Chapter 12: Networking Your Computer 201
Group Policy settings in Windows Vista allow administrators to configure lists of allowed and
denied wireless network names. With an allow list, administrators can specify by name the set
of wireless networks to which wireless clients are allowed to connect, thereby limiting wireless
connections to a specific set of wireless networks. With a deny list, administrators can specify
by name the set of wireless networks to which wireless clients are not allowed to connect and
in this way prevent connections to known unsecured wireless networks as well as to any other
wireless networks that might be available but should not be used.
Using Fast Roaming and Auto Configuration
with Wireless Connections
Through Group Policy settings, administrators can also configure fast roaming and automatic
connections on preferred wireless networks. With fast roaming, wireless clients can more
quickly roam from one wireless access point to another by using preauthentication and Pair-
wise Master Key (PMK) caching. With automatic connections, wireless clients can establish
connections automatically when preferred networks are detected. If you don’t want to use
automatic connections, you can specify that manual connections should be used instead.
Wireless Auto Configuration is a service that dynamically selects the wireless network to
which the computer will automatically connect, based either on your preferences or on default
settings. This includes automatically selecting and connecting to a more preferred wireless
network when it becomes available.
Wireless Auto Configuration in Windows Vista helps to protect computers running Windows
Vista from attackers. As with earlier versions of Windows, a computer running Windows Vista
uses a randomly named wireless network if no preferred network is available and periodically
scans for a preferred network to become available. Unlike earlier versions of Windows, Win-
dows Vista prevents a wireless connection to a wireless network matching the random wire-
less network name. Further, because Windows Vista attempts to connect preferred networks
in the order specified, you can connect to a hidden network before a nonhidden network if the
hidden network is higher in the preferred network list.
Wireless connections also support integration with Network Access Protection (NAP) when
using 802.1X authentication and Single Sign-On profiles. Using Network Access Protection
and 802.1X authentication, administrators can prevent wireless clients that do not comply
with system health requirements from gaining unlimited access to a private network. With
Single Sign-On profiles, administrators can ensure that only an appropriate user or device is
allowed on the protected network and that their data is secure when establishing the connec-
tion as well as once the connection is established.
When a Single Sign-On profile is configured, 802.1X authentication is used prior to the com-
puter logon to the domain and users are prompted for credential information only if needed.
This ensures that the wireless connection is established prior to the computer domain logon,
which enables scenarios that require network connectivity prior to user logon such Group
Policy updates, wireless client domain joins, and execution of logon scripts.
C12622841.fm Page 201 Wednesday, May 17, 2006 1:55 PM
To Next Page
Loading...
Need help?
General
