Why Use RADIUS for Wi-Fi?
Most small businesses secure their Wi-Fi using WPA2-Personal, which requires sharing a single Pre-Shared Key (PSK) password with all employees. If an employee leaves the company, you must change the password on every single device to maintain security. By deploying a RADIUS (Remote Authentication Dial-In User Service) server integrated with Active Directory, you can upgrade your Wi-Fi to WPA2-Enterprise. This requires users to log into the Wi-Fi using their unique Active Directory username and password. When an employee leaves, simply disabling their AD account instantly revokes their Wi-Fi access.
Step 1: Install the Network Policy and Access Services Role
Log in to your Windows Server Domain Controller. Open Server Manager and click Add roles and features. Navigate to the Server Roles page and check the box for Network Policy and Access Services (NPAS). Click Next and complete the installation wizard.
Step 2: Register the NPS Server in Active Directory
Once installed, open the Network Policy Server (NPS) console from the Server Manager Tools menu. Right-click on the top-level NPS (Local) node in the left pane and select Register server in Active Directory. This authorizes the RADIUS server to read user dial-in properties and password hashes from AD.
Step 3: Add Your Wireless Access Point as a RADIUS Client
The RADIUS server will only accept authentication requests from trusted devices (your Wi-Fi routers or access points). In the NPS console, expand RADIUS Clients and Servers, right-click on RADIUS Clients, and select New.
Provide a friendly name for your access point (e.g., “Lobby-AP”), enter its static IP address, and generate a strong Shared secret. You will need to enter this exact same shared secret into the web interface of your physical Wi-Fi access point later.
Step 4: Configure the 802.1X Wireless Policy
To tell the NPS server how to handle incoming Wi-Fi authentication requests, click on the top-level NPS (Local) node again. In the center pane, under the Standard Configuration section, select RADIUS server for 802.1X Wireless or Wired Connections from the drop-down menu, and click Configure 802.1X.
Follow the wizard:
1. Select Secure Wireless Connections.
2. Check the box next to the RADIUS client you created in Step 3.
3. For the authentication method, select Microsoft: Protected EAP (PEAP).
4. Specify the Active Directory User Groups that are allowed to connect to the Wi-Fi (e.g., “Domain Users”).
Step 5: Configure Your Physical Access Point
Log in to the web management interface of your physical Wi-Fi router (e.g., Ubiquiti, Cisco, or Meraki). Navigate to the Wireless Security settings and change the security mode from WPA2-PSK to WPA2-Enterprise (or WPA2-EAP).
Enter the IP address of your Windows Server running NPS as the RADIUS server, and input the Shared Secret you created in Step 3.
Your users will now be prompted to enter their individual network credentials when connecting to the corporate Wi-Fi!