel PROSet/Wireless Software Installation directory: Click Browse to locate the Autorun.exe file.
4. Click OK.
5. Specify which components you want to include in this package: Select which applications to install on a user's computer.

To reduce the size of the software files in your Administrator Package:

1. Copy the installation folders from your Intel(R) PROSet/Wireless software to a local directory.
2. Remove unused language folders from the \XP\Docs or \Vista\Docs and the \XP\Apps\x32\iProLang folders or the \Vista\Apps\v32\iProLang folders. For example, if you only need the English folders, you can remove all the language folders except ENU.
3. Use the files from your local directory to add the software files to the Administrator package.

NOTE: If you create an Administrator Package on a Microsoft Windows XP Professional x64 Edition system, the language files are located in the \XP\Docs and the XP\Apps\x64\iProLang folders.

NOTE: If you plan to use Novell Client* for Windows, it should be installed prior to installation of the Intel(R) PROSet/Wireless software. If Intel(R) PROSet/Wireless is already installed, you should remove it prior to installation of Novell Client for Windows.

EAP-FAST A-ID Groups

NOTE: This feature is unavailable if CCXv4 is not selected in the Administrator Tool Application Settings

NOTE: This feature is unavailable for Windows Vista packages.

An Authority Identifier (A-ID) is the RADIUS server that provisions Protected Access Credential (PACs) A-ID groups. A-ID groups are shared by all users of the computer and allow EAP-FAST profiles to support multiple PACs from multiple A-IDs.

The A-ID groups can be pre-configured by the administrator and set up through an Administrator Package on a user's computer. When a wireless network profile encounters a server with an A-ID within the same group of the A-ID specified in the wireless network profile, it uses this PAC without a prompt to the user.

To add an A-ID Group:

1. Select Include A-ID Groups.
2. Click Add.
3. Enter a new A-ID group name.
4. Click OK. The A-ID group is added to the A-ID Group list.

If the A-ID group is locked, then additional A-IDs cannot be added to the group.

To add an A-ID to an A-ID group:

1. Select a group from the A-ID Groups list.
2. Click Add in the A-IDs section.
3. Select an A-ID.
4. Click OK. The A-ID is added to the list.

Once an A-ID group has been selected, the A-IDs are extracted from the PACs on the A-ID group server. The list of A-IDs is automatically populated.

NOTE: EAP-FAST AID Groups are not applicable for Windows Vista Client.

Administrator Tasks

How to Obtain a Client Certificate

If you do not have any certificates for EAP-TLS (TLS) or EAP-TTLS (TTLS) you must obtain a client certificate to allow authentication.

Certificates are managed from either Internet Explorer or the Microsoft Windows Control Panel.

Windows XP and Windows 2000: When a client certificate is obtained, do not enable strong private key protection. If you enable strong private key protection for a certificate, you need to enter an access password for the certificate every time this certificate is used. You must disable strong private key protection for the certificate if you configure the service for TLS or TTLS authentication. Otherwise, the 802.1X service fails authentication because there is no logged in user to provide the required password.

Notes about Smart Cards

After a Smart Card is installed, the certificate is automatically installed on your computer and is chosen from the personal certificate store and root certificate store.

Set up a Client with TLS Network Authentication

Step 1: Obtain a certificate

To allow TLS authentication, you need a valid client certificate in the local repository for the logged-in user's account. You also need a trusted CA certificate in the root store.

The following information provides two methods for obtaining a certificate:

• From a corporate certification authority (CA) implemented on a Windows 2000 server.
• Import a certificate from a file with Internet Explorer's certificate import wizard.

If you do not know how to obtain a user certificate from the CA, consult your administrator for the procedure.

To install the CA on the local machine:

1. Obtain the CA and store it on your local drive.
2. Click Import. The Certificate Import Wizard opens.
3. Click Next.
4. Click Browse to locate the certificate on your local drive.
5. Click the exported certificate.
6. Click Open.
7. Click Next.
8. Click Place all certificates in the following store.
9. Click Browse to open the Select Certificate Store.
10. Click Show physical stores.
11. Click OK.
12. From the list of stores, scroll up and expand Trusted Root Certificate Authorities.
13. Click Local Computer.
14. Click OK.
15. Click Next.
16. Click Finish to complete the process.
17. Reboot after a certificate is installed.

Use Microsoft Management Console (MMC) to verify that the CA is installed in the machine store.

1. In the Start menu, click Run.
2. Enter MMC.
3. Click OK to open The Microsoft Management Console.
4. Click File.
5. Click Add/Remove Snap-in.
6. Click Add to open the Add Standalone Snap-in page.
7. Click Certificates.
8. Click Add.
9. Click Computer account.
10. Click Next.
11. Click Finish.
12. Click Close.
13. Click OK.
14. In the console, click Certificates (Local Computer).
15. Click Trusted Root Certificate Authorities.
16. Click Certificates.
17. Verify that the CA you just installed is listed.
18. Click File.
19. Click Exit to close the console.

Obtain a certificate from a Microsoft Windows 2000* CA:

1. Start Internet Explorer and browse to the Certificate Authority HTTP Service (use an URL, for example, http://yourdomainserver.yourdomain/certsrv with certsrv being the command that brings you to the certificate authority. You can also use the IP address of the server machine. For example, "192.0.2.12/certsrv."
2. Logon to the CA with the name and password of the user account you created on the authentication server. The name and password do not have to be the same as the Windows log on name and password of the current user.
3. On the Welcome page of the CA, select Request a certificate task and submit the form.
4. Choose Request Type: Select Advanced request.
5. Click Next.
6. Advanced Certificate Requests: Select Submit a certificate request to this CA using a form.
7. Click Submit.
8. Advanced Certificate Request: Select User certificate template.
9. Click Mark keys as exportable.
10. Click Next. Use the provided defaults.
11. Certificate Issued: Click Install this certificate.

NOTE: If this is the first certificate you have obtained, the CA first asks you if it should install a trusted CA certificate in the root store. This is not a trusted CA certificate. The name on the certificate is that of the host of the CA. Click Yes. You need this certificate for both TLS and TTLS.

12. If your certificate was successfully installed, you see the message, "Your new certificate has been successfully installed."
13. To verify the installation, click Internet Explorer Tools Internet Options Content Certificates. The new certificate should be installed in the Personal folder.

Import a Certificate from a File

1. Open Internet Properties (right-click on the Internet Explorer icon on the desktop.
2. Select Properties.
3. Content: Click Certificates. The list of installed certificates appears.
4. Click Import to open the Certificate Import Wizard.
5. Select the file.
6. Specify your access password for the file. Clear Enable strong private key protection.
7. Certificate store: Click Automatically select certificate store based on the type of certificate (the certificate must be in the user accounts personal store to be accessible).
8. Proceed to Completing the Certificate Import and click Finish.

To configure a profile with WPA authentication with WEP or TKIP encryption that uses TLS authentication:

NOTE: Obtain and install a client certificate, See Step 1 or consult your administrator.

Specify the certificate used by Intel(R) PROSet/Wireless

1. On the Profile page, click Add to open General Settings.
2. Profile Name: Enter a profile name.
3. Wireless Network Name (SSID): Enter the network identifier.
4. Operating Mode: Network (Infrastructure) is selected by default.
5. Click Next to open the Security Settings.
6. Click Enterprise Security.
7. Network Authentication: Select Open (Recommended).
8. Data Encryption: Select WEP.
9. 802.1X Enabled: Selected.
10. Authentication Type: Select TLS.

Step 1 of 2: TLS User

1. Obtain and install a client certificate.
2. Select one of the following to obtain a certificate:

Name	Description
Static Password	On connection, enter the user credentials.
One-time password (OTP)	Obtain the password from a hardware token device.
PIN (Soft Token)	Obtain the password from a soft token program.

3. Click Next.

Step 2 of 2: TLS Server

1. Select one of the following credential retrieval methods: Validate Server Certificate or Specify Server or Certificate Name.
2. Click OK. The profile is added to the Profiles list.
3. Click the new profile at the end of the Profiles list. Use the up and down arrows to change the priority of the new profile.
4. Click Connect to connect to the selected wireless network.
5. Click OK to close Intel(R) PROSet/Wireless.

Back to Top

Back to Contents