How to Configure IEEE 802.1X Wired Authentication in Windows 11 Using netsh lan

Enterprise campus networks, financial institutions, and government facilities frequently implement IEEE 802.1X network access control on physical Ethernet switch ports to prevent unauthorized devices from connecting to the internal corporate LAN. When an Ethernet cable is plugged into an 802.1X-secured port, the switch port remains blocked until the client workstation authenticates using an Extensible Authentication Protocol (EAP) method (such as EAP-TLS with machine certificates or PEAP-MSCHAPv2). In Windows 11, wired 802.1X authentication is managed through the Wired AutoConfig service and configured via the netsh lan command context.

Understanding Wired AutoConfig and the netsh lan Context

Unlike Wi-Fi (managed by the WLAN AutoConfig service), wired 802.1X authentication relies on the Wired AutoConfig service (dot3svc):

• Service Dependency: The dot3svc service is stopped and set to Manual startup by default in Windows 11. It must be running for 802.1X Ethernet authentication to function.
• Authentication Profiles: Security settings, EAP types, certificate authorities, and authentication modes (User or Computer) are stored in structured XML profiles.
• Automation via netsh: The netsh lan command allows systems administrators to query interface status, export reference XML profiles, and bulk-deploy 802.1X configurations across workstations without manual GUI intervention.

Enabling and Starting the Wired AutoConfig Service

Before configuring 802.1X parameters, open PowerShell or Command Prompt with administrative privileges and enable the dot3svc service:

Set-Service -Name "dot3svc" -StartupType Automatic
Start-Service -Name "dot3svc"

To verify that the service is running:

Get-Service -Name "dot3svc"

With the service active, Windows 11 enables the Authentication tab inside Network Adapter Properties and activates the netsh lan command context.

Inspecting Wired Network Interfaces and Authentication State

To view connected Ethernet network adapters and their current 802.1X authentication state:

netsh lan show interfaces

The output reports interface hardware and 802.1X status:

There is 1 interface on the system:

    Name                   : Ethernet 1
    Description            : Intel(R) Ethernet Connection I219-LM
    GUID                   : {3C8B721A-4F12-421B-8E99-8D4C13506214}
    Physical Address       : 00-1B-21-BA-81-42
    State                  : Authenticating
    802.1x status          : Enabled

Exporting an Active 802.1X Profile to XML

To create a reusable configuration profile template for deployment across other Windows 11 computers, export the active wired profile from a working reference machine:

netsh lan export profile folder=C:\Profiles interface="Ethernet 1"

Windows generates an XML profile file (e.g., C:\Profiles\Ethernet 1.xml). Inspecting this XML reveals the EAP authentication structure:

<LANProfile xmlns="http://www.microsoft.com/networking/LAN/profile/v1">
  <MSM>
    <security>
      <OneX xmlns="http://www.microsoft.com/networking/OneX/spec/v1">
        <authMode>machineOrUser</authMode>
        <EAPConfig>...</EAPConfig>
      </OneX>
    </security>
  </MSM>
</LANProfile>

Importing and Applying an 802.1X Profile via netsh

To deploy an 802.1X wired security profile to a target Windows 11 machine:

netsh lan add profile filename="C:\Profiles\Ethernet 1.xml" interface="Ethernet 1"

To verify that the profile was installed successfully:

netsh lan show profiles interface="Ethernet 1"

The profile name appears under applied profiles for that adapter.

Troubleshooting 802.1X Authentication Failures

If an Ethernet port remains blocked or the connection cycles continuously in the Authenticating state:

To inspect real-time 802.1X security negotiation status:

netsh lan show security interface="Ethernet 1"

Common resolutions include:

• Certificate Validation: For EAP-TLS, verify that the required Root and Intermediate Certificate Authorities (CA) are installed in the computer\u2019s Trusted Root Certification Authorities store.
• Authentication Mode: If user sign-in is required before network connectivity is established, verify that authMode is configured to machineOrUser to allow pre-logon computer authentication.

Removing a Wired 802.1X Profile

To remove an applied 802.1X profile and return the Ethernet interface to unauthenticated standard DHCP/static operation:

netsh lan delete profile name="Ethernet 1" interface="Ethernet 1"

The interface immediately unbinds the 802.1X profile without requiring a system reboot.