Configuring WinXP built-in wireless client for PEAP+MSCHAPv2 (v3.0, 27th Feb 2014)

Described here are the steps involved in configuring the built-in wireless client under Windows XP to use eduroam, authenticating via PEAP+MSCHAPv2. Your home site will be able to tell you whether PEAP+MSCHAPv2 is the appropriate authenticiation method that you should use.

Wherever you see the icon in the instructions below you can click on the text beside it to display further information and click on it again to hide the detailed text once more. Click on an image to open a larger version in a new browser window.

Information you will need

To complete these instructions you'll need some information specific to your home site/organisation, plus your own credentials, as listed below. If any of the details in your wifi profile are incorrect then your authentication will fail and you will not gain wifi access via eduroam. The IT department of your home site will be able to provide you with these details:

Information requiredSample string in the instructions below
Your home site's domain name as would appear in, for example, your e-mail address e.g.
[OPTIONAL] The name of the CA certificate used by your home site for eduroam. You will not require this if your site is using a public CA which is already defined within your wireless client.GTE CyberTrust Global Root
[OPTIONAL] A file containing the actual CA certificate used by your site for eduroam. You will not require this if your site is using a public CA which is already defined within your wireless client.cacert.crt
The name on the SSL certificate presented by the authentication server at your home site e.g.
The username you use to authenticate against your home account. Note the inclusion of your domain name e.g.
The password you use to authenticate against your home account.mypassword

Configuration instructions

The instructions below are broken into two sections:

Notes on the built-in wireless client under WinXP

Create a wifi profile

Follow these steps to create your eduroam wifi profile:

  1. If your home site has provided you with a file containing a CA certificate then you will need to install it here, otherwise skip to the next step.

    Installing the CA certificate

    Further info on CA certificate

  2. Double-click on the application icon in the tray.
    Click View Wireless Networks.
  3. Click Change advanced settings.
  4. Click on the Wireless Networks tab.
  5. Click Add...
  6. Define the profile general details:
    Network name (SSID): eduroam
    Select Connect even if this network is not broadcasting
    Network Authentication: WPA2
    Data Encryption: AES
    Un-select This is a computer-to-computer (ad hoc) network; wireless access points are not used

    Click on the Authentication tab.

  7. Define the authentication method:
    EAP type: Protected EAP (PEAP)
    Un-select Authenticate as computer when computer information is available
    Un-select Authenticate as guest when user or computer information is unavailable

    Click Properties

  8. Define your server security details:
    Select Validate Server Certificate
    Select Connect to these
    Trusted Root Certification Authorities: Select the appropriate CA entry for your home site from the list.
    Select Do not prompt user to authorize new servers or trusted certification authorities.
    Select Authentication Method:Secured password (EAP-MSCHAP v2)
    Select Enable Fast Reconnect
    Un-select Enable Quarantine checks
    Un-select Disconnect if server does not present cryptobinding TLV

    Further info on server identity

    Click Configure...

  9. Define your EAP MSCHAPv2 properties:
    Un-select Automatically use my Windows logon name and password (and domain if any)

    Click OK
    Click OK again.

  10. Click on the Connection tab.
  11. Define automatic connection mode:
    Select Connect when this network is in range

    Click OK

  12. You can make eduroam your preferred network by highlighting the eduroam entry and using the Move Up button to move it to the top of the list of preferred networks.

    Click OK

  13. Your wireless client is now configured to avail of eduroam and should connect automatically when at a site where the eduroam service is available.

    Using eduroam for the first time

    When your wireless client connects to eduroam for the first time you will be required to provide your credentials.

    1. Click on the prompt which appears in the task bar.
    2. Provide your credentials:
      User name:
      Password: mypassword
      Logon domain: Leave blank

      Further info on credential settings

      Click OK