Why Enterprise Wi-Fi Needs RADIUS
In small offices, employees connect to the Wi-Fi using a single shared password (WPA2-Personal). If an employee leaves the company, you technically must change the Wi-Fi password on every device in the building to maintain security. RADIUS (Remote Authentication Dial-In User Service) solves this by forcing users to log into the Wi-Fi using their individual Active Directory usernames and passwords (WPA2-Enterprise). When the employee leaves, you simply disable their AD account, instantly revoking their Wi-Fi access. Windows Server includes a built-in RADIUS server called Network Policy Server (NPS).
Step 1: Install the NPS Role
Log in to your Domain Controller or a dedicated security server. Open Server Manager and launch the Add roles and features wizard.
On the Server Roles screen, check the box for Network Policy and Access Services. Click Next and complete the installation.
Step 2: Register NPS in Active Directory
The NPS server must be granted permission to query the Active Directory database to verify user credentials.
Open the Network Policy Server console from the Administrative Tools menu. Right-click the top-level NPS (Local) node and select Register server in Active Directory. Click OK on the prompt.
Step 3: Add Your Wi-Fi Controller as a RADIUS Client
You must configure NPS to accept authentication requests coming from your wireless access points (or your central Wi-Fi controller, like a Cisco WLC or Ubiquiti UniFi Controller).
In the NPS console, expand RADIUS Clients and Servers. Right-click RADIUS Clients and select New.
- Friendly name: “Ubiquiti Controller”
- Address (IP or DNS): The IP address of your Wi-Fi controller (e.g.,
192.168.1.50). - Shared secret: Generate a very long, complex password (e.g.,
8x#P9!kL2mQ@9vZ). You will need to enter this exact same password into your Wi-Fi controller’s settings later.
Click OK to save the client.
Step 4: Create the Network Policy
Now you must define who is actually allowed to connect.
Expand Policies, right-click Network Policies, and select New. Name it “Allow Corporate Wi-Fi Users”. Click Next.
On the Conditions page, click Add. Select User Groups, and search for the Active Directory security group containing your authorized employees (e.g., Domain Users). Click Next.
Ensure the Access Permission is set to Access granted. Click Next.
On the Authentication Methods page, uncheck all the old insecure protocols. You must check Microsoft: Protected EAP (PEAP). This is the industry standard for secure WPA2-Enterprise Wi-Fi. (Note: You must select a valid SSL certificate from the PEAP properties window; usually, a self-signed cert or one from your internal CA is automatically selected). Complete the wizard.
Step 5: Configure Your Wi-Fi Controller
Log into the management interface of your Wi-Fi controller (e.g., Ubiquiti UniFi). Create a new Wireless Network.
Instead of selecting “WPA Personal” (password), select WPA Enterprise.
Enter the IP address of your Windows NPS server, the standard RADIUS port (1812), and the complex “Shared secret” you created in Step 3. Save the settings. When users connect to the SSID on their phones or laptops, they will now be prompted for their individual corporate username and password!