Running PEAP with Cisco Aeronet 1231G and Cisco Wireless IP Phone 7925G

To run WiFi with WPA and PEAP using Cisco Aeronet and Windows IAS/NPS, you need the following:

• Cisco Aeronet Access Point
• Windows Server (2003/2008) running IAS/NPS as the Radius server
• Server authentication certificate (commercial or self-signed)

Setting the Access Point

Login to the access point using HTTP/HTTPS, navigate to Security - Server Manager

Create a new radius server, point it to the Windows IAS/NPS (installed later). Speficy the shared secret and port for authentication and accounting

Set the default server priorities to or the new Radius server's IP address you just added

Navigate to Security - SSID Manager

Create a new SSID, attach it to the VLAN and tick the Radio checkbox

For Client Authentication Settings, tick Open Authentication with EAP and Network EAP. Change the Server Priorities to Customize or use defaults

For Client Authentication Key Management, select Mandatory for Key Management and tick WPA

SSID Settings. (optional) select Multiple SSID if you are running this SSID as multiple SSID

Navigate to Security - Encryption Manager

Select Encryption Modes to Chipher with AES CCMP + TKIP

Select Encryption Keys to Key 2 and let the value blank

Setting IAS/NPS

Once the NPS installed, run the wizard to setup the Wireless network.
We need to add a radius client which is the IP address of the Cisco Access Point

Navigate to Advancced tab, select the vendor name to Cisco

Navigate to Policies and select Connection Request Policies. Select the Secure Wireless Policy

Most of the following settings are the default value

Navigate to Use Windows authentication for all users. The following settings are having the default value

Navigate to Secure Wireless Connections. The following settings are having the default value

We specify which AD Security Group has access to this policy

Up to this stage, you need to import a server authentication certificate. This can be a commercial certificate or self-signed certificate. If you use self-signed certificate, you need to make sure the clients machine that is going to connect to this WiFi must trust the Root CA who generate this certificate

Select Microsoft Protected EAP (PEAP) and select Edit

If you have the certificate installed correctly, you should see the option which certificate you want to use

On the Settings tab

Change Windows Task Folder Permission

1. Copy the tasks folder

XCOPY C:\WINDOWS\TASKS c:\temp /s /e /k /o

2. Go to Windows Explorer and change the c:\temp permission to whatever you like
3. Display the folder permission

CACLS C:\temp /s

4. Copy the SDDL string - the one between the quotes
5. Apply the permisison to the tasks folder

CACLS C:\Windows\Tasks /s:

NTVDM.EXE

For the last 2 weeks, I was stuck with trying to run old MS-DOS application on Windows 2003. It was previously ran on Windows 2000 fine, no problem at all. Suddenly when we migrated this app to Windows 2003, users start complaining that the application randomly freezes on them...

We tried everything we could think of, like setting up the compatibility layer on the batch file before running the app, e.g.

set __COMPAT_LAYER=Win2000 DisableThemes

it did not work...

Finally, we found the solution, it appears that the ntvdm.exe process is running on multiprocessors - which does not work for this particular MS-DOS app. So we need to tell the ntvdm.exe process to run only on uni-processor. To do that:

- backup your original ntvdm.exe file (c:\windows\system32)
- find and download imagecfg.exe (google it)
- copy the ntvdm.exe from the location above to a temp folder
- run: imagecfg.exe -u ntvdm.exe in the temp folder
- copy this new ntvdm.exe to system32, dllcache, servicepack\i386 folders, otherwise the Windows File Protection will replace your modified ntvdm.exe file with the original one
- test it, you will see only a single processor will be used to run ntvdm.exe

Printer Queue Stuck

After printing a job, the print indicator window only goes to 99% and the job never completes itself, although the paper spits out and it is finished. If you try to then print another job, it won't print because it thinks the first job isn't done (but it is).

When you try to open the queue, the first document says "Deleting- printed". It's almost like it's stuck at deleting the old job.

Do this:
- Stop the "Print Spooler" service.
- Delete all the existing print spool files. (Stored in "C:\WINDOWS\system32\spool\PRINTERS" by default).
- Start the "Print Spooler" service.
- Right-click the printer's icon in the Printers and Faxes folder and choose Properties.
- Click the Advanced tab.
- Click the Print Processor... button.
- Make a note of the existing "Print processor" selection on the left (in case you need to revert it.). Then change it to "WinPrint". Click OK.
- Click OK on the printer's properties window.
- Try sending a print job to see whether it persists in the print queue.