{"id":2171,"date":"2015-11-10T23:19:31","date_gmt":"2015-11-10T21:19:31","guid":{"rendered":"http:\/\/www.windows-infrastructure.de\/?p=2171"},"modified":"2021-03-06T18:08:59","modified_gmt":"2021-03-06T16:08:59","slug":"enable-eap-md5-in-windows-nps","status":"publish","type":"post","link":"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/","title":{"rendered":"enable EAP-MD5 in Windows NPS"},"content":{"rendered":"<p>For enabling wired MAC bypass on Cisco switches there are two commands\u00a0available.<\/p>\n<ul>\n<li>dot1x mac-auth-bypass\u00a0&#8212; the Access-Request message is a Password Authentication Protocol (PAP) authentication request<\/li>\n<li>dot1x mac-auth-bypass eap &#8212; the Cisco switch perform MAB as EAP-MD5 authentication<\/li>\n<\/ul>\n<p>Although PAP authentication has been configured by the switch as well as authentication method in Microsoft NPS Server, authentication does not work.\u00a0The NPS logs showing\u00a0rejects for the reason of a not configured protocol type; EAP with type MD5. Sniffing with\u00a0Network Monitor confirmed\u00a0Cisco\u00a0requests EAP communication.<\/p>\n<span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span>\n<p>Some researches brought me to the following statement:<\/p>\n<p><em>In this release, the RADIUS security system with Extensible Authentication Protocol (EAP) extensions is the only supported authentication server.<\/em><span style=\"font-size: 10pt;\"><br \/>\n<\/span><\/p>\n<p><span style=\"font-size: 10pt;\"><a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/switches\/lan\/catalyst2960x\/software\/15-0_2_EX\/security\/configuration_guide\/b_sec_152ex_2960-x_cg\/b_sec_152ex_2960-x_cg_chapter_010000.html\" target=\"_blank\" rel=\"noopener\">http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/switches\/lan\/catalyst2960x\/software\/15-0_2_EX\/security\/configuration_guide\/b_sec_152ex_2960-x_cg\/b_sec_152ex_2960-x_cg_chapter_010000.html<\/a><\/span><\/p>\n<p><span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span><span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span><\/p>\n<p>In current NPS implementation EAP-MD5 cannot be chosen for authentication.<\/p>\n<p><img loading=\"lazy\" class=\"wp-image-2176 alignnone\" src=\"https:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_217.png\" alt=\"Microsoft NPS authentication eap \" width=\"733\" height=\"607\" srcset=\"http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_217.png 733w, http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_217-300x248.png 300w\" sizes=\"(max-width: 733px) 100vw, 733px\" \/><\/p>\n<p><span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span><span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span><\/p>\n<p>MD5 Challenge is being deprecated and no\u00a0longer supported\u00a0since Windows Server\u00a02008\/Vista. It can be re-enabled by modifying the registry on the NPS Server, but without any support!<\/p>\n<p><img loading=\"lazy\" class=\"size-full wp-image-2178 alignnone\" src=\"https:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_221.png\" alt=\"NPS registry eap-md5\" width=\"1030\" height=\"730\" srcset=\"http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_221.png 1030w, http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_221-300x213.png 300w, http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_221-1024x726.png 1024w\" sizes=\"(max-width: 1030px) 100vw, 1030px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>registry import<\/p>\n<pre class=\"theme:a-weiss lang:default decode:true\">Windows Registry Editor Version 5.00\r\n\r\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RasMan\\PPP\\EAP\\4]\r\n\"RolesSupported\"=dword:0000000a\r\n\"FriendlyName\"=\"MD5-Challenge\"\r\n\"Path\"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\\\r\n  00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,52,00,\\\r\n  61,00,73,00,63,00,68,00,61,00,70,00,2e,00,64,00,6c,00,6c,00,00,00\r\n\"InvokeUsernameDialog\"=dword:00000001\r\n\"InvokePasswordDialog\"=dword:00000001\r\n\r\n<\/pre>\n<span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span>\n<p>when values are set, restart the NPS Service<\/p>\n<p><img loading=\"lazy\" class=\"size-full wp-image-2177 alignnone\" src=\"https:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_218.png\" alt=\"Microsoft NPS authentication eap md5 eap-md5\" width=\"732\" height=\"606\" srcset=\"http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_218.png 732w, http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_218-300x248.png 300w\" sizes=\"(max-width: 732px) 100vw, 732px\" \/><\/p>\n<span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span>\n<p>NPS log<\/p>\n<p><span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Log Name:\u00a0\u00a0\u00a0\u00a0\u00a0 Security<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Source:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Microsoft-Windows-Security-Auditing<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Event ID:\u00a0\u00a0\u00a0\u00a0\u00a0 6278<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Task Category: Network Policy Server<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Level:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Information<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Keywords:\u00a0\u00a0\u00a0\u00a0\u00a0 Audit Success<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">User:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 N\/A<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Network Policy Server granted full access to a user because the host met the defined health policy.<\/span><\/p>\n<p><span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Authentication Details:<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">Authentication Type:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 EAP<\/span><br \/>\n<span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">EAP Type:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MD5-Challenge\u00a0\u00a0\u00a0 <\/span><\/p>\n<p><span style=\"font-family: courier new,courier,monospace; font-size: 10pt;\">\u00a0<\/span><\/p>\n<p><span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span><span class=\"\" style=\"display:block;clear:both;height: 0px;padding-top: 20px;border-top-width:0px;border-bottom-width:0px;\"><\/span><\/p>\n<p>Windows Server 2012R2<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>For enabling wired MAC bypass on Cisco switches there are two commands\u00a0available. dot1x mac-auth-bypass\u00a0&#8212; the Access-Request message is a Password Authentication Protocol (PAP) authentication request dot1x mac-auth-bypass eap &#8212; the Cisco switch perform MAB as EAP-MD5 authentication Although PAP authentication&hellip; <a href=\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/\" class=\"more-link\">Weiterlesen <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":2177,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[149,150],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v15.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>enable EAP-MD5 in Windows NPS - windows-infrastructure.de<\/title>\n<meta name=\"description\" content=\"MD5 Challenge is being deprecated and longer supported since Windows Server 2008\/Vista. It can be re-enabled by modifying the registry on the NPS Server\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"enable EAP-MD5 in Windows NPS - windows-infrastructure.de\" \/>\n<meta property=\"og:description\" content=\"MD5 Challenge is being deprecated and longer supported since Windows Server 2008\/Vista. It can be re-enabled by modifying the registry on the NPS Server\" \/>\n<meta property=\"og:url\" content=\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/\" \/>\n<meta property=\"og:site_name\" content=\"windows-infrastructure.de\" \/>\n<meta property=\"article:published_time\" content=\"2015-11-10T21:19:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-03-06T16:08:59+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_218.png\" \/>\n\t<meta property=\"og:image:width\" content=\"732\" \/>\n\t<meta property=\"og:image:height\" content=\"606\" \/>\n<meta name=\"twitter:label1\" content=\"Gesch\u00e4tzte Lesezeit\">\n\t<meta name=\"twitter:data1\" content=\"2 Minuten\">\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"http:\/\/www.windows-infrastructure.de\/#website\",\"url\":\"http:\/\/www.windows-infrastructure.de\/\",\"name\":\"windows-infrastructure.de\",\"description\":\"Windows Server Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":\"http:\/\/www.windows-infrastructure.de\/?s={search_term_string}\",\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"de-DE\"},{\"@type\":\"ImageObject\",\"@id\":\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/#primaryimage\",\"inLanguage\":\"de-DE\",\"url\":\"http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/hc_218.png\",\"width\":732,\"height\":606,\"caption\":\"Microsoft NPS authentication eap md5 eap-md5\"},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/#webpage\",\"url\":\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/\",\"name\":\"enable EAP-MD5 in Windows NPS - windows-infrastructure.de\",\"isPartOf\":{\"@id\":\"http:\/\/www.windows-infrastructure.de\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/#primaryimage\"},\"datePublished\":\"2015-11-10T21:19:31+00:00\",\"dateModified\":\"2021-03-06T16:08:59+00:00\",\"author\":{\"@id\":\"http:\/\/www.windows-infrastructure.de\/#\/schema\/person\/60ba29b74ac5d95d2d152448d563e4a8\"},\"description\":\"MD5 Challenge is being deprecated and longer supported since Windows Server 2008\/Vista. It can be re-enabled by modifying the registry on the NPS Server\",\"inLanguage\":\"de-DE\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/www.windows-infrastructure.de\/enable-eap-md5-in-windows-nps\/\"]}]},{\"@type\":\"Person\",\"@id\":\"http:\/\/www.windows-infrastructure.de\/#\/schema\/person\/60ba29b74ac5d95d2d152448d563e4a8\",\"name\":\"Holger Wache\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"http:\/\/www.windows-infrastructure.de\/#personlogo\",\"inLanguage\":\"de-DE\",\"url\":\"http:\/\/www.windows-infrastructure.de\/wp-content\/uploads\/Holger1.png\",\"caption\":\"Holger Wache\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/posts\/2171"}],"collection":[{"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/comments?post=2171"}],"version-history":[{"count":16,"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/posts\/2171\/revisions"}],"predecessor-version":[{"id":2345,"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/posts\/2171\/revisions\/2345"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/media\/2177"}],"wp:attachment":[{"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/media?parent=2171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/categories?post=2171"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.windows-infrastructure.de\/wp-json\/wp\/v2\/tags?post=2171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}