The IEEE 802.1X authentication protocol is not supported in Windows Preinstall Environment (PE) 3.0

Introduction

Windows Preinstall Environment (PE) 3.0 does not support the IEEE 802.X authentication protocol. Therefore, the Windows PE 3.0 client cannot authenticate a switch that is configured for IEEE 802.X authenticated network access.

More Information

After you apply this hotfix, Windows PE 3.0 supports the IEEE 802.X authentication protocol.

Note 802.1X authentication is not supported when you start Windows PE from the following:

• Microsoft System Center Configuration Manager 2007 Operating System Deployment

• Microsoft Deployment Toolkit

Add the update to Windows PE 3.0

The following instructions show how to add the following update to Windows PE 3.0. It does not cover any integration with System Center Configuration Manager or with other products.

972831 The IEEE 802.1X authentication protocol is not supported in Windows Preinstall Environment (PE) 3.0 You must have the following files and prerequisites available or installed:

• A technician computer that has the Windows Automated Installation Kit (AIK) for Windows 7 installed

• 394904_intl_i386_zip.exe or 394905_intl_x64_zip.exe, depending on architecture of your Windows PE image

• The following VBS script and two XML files. They are located in the Script samplessection:

  • StartDot3.VBS

  • USERDATA-EAP-TLS.xml

  • Wired-WinPE-EAP-TLS.xml

• Your root certificate, saved as RootCert.cer

• Any subordinate CA certificates, saved as SubCACert.cer

• Your User Certificate pfx, saved as Usercert.pfx

• The x86 or x64 versions of certutil.exe and certutil.exe.mui from a Windows 7-based computer, depending on architecture of your Windows PE image

NoteThe following example builds an x86 version of Windows PE.

On a Windows 7-based, Windows Server 2008-based, or Windows Server 2008 R2-based computer, install the Windows 7 AIK.

1. On your technician computer, click Start, point to All Programs, point to Windows AIK, right-click Deployment Tools Command Prompt, and then click Run as administrator.
   
   The menu shortcut opens a Command Prompt window and automatically sets environment variables to point to all the necessary tools. By default, all tools are installed in the C:\Program Files\Windows AIK\Tools folder.

2. At the command prompt, run the Copype.cmd script. The script requires two arguments: hardware architecture and destination location.
   
   For example, run copype.cmd <architecture> <destination>, where <architecture> can be x86, amd64, or ia64, and <destination> is the path of the local directory.
   
   For example, run this command:

   copype.cmd x86 c:\winpe_x86The script creates the following directory structure and copies all the necessary files for that architecture:

   \winpe_x86
   \winpe_x86\ISO
   \winpe_x86\mount

3. Copy the base image (Windows PE.wim) into the \Winpe_x86\ISO\sources folder, and rename the file to boot.wim.

   copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim

4. Mount the base Windows PE image. In this step, you mount the base image to a local directory so that you can add or remove packages.

   Dism /Mount-Wim /WimFile:C:\winpe_x86\ISO\sources\boot.wim /index:1 /MountDir:C:\winpe_x86\mount

5. Add the following packages to the image. Be aware that each command should be a single line, and the command must not wrap.
   
   Add WINPE-WMI package

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-wmi.cab"
   
   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\winpe-wmi_en-us.cab" 

   Add WINPE-Scripting package

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-scripting.cab"
   
   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\winpe-scripting_en-us.cab" 

   Add WINPE-HTA package

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-hta.cab"
   
   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\winpe-hta_en-us.cab"

6. Extract the contents of the 394904_intl_i386_zip.exe update to the c:\972831 folder.
   

7. Add the update for 802.1X support to the image:

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"c:\972831\Windows6.1-KB972831-86.cab" 

8. Create a folder to contain additional files for 802.1X support. To do this, run the following command:

   md C:\winpe_x86\mount\winpe

9. Copy certutil.exe and certutil.exe.mui from a Windows 7-based computer to the c:\winpe_x86\mount\winpe folder. These files can be found in the %windir%\system32 folder.
   
   Note You must copy the correct version of these files, based on the architecture of your Windows PE image.

10. Edit the Wired-WinPE-EAP-TLS.xml file, and change the following line to enter the Root CA certificate thumbprint/hash for the correct certification authority:

    <TrustedRootCA>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</TrustedRootCA> 

11. Copy your connection profile to the Windows PE directory by using EAP-TLS:

    Copy Wired-WinPE-EAP-TLS.xml C:\winpe_x86\mount\winpe 

12. Edit the USERDATA-EAP-TLS.xml file, and change the following lines for Username and UserCert:

    <eapTls:Username>contoso\username</eapTls:Username>
    
    <eapTls:UserCert>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</eapTls:UserCert>

13. Copy your connection profile to the Windows PE directory by using EAP-TLS:

    copy USERDATA-EAP-TLS.xml C:\winpe_x86\mount\winpe 

14. Copy your root certificate and any subordinate CA certificates to the c:\winpe_x86\mount\winpe folder.

15. Copy your User Certificate pfx to the c:\winpe_x86\mount\winpe folder.

16. Edit StartDot3.vbs file, and change the following line:

    certutil –user –p PASSWORD -importpfx \winpe\USERcert.pfx NOEXPORT,NOCHAIN 

    Note In this line, you must change PASSWORD to the password that was assigned to the certificate when it was exported.

17. Copy StartDot3.Vbs to the c:\winpe_x86\mount\winpe folder.

18. Edit startnet.cmd to run StartDot3.vbs automatically:

    notepad C:\winpe_x86\mount\windows\system32\startnet.cmd

19. Add .\winpe\StartDot3.vbs after the wpeinit command, and then save the startnet.cmd file.

20. Unmount and commit changes to the .WIM:

    Dism /Unmount-Wim /MountDir:C:\winpe_x86\mount /Commit

21. Create your bootable media by using the steps that are outlined in the Windows 7 AIK Help file under the following topics:

    • "To create a bootable CD-ROM"

    • "To create a bootable UFD"

‘================================
‘StartDot3.VBS
‘================================
Dim WshShell
Set WshShell = CreateObject("WScript.Shell")

commandLine = "certutil -addstore Root \winpe\Rootcert.cer"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "certutil -addstore CA \winpe\SubCAcert.cer"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "certutil –user –p PASSWORD -importpfx \winpe\USERcert.pfx NOEXPORT,NOCHAIN"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "net start dot3svc"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "netsh lan add profile filename=\winpe\Wired-WinPE-EAP-TLS.xml"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "netsh lan set eapuserdata filename=\winpe\Wired-WinPE-UserData-EAP-TLS.xml allusers=yes interface=*"
Return  = WshShell.Run(commandLine, 0, true)

<?xml version="1.0"?>
<EapHostUserCredentials xmlns="http://www.microsoft.com/provisioning/EapHostUserCredentials" xmlns:eapCommon="http://www.microsoft.com/provisioning/EapCommon" xmlns:baseEap="http://www.microsoft.com/provisioning/BaseEapMethodUserCredentials">
 <EapMethod>
  <eapCommon:Type>13</eapCommon:Type>
  <eapCommon:AuthorId>0</eapCommon:AuthorId>
 </EapMethod>
 <Credentials xmlns:eapUser="http://www.microsoft.com/provisioning/EapUserPropertiesV1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:baseEap="http://www.microsoft.com/provisioning/BaseEapUserPropertiesV1" xmlns:eapTls="http://www.microsoft.com/provisioning/EapTlsUserPropertiesV1">
  <baseEap:Eap>
  <baseEap:Type>13</baseEap:Type>
   <eapTls:EapType>
    <eapTls:Username>contoso\username</eapTls:Username>
    <eapTls:UserCert>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</eapTls:UserCert>
   </eapTls:EapType>
  </baseEap:Eap>
 </Credentials>
</EapHostUserCredentials>

<?xml version="1.0"?>
<LANProfile xmlns="http://www.microsoft.com/networking/LAN/profile/v1">
 <MSM>
  <security>
   <OneXEnforced>false</OneXEnforced>
   <OneXEnabled>true</OneXEnabled>
   <OneX xmlns="http://www.microsoft.com/networking/OneX/v1">
    <authMode>user</authMode>
    <EAPConfig><EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod>
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type>
<VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId>
<VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType>
<AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId>
</EapMethod>
<Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
<Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>13</Type>
<EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1">
<CredentialsSource>
<CertificateStore>
<SimpleCertSelection>true</SimpleCertSelection>
</CertificateStore>
</CredentialsSource>
<ServerValidation>
<DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation>
<ServerNames></ServerNames>
<TrustedRootCA>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</TrustedRootCA>
</ServerValidation>
<DifferentUsername>false</DifferentUsername>
<PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation>
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</AcceptServerName>
</EapType>
</Eap>
</Config>
</EapHostConfig>
</EAPConfig>
   </OneX>
  </security>
 </MSM>
</LANProfile>

References

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.