IAS : Only validate certificate, not AD account !

hello,

i use ias & eap/tls authenticate computers (not users !) connecting wireless network. these computers not in ad domain. got computers certificates generated standalone ca.
these computers not have ad accounts, "hotspot" computers.

 

ias use validate revocation state of computer certificate trying connect network.
if certificate revoked, client cannot connect network. if certificate valid, access granted.

but ias not friendly me …i have set eap / “wireless connection type” access policy rule in ias, nothing relating domain user/group.

the problem ias still trying authenticate certificate name a  user through active directory (ias on domain controller).
and username quite strange : host/certificatename (the “host/” part of username, not domain prefix. seems telling computer authentication)… , don’t have user (and in ways, cannot create user “/” in username), ias denied connection request.

 

do know how rid of windows authentication , validate certificate revocation state ?

 

thanks all,

guillaume

problem resolved :
- applying realm rule in ias access policy delete "host/" username authenticated
- applying radius attribute "ignore-user-dialin-properties"
- applying kb915832 on clients (http://support.microsoft.com/kb/915832)
- creating ad account name certificate subject
- placing root certificate in computer store on clients
- checking server certificate validation in eap/tls wireless configuration on clients using root certificate bellow

i not able totaly avoid ad authentication ...

Windows Server  >  Network Access Protection