From c0ce8971f2b1ce4146608a15f81cda8f5030a0a5 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Tue, 13 May 2025 11:49:46 -0700 Subject: [PATCH 01/12] Update wifi-csp.md with correct SSID/Profile info --- windows/client-management/mdm/wifi-csp.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 5a09b0e1ee..02e7965eff 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -16,10 +16,9 @@ The WiFi configuration service provider provides the functionality to add or del Programming considerations: -- If the authentication method needs a certificate, for example, EAP-TLS requires client certificates, you must configure it through the CertificateStore configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. +- If the authentication method needs a certificate, (e.g. client certificates for EAP-TLS), you must configure it through the [CertificateStore](./certificatestore-csp) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device. -- The SSID of the Wi-Fi network part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all non-ASCII characters must be escaped using a %-character. Unicode characters without the necessary escaping aren't supported. -- The `name_goes_here\` must match `name_goes_here`. +- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all non-excluded ASCII characters must be escaped using a %-character. This includes replacing the space character with `%20`. Characters (including Unicode) without the necessary escaping aren't supported. - For the WiFi CSP, you can't use the Replace command unless the node already exists. - Using ProxyPacUrl or ProxyWPAD in Windows 10 client editions (Home, Pro, Enterprise, and Education) will result in failure. @@ -108,9 +107,13 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added -Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. +Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is what's used when applied to the system. -SSID is the name of network you're connecting to, while Profile name is the name of the Profile that contains the WiFi settings information. If the Profile name isn't set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, `./Vendor/MSFT/WiFi/Profile//WlanXml`. +> [!NOTE] +> This field is the Profile Name that will appear as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ` `. This value MAY be different from the SSID of the actual network being broadcast (which is under ` `). + +> [!IMPORTANT] +> If the Profile name isn't set correctly in the MDM SyncML, as per the information in the Wi-Fi settings XML (``, it could lead to some unexpected errors. In other words, if the profile is `Contoso Wi-Fi{...}`, the MDM SyncML must be `./Vendor/MSFT/WiFi/Profile/Contoso%20Wi-Fi/WlanXml`. From 6f40d5aadaa770bdb7940416b8a07af488b9bdd1 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Tue, 13 May 2025 15:05:01 -0700 Subject: [PATCH 02/12] More updates --- windows/client-management/mdm/wifi-csp.md | 64 ++++++++++------------- 1 file changed, 29 insertions(+), 35 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 02e7965eff..476762d285 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,7 +1,7 @@ --- title: WiFi CSP description: Learn more about the WiFi CSP. -ms.date: 03/12/2025 +ms.date: 05/13/2025 ms.topic: generated-reference --- @@ -16,11 +16,11 @@ The WiFi configuration service provider provides the functionality to add or del Programming considerations: -- If the authentication method needs a certificate, (e.g. client certificates for EAP-TLS), you must configure it through the [CertificateStore](./certificatestore-csp) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. +- If the authentication method needs a certificate (for example, client certificates for EAP-TLS), you must configure it through the [CertificateStore](./certificatestore-csp) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device. -- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all non-excluded ASCII characters must be escaped using a %-character. This includes replacing the space character with `%20`. Characters (including Unicode) without the necessary escaping aren't supported. +- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character. This includes replacing the space character (` `) with `%20`. Characters (including Unicode) without the necessary escaping aren't supported. - For the WiFi CSP, you can't use the Replace command unless the node already exists. -- Using ProxyPacUrl or ProxyWPAD in Windows 10 client editions (Home, Pro, Enterprise, and Education) will result in failure. +- Using ProxyPacUrl or ProxyWPAD in Windows client editions (Home, Pro, Enterprise, and Education) will result in failure. @@ -52,7 +52,7 @@ The following list shows the WiFi configuration service provider nodes: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -91,7 +91,7 @@ Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -110,10 +110,10 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is what's used when applied to the system. > [!NOTE] -> This field is the Profile Name that will appear as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ` `. This value MAY be different from the SSID of the actual network being broadcast (which is under ` `). +> This field is the Profile Name that appears as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ` `. This value MAY be different from the SSID of the actual network being broadcast (which is under ` `). > [!IMPORTANT] -> If the Profile name isn't set correctly in the MDM SyncML, as per the information in the Wi-Fi settings XML (``, it could lead to some unexpected errors. In other words, if the profile is `Contoso Wi-Fi{...}`, the MDM SyncML must be `./Vendor/MSFT/WiFi/Profile/Contoso%20Wi-Fi/WlanXml`. +> If the Profile name isn't set correctly in the MDM SyncML, as per the information in the Wi-Fi settings XML (``), it could lead to some unexpected errors. In other words, if the profile is `Contoso Wi-Fi{...}`, the MDM SyncML must be `./Vendor/MSFT/WiFi/Profile/Contoso%20Wi-Fi/WlanXml`. @@ -138,7 +138,7 @@ Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, co | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -187,7 +187,7 @@ Allows for defining which administrative entity is setting this Wi-Fi profile. T | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -226,7 +226,7 @@ Optional node. The format is url:port. Configuration of the network proxy (if an | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -243,7 +243,7 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will result in failure. @@ -267,7 +267,7 @@ Optional node. URL to the PAC file location. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -284,7 +284,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will result in failure. @@ -317,7 +317,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -367,7 +367,7 @@ Optional node. If the policy is active selecting one of the values from the foll | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -414,7 +414,7 @@ If it exists in the blob, the **keyType** and **protected** elements must come b | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -453,7 +453,7 @@ Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -469,9 +469,7 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added -Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. - -SSID is the name of network you're connecting to, while Profile name is the name of the Profile that contains the WiFi settings information. If the Profile name isn't set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, `./Vendor/MSFT/WiFi/Profile//WlanXml`. +See [Device/Profile/{SSID}](#deviceprofilessid) for more information. @@ -496,7 +494,7 @@ SSID is the name of network you're connecting to, while Profile name is the name | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -545,7 +543,7 @@ Allows for defining which administrative entity is setting this Wi-Fi profile. T | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -584,7 +582,7 @@ Optional node. The format is url:port. Configuration of the network proxy (if an | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -601,7 +599,7 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will result in failure. @@ -625,7 +623,7 @@ Optional node. URL to the PAC file location. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -642,7 +640,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows 10 client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will result in failure. @@ -675,7 +673,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -725,7 +723,7 @@ Optional node. If the policy is active selecting one of the values from the foll | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -743,12 +741,8 @@ Link to schema: -The profile XML must be escaped, as shown in the examples below. -If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](/windows/win32/nativewifi/wpa2-personal-profile-sample). - -> [!NOTE] -> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the EapHostConfig portion of the WlanXML. For more information, see [EAP configuration](./eap-configuration.md). +See [Device/Profile/{SSID}/WlanXml](#deviceprofilessidwlanxml) for more information. @@ -790,7 +784,7 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor chr - MyNetwork412D4D534654574C414EMyNetworkfalseESSmanualWPA2AEStrueuser2500025truetruefalse26falsefalsefalsefalsefalse + MyNetwork412D4D534654574C414EMyNetworkfalseESSmanualWPA2AEStrueuser2500025truetruefalse26falsefalsefalsefalsefalse From ada61ec6eb809e4edaa61fef3e9e5c5206c899b3 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Tue, 13 May 2025 23:36:04 -0700 Subject: [PATCH 03/12] Update EAP and WiFi CSP documentation --- .../mdm/eap-configuration.md | 10 ++- windows/client-management/mdm/wifi-csp.md | 82 ++++++++++++------- 2 files changed, 59 insertions(+), 33 deletions(-) diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index cb42cb7572..f5e211ef20 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -1,12 +1,12 @@ --- title: EAP configuration -description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows 10. +description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows. ms.date: 06/26/2017 --- # EAP configuration -This article provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including information about EAP certificate filtering in Windows 10. +This article provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including information about EAP certificate filtering in Windows. While the screenshots are specifically for VPN, the EAP portions are applicable to Wi-Fi and Wired EAP profiles as well. For more information, see [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles). ## Create an EAP configuration XML for a VPN profile @@ -292,6 +292,8 @@ Alternatively, you can use the following procedure to create an EAP configuratio > [!NOTE] > You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) article. -## Related topics +## Related articles -[Configuration service provider reference](index.yml) +* [Configuration service provider reference](index.yml) +* [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +* [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) \ No newline at end of file diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 476762d285..af47398d61 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -138,7 +138,7 @@ Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, co | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -390,7 +390,7 @@ The profile XML must be escaped, as shown in the examples below. If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](/windows/win32/nativewifi/wpa2-personal-profile-sample). > [!NOTE] -> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the EapHostConfig portion of the WlanXML. For more information, see [EAP configuration](./eap-configuration.md). +> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the WlanXml ([WLANProfile](/windows/win32/nativewifi/wlan-profileschema-elements) > [MSM](/windows/win32/nativewifi/wlan-profileschema-msm-wlanprofile-element) > [security](/windows/win32/nativewifi/wlan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [WPA2-Enterprise with TLS profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-tls-profile-sample). @@ -404,6 +404,7 @@ If it exists in the blob, the **keyType** and **protected** elements must come b +See [Add a network](#add-a-network) for examples. @@ -494,7 +495,7 @@ See [Device/Profile/{SSID}](#deviceprofilessid) for more information. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | @@ -768,7 +769,7 @@ These XML examples show how to perform various tasks using OMA DM. ### Add a network -The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork'. +The following example shows how to add a WPA2-Enterprise network with SSID and profile name `MyNetwork` that authenticates with PEAP-MSCHAPv2. ```xml @@ -784,7 +785,7 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor chr - MyNetwork412D4D534654574C414EMyNetworkfalseESSmanualWPA2AEStrueuser2500025truetruefalse26falsefalsefalsefalsefalse + MyNetwork4d794e6574776f726bMyNetworkfalseESSmanualWPA2AEStrueuser2500025truetruefalse26falsefalsefalsefalsefalse]]> @@ -793,6 +794,49 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor ``` +The following example shows how to add a WPA3-Enterprise network with profile name `My Network` and SSID `MySSID` that authenticates with EAP-TLS. + +> [!IMPORTANT] +> Notice how the space is %-escaped in the `LocURI` and unescaped in the `WLANProfile` > `name`. + +```xml + + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/My%20Network/WlanXml + + + chr + + My NetworkMySSIDESSautoWPA3ENTAEStrueenabled720128disabledmachine1300013truetrue00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff 00 11 22 33falsetruefalsefalse00112233445566778899aabbccddeeff00112233Client Authentication1.3.6.1.5.5.7.3.2Client Authentication]]> + + + +``` + +The following example shows how to add a WPA3-Personal (transition mode) network with profile name and SSID `MyNetwork` that includes the passphrase `TestPassword1!`. + +```xml + + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml + + + chr + + MyNetworkMyNetworkESSautoWPA3SAEAESfalsetruepassPhrasefalseTestPassword1!]]> + + + +``` + ### Query network profiles The following example shows how to query Wi-Fi profiles installed on an MDM server. @@ -825,7 +869,7 @@ The following example shows the response. ### Remove a network -The following example shows how to remove a network with SSID 'MyNetwork' and no proxy. Removing all network authentication types is done in this same manner. +The following example shows how to remove a network with SSID `MyNetwork` and no proxy. Removing all network authentication types is done in this same manner. ```xml @@ -840,32 +884,12 @@ The following example shows how to remove a network with SSID 'MyNetwork' and no ``` - -### Add a network and certification authority for a server certificate - -The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork' and root CA validation for server certificate. - -```xml - - 300 - - 301 - - - ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml - - - chr - - MyNetworkMyNetworkfalseESSmanualWPA2AEStrueuser2500025true InsertCertThumbPrintHere truefalse26falsefalsefalsetruefalse - - - -``` ## Related articles -[Configuration service provider reference](configuration-service-provider-reference.md) +* [Configuration service provider reference](configuration-service-provider-reference.md) +* [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +* [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) \ No newline at end of file From 0fbc401dd205dcc11dacbb3feea461b2dbcdcb6e Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Tue, 13 May 2025 23:46:32 -0700 Subject: [PATCH 04/12] Acrolinx --- windows/client-management/mdm/wifi-csp.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index af47398d61..3898c4cc25 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -18,9 +18,9 @@ Programming considerations: - If the authentication method needs a certificate (for example, client certificates for EAP-TLS), you must configure it through the [CertificateStore](./certificatestore-csp) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device. -- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character. This includes replacing the space character (` `) with `%20`. Characters (including Unicode) without the necessary escaping aren't supported. +- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character, including replacing the space character (` `) with `%20`. Characters (including Unicode) without the necessary escaping aren't supported. - For the WiFi CSP, you can't use the Replace command unless the node already exists. -- Using ProxyPacUrl or ProxyWPAD in Windows client editions (Home, Pro, Enterprise, and Education) will result in failure. +- Using `ProxyPacUrl` or `ProxyWPAD` in Windows client editions (Home, Pro, Enterprise, and Education) will fail. @@ -107,7 +107,7 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added -Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is what's used when applied to the system. +Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is used inside the system. > [!NOTE] > This field is the Profile Name that appears as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ` `. This value MAY be different from the SSID of the actual network being broadcast (which is under ` `). @@ -243,7 +243,7 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will fail. @@ -284,7 +284,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will fail. @@ -385,7 +385,7 @@ Link to schema: -The profile XML must be escaped, as shown in the examples below. +The profile XML must be escaped, as shown in the following examples. If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](/windows/win32/nativewifi/wpa2-personal-profile-sample). @@ -470,7 +470,7 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added -See [Device/Profile/{SSID}](#deviceprofilessid) for more information. +For more information, see [Device/Profile/{SSID}](#deviceprofilessid). @@ -600,7 +600,7 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will fail. @@ -641,7 +641,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will result in failure. +> Don't use. Using this configuration in Windows client editions will fail. @@ -743,7 +743,7 @@ Link to schema: -See [Device/Profile/{SSID}/WlanXml](#deviceprofilessidwlanxml) for more information. +For more information, see [Device/Profile/{SSID}/WlanXml](#deviceprofilessidwlanxml). From 22c483af5ccef72aef4809e748515e91ac9ac802 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Tue, 13 May 2025 23:57:03 -0700 Subject: [PATCH 05/12] WiredNetwork CSP --- .../client-management/mdm/wirednetwork-csp.md | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index 25003242b3..7d03ef8177 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -1,7 +1,7 @@ --- title: WiredNetwork CSP description: Learn more about the WiredNetwork CSP. -ms.date: 03/12/2025 +ms.date: 05/14/2025 ms.topic: generated-reference --- @@ -32,7 +32,7 @@ The following list shows the WiredNetwork configuration service provider nodes: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -72,7 +72,7 @@ Enable block period (minutes), used to specify the duration for which automatic | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -88,6 +88,11 @@ XML describing the wired network configuration and follows the LAN_profile schem +The profile XML must be escaped, as shown in the following examples. + +> [!NOTE] +> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the LAN profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the LanXML ([LANProfile](/windows/win32/nativewifi/lan-profileschema-schema) > [MSM](/windows/win32/nativewifi/lan-profileschema-msm-lanprofile-element) > [security](/windows/win32/nativewifi/lan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). + @@ -101,6 +106,7 @@ XML describing the wired network configuration and follows the LAN_profile schem +See [Examples](#examples). @@ -111,7 +117,7 @@ XML describing the wired network configuration and follows the LAN_profile schem | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -151,7 +157,7 @@ Enable block period (minutes), used to specify the duration for which automatic | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | @@ -167,6 +173,7 @@ XML describing the wired network configuration and follows the LAN_profile schem +For more information, see [Device/LanXML](#devicelanxml). @@ -188,7 +195,7 @@ XML describing the wired network configuration and follows the LAN_profile schem ## Examples -The following example shows how to add a wired network profile: +The following example shows how to add a wired network profile that authenticates with PEAP-MSCHAPv2: ```xml @@ -202,7 +209,7 @@ The following example shows how to add a wired network profile: chr - falsetrue2500025falsetruefalse26falsefalsefalsetruefalsetrue + falsetrue2500025falsetruefalse26falsefalsefalsetruefalsetrue]]> @@ -214,4 +221,6 @@ The following example shows how to add a wired network profile: ## Related articles -[Configuration service provider reference](configuration-service-provider-reference.md) +* [Configuration service provider reference](configuration-service-provider-reference.md) +* [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +* [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) From 0891babae4631a6af2928f171b29ea9d72a1b894 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Wed, 14 May 2025 14:17:39 -0700 Subject: [PATCH 06/12] Correct samples --- windows/client-management/mdm/wifi-csp.md | 2 +- windows/client-management/mdm/wirednetwork-csp.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 3898c4cc25..0e3c6924c0 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -390,7 +390,7 @@ The profile XML must be escaped, as shown in the following examples. If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](/windows/win32/nativewifi/wpa2-personal-profile-sample). > [!NOTE] -> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the WlanXml ([WLANProfile](/windows/win32/nativewifi/wlan-profileschema-elements) > [MSM](/windows/win32/nativewifi/wlan-profileschema-msm-wlanprofile-element) > [security](/windows/win32/nativewifi/wlan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [WPA2-Enterprise with TLS profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-tls-profile-sample). +> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the WlanXml ([WLANProfile](/windows/win32/nativewifi/wlan-profileschema-elements) > [MSM](/windows/win32/nativewifi/wlan-profileschema-msm-wlanprofile-element) > [security](/windows/win32/nativewifi/wlan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [Wireless profile samples](/windows/win32/nativewifi/wireless-profile-samples). diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index 7d03ef8177..84a2b1dac2 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -91,7 +91,7 @@ XML describing the wired network configuration and follows the LAN_profile schem The profile XML must be escaped, as shown in the following examples. > [!NOTE] -> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the LAN profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the LanXML ([LANProfile](/windows/win32/nativewifi/lan-profileschema-schema) > [MSM](/windows/win32/nativewifi/lan-profileschema-msm-lanprofile-element) > [security](/windows/win32/nativewifi/lan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). +> If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the LAN profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the LanXML ([LANProfile](/windows/win32/nativewifi/lan-profileschema-schema) > [MSM](/windows/win32/nativewifi/lan-profileschema-msm-lanprofile-element) > [security](/windows/win32/nativewifi/lan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [Wired Profile Samples](/windows/win32/nativewifi/wired-profile-samples). From 3646b59da154464f0dfab7d9e774c6e3f816a973 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Wed, 14 May 2025 17:33:16 -0700 Subject: [PATCH 07/12] Point to samples --- windows/client-management/mdm/wifi-csp.md | 13 +++++++------ windows/client-management/mdm/wirednetwork-csp.md | 9 +++++---- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 0e3c6924c0..3e1f76f26f 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -769,7 +769,7 @@ These XML examples show how to perform various tasks using OMA DM. ### Add a network -The following example shows how to add a WPA2-Enterprise network with SSID and profile name `MyNetwork` that authenticates with PEAP-MSCHAPv2. +The following example shows how to add a WPA2-Enterprise network with SSID and profile name `MyNetwork` that authenticates with PEAP-MSCHAPv2. This example is based on the sample profile at [WPA2-Enterprise with PEAP-MSCHAPv2 profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-peap-mschapv2-profile-sample). ```xml @@ -794,7 +794,7 @@ The following example shows how to add a WPA2-Enterprise network with SSID and p ``` -The following example shows how to add a WPA3-Enterprise network with profile name `My Network` and SSID `MySSID` that authenticates with EAP-TLS. +The following example shows how to add a WPA3-Enterprise network with profile name `My Network` and SSID `MySSID` that authenticates with EAP-TLS. This example is based on the sample profile at [WPA2-Enterprise with TLS profile sample](/windows/win32/nativewifi/wpa2-enterprise-with-tls-profile-sample). > [!IMPORTANT] > Notice how the space is %-escaped in the `LocURI` and unescaped in the `WLANProfile` > `name`. @@ -817,7 +817,7 @@ The following example shows how to add a WPA3-Enterprise network with profile na ``` -The following example shows how to add a WPA3-Personal (transition mode) network with profile name and SSID `MyNetwork` that includes the passphrase `TestPassword1!`. +The following example shows how to add a WPA3-Personal (transition mode) network with profile name and SSID `MyNetwork` that includes the passphrase `TestPassword1!`. This example is based on the sample profile at [WPA3-Personal with transition mode profile sample](/windows/win32/nativewifi/wpa3-personal-transition-profile-sample). ```xml @@ -890,6 +890,7 @@ The following example shows how to remove a network with SSID `MyNetwork` and no ## Related articles -* [Configuration service provider reference](configuration-service-provider-reference.md) -* [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) -* [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) \ No newline at end of file +- [Wireless profile samples](/windows/win32/nativewifi/wireless-profile-samples) +- [Configuration service provider reference](configuration-service-provider-reference.md) +- [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +- [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index 84a2b1dac2..7b0d0d324b 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -195,7 +195,7 @@ For more information, see [Device/LanXML](#devicelanxml). ## Examples -The following example shows how to add a wired network profile that authenticates with PEAP-MSCHAPv2: +The following example shows how to add a wired network profile that authenticates with PEAP-MSCHAPv2. This example is based on the sample profile at [PEAP Profile Sample](/windows/win32/nativewifi/peap-profile-sample) ```xml @@ -221,6 +221,7 @@ The following example shows how to add a wired network profile that authenticate ## Related articles -* [Configuration service provider reference](configuration-service-provider-reference.md) -* [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) -* [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) +- [Wired profile samples](/windows/win32/nativewifi/wired-profile-samples) +- [Configuration service provider reference](configuration-service-provider-reference.md) +- [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) +- [Configure EAP profiles and settings in Windows](/windows-server/networking/technologies/extensible-authentication-protocol/configure-eap-profiles) From e124b57e258622555d7102833630bd363c46e695 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Wed, 14 May 2025 17:43:59 -0700 Subject: [PATCH 08/12] Update VPN authentication page to point to main doc page --- .../network-security/vpn/vpn-authentication.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md index 26a2c22a06..df5f510507 100644 --- a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md +++ b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md @@ -71,7 +71,7 @@ For a UWP VPN plug-in, the app vendor controls the authentication method to be u ## Configure authentication -See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EAP XML configuration. +See [EAP configuration](/windows/client-management/mdm/eap-configuration) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) for EAP XML configuration. >[!NOTE] >To configure Windows Hello for Business authentication, follow the steps in [EAP configuration](/windows/client-management/mdm/eap-configuration) to create a smart card certificate. [Learn more about Windows Hello for Business.](../../../identity-protection/hello-for-business/index.md). @@ -79,4 +79,3 @@ See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EA The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP). :::image type="content" source="images/vpn-eap-xml.png" alt-text="Screenshot showing EAP XML configuration in Intune profile."::: - From e7043e95c134b947ba61e2da5d66355599bf29ab Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Wed, 14 May 2025 17:45:32 -0700 Subject: [PATCH 09/12] Fix certstore csp link --- windows/client-management/mdm/wifi-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 3e1f76f26f..1fb9efc0a8 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -16,7 +16,7 @@ The WiFi configuration service provider provides the functionality to add or del Programming considerations: -- If the authentication method needs a certificate (for example, client certificates for EAP-TLS), you must configure it through the [CertificateStore](./certificatestore-csp) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. +- If the authentication method needs a certificate (for example, client certificates for EAP-TLS), you must configure it through the [CertificateStore](certificatestore-csp.md) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device. - The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character, including replacing the space character (` `) with `%20`. Characters (including Unicode) without the necessary escaping aren't supported. - For the WiFi CSP, you can't use the Replace command unless the node already exists. From 8f1e0f695aee4831190dbf10b25768c5bd115270 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Thu, 15 May 2025 11:29:40 -0700 Subject: [PATCH 10/12] Remove applicability (need to update in ddf instead) --- windows/client-management/mdm/wifi-csp.md | 30 +++++++++---------- .../client-management/mdm/wirednetwork-csp.md | 8 ++--- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 1fb9efc0a8..3c625c28f3 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -18,7 +18,7 @@ Programming considerations: - If the authentication method needs a certificate (for example, client certificates for EAP-TLS), you must configure it through the [CertificateStore](certificatestore-csp.md) configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS. - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device. -- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character, including replacing the space character (` `) with `%20`. Characters (including Unicode) without the necessary escaping aren't supported. +- The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character, including replacing the space character (' ') with '%20'. Characters (including Unicode) without the necessary escaping aren't supported. - For the WiFi CSP, you can't use the Replace command unless the node already exists. - Using `ProxyPacUrl` or `ProxyWPAD` in Windows client editions (Home, Pro, Enterprise, and Education) will fail. @@ -52,7 +52,7 @@ The following list shows the WiFi configuration service provider nodes: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | @@ -91,7 +91,7 @@ Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | @@ -187,7 +187,7 @@ Allows for defining which administrative entity is setting this Wi-Fi profile. T | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | @@ -226,7 +226,7 @@ Optional node. The format is url:port. Configuration of the network proxy (if an | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | @@ -267,7 +267,7 @@ Optional node. URL to the PAC file location. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | @@ -317,7 +317,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | @@ -367,7 +367,7 @@ Optional node. If the policy is active selecting one of the values from the foll | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | @@ -415,7 +415,7 @@ See [Add a network](#add-a-network) for examples. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | @@ -454,7 +454,7 @@ Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | @@ -544,7 +544,7 @@ Allows for defining which administrative entity is setting this Wi-Fi profile. T | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | @@ -583,7 +583,7 @@ Optional node. The format is url:port. Configuration of the network proxy (if an | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | @@ -624,7 +624,7 @@ Optional node. URL to the PAC file location. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | @@ -674,7 +674,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | @@ -724,7 +724,7 @@ Optional node. If the policy is active selecting one of the values from the foll | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index 7b0d0d324b..1b8f00d555 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -32,7 +32,7 @@ The following list shows the WiredNetwork configuration service provider nodes: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | @@ -72,7 +72,7 @@ Enable block period (minutes), used to specify the duration for which automatic | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | @@ -117,7 +117,7 @@ See [Examples](#examples). | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | @@ -157,7 +157,7 @@ Enable block period (minutes), used to specify the duration for which automatic | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later
✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | From eec8aa4601e8f8a31936dee4f9a6339d70ddf1e6 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Thu, 15 May 2025 14:13:56 -0700 Subject: [PATCH 11/12] fixes for md preview, add explicit example --- windows/client-management/mdm/wifi-csp.md | 39 ++++++++++++++++++++--- 1 file changed, 35 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 3c625c28f3..4d35e88454 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -107,13 +107,13 @@ The Profile name of the Wi-Fi network. This is added when WlanXml node is added -Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is used inside the system. +Specifies the Profile name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. In the URI, it must be %-escaped, but the non-%-escaped value is used inside the system. > [!NOTE] -> This field is the Profile Name that appears as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ` `. This value MAY be different from the SSID of the actual network being broadcast (which is under ` `). +> This field is the Profile Name that appears as a "Friendly Name" to the user and contains the Wi-Fi settings information. The non-%-escaped value must correspond to `` in ` `. + +The Profile name can be the same or different from the SSID of the actual network being broadcast (which is under ` `). For example, the broadcast SSID might be "CC_Corp_7" but the Profile name might be "ContosoWiFi". -> [!IMPORTANT] -> If the Profile name isn't set correctly in the MDM SyncML, as per the information in the Wi-Fi settings XML (``), it could lead to some unexpected errors. In other words, if the profile is `Contoso Wi-Fi{...}`, the MDM SyncML must be `./Vendor/MSFT/WiFi/Profile/Contoso%20Wi-Fi/WlanXml`. @@ -128,6 +128,32 @@ Specifies the Profile Name of the Wi-Fi network (32 bytes maximum) to create, co + +In the following example, the 'ContosoWiFi' Profile is added, targeting the 'CC_Corp_7' SSID. The rest of the profile is omitted for brevity - for complete examples, see [Add a network](#add-a-network). + +```xml + + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/ContosoWiFi/WlanXml + + + chr + + ContosoWiFiCC_Corp_7{...}]]> + + + +``` + +> [!IMPORTANT] +> If the Profile name isn't set correctly in the MDM SyncML, as per the information in the Wi-Fi settings XML (``), it could lead to some unexpected errors at runtime. In other words, if the profile is `Contoso Wi-Fi{...}`, the MDM SyncML must be `./Vendor/MSFT/WiFi/Profile/Contoso%20Wi-Fi/WlanXml`. +> +> In this example, if we instead had `./Vendor/MSFT/WiFi/Profile/CC_Corp_7/WlanXml`, the profile would be considered to be User provisioned, not MDM provisioned, which may cause users to connect to the wrong network. + @@ -244,6 +270,7 @@ Optional node. URL to the PAC file location. > [!NOTE] > Don't use. Using this configuration in Windows client editions will fail. + @@ -285,6 +312,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] > Don't use. Using this configuration in Windows client editions will fail. + @@ -391,6 +419,7 @@ If it exists in the blob, the **keyType** and **protected** elements must come b > [!NOTE] > If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the [EapHostConfig](/windows/win32/eaphost/eaphostconfigschema-eaphostconfig-element) portion of the WlanXml ([WLANProfile](/windows/win32/nativewifi/wlan-profileschema-elements) > [MSM](/windows/win32/nativewifi/wlan-profileschema-msm-wlanprofile-element) > [security](/windows/win32/nativewifi/wlan-profileschema-security-msm-element) > [OneX](/windows/win32/nativewifi/onexschema-onex-element) > EAPConfig). For more information, see [EAP configuration](./eap-configuration.md) and [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For an example, see [Wireless profile samples](/windows/win32/nativewifi/wireless-profile-samples). + @@ -601,6 +630,7 @@ Optional node. URL to the PAC file location. > [!NOTE] > Don't use. Using this configuration in Windows client editions will fail. + @@ -642,6 +672,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] > Don't use. Using this configuration in Windows client editions will fail. + From 535184b8fb257dcdf34a0fa30a4445c6fb6b4660 Mon Sep 17 00:00:00 2001 From: Sam Yun Date: Thu, 15 May 2025 15:24:50 -0700 Subject: [PATCH 12/12] Point proxy config to proxycsp --- windows/client-management/mdm/wifi-csp.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 4d35e88454..784e8088ba 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -20,7 +20,7 @@ Programming considerations: - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device. - The `SSID` part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all nonexcluded ASCII characters must be escaped using a %-character, including replacing the space character (' ') with '%20'. Characters (including Unicode) without the necessary escaping aren't supported. - For the WiFi CSP, you can't use the Replace command unless the node already exists. -- Using `ProxyPacUrl` or `ProxyWPAD` in Windows client editions (Home, Pro, Enterprise, and Education) will fail. +- Using `Proxy`, `ProxyPacUrl` or `ProxyWPAD` in Windows client editions (Home, Pro, Enterprise, and Education) may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. @@ -229,6 +229,9 @@ Optional node. The format is url:port. Configuration of the network proxy (if an +> [!NOTE] +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -269,7 +272,7 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will fail. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. @@ -311,7 +314,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will fail. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. @@ -589,6 +592,9 @@ Optional node. The format is url:port. Configuration of the network proxy (if an +> [!NOTE] +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. + @@ -629,7 +635,7 @@ Optional node. URL to the PAC file location. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will fail. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead. @@ -671,7 +677,7 @@ Optional node. The presence of the field enables WPAD for proxy lookup. > [!NOTE] -> Don't use. Using this configuration in Windows client editions will fail. +> Don't use. Using this configuration in Windows client editions may fail or have no effect. Use [NetworkProxy](networkproxy-csp.md) CSP instead.