The IEEE 802.1X authentication protocol is not supported in Windows Preinstall Environment (PE) 3.0

• Microsoft System Center Configuration Manager 2007 Operating System Deployment
• Microsoft Deployment Toolkit

Hotfix information

Prerequisites

Registry information

Hotfix replacement information

File information

For all supported x86-based versions of Windows PE 3.0

For all supported x64-based versions of Windows PE 3.0

• A technician computer that has the Windows Automated Installation Kit (AIK) for Windows 7 installed
• 394904_intl_i386_zip.exe or 394905_intl_x64_zip.exe, depending on architecture of your Windows PE image
• The following VBS script and two XML files. They are located in the Script samplessection:
  • StartDot3.VBS
  • USERDATA-EAP-TLS.xml
  • Wired-WinPE-EAP-TLS.xml
• Your root certificate, saved as RootCert.cer
• Any subordinate CA certificates, saved as SubCACert.cer
• Your User Certificate pfx, saved as Usercert.pfx
• The x86 or x64 versions of certutil.exe and certutil.exe.mui from a Windows 7-based computer, depending on architecture of your Windows PE image

1. On your technician computer, click Start, point to All Programs, point to Windows AIK, right-click Deployment Tools Command Prompt, and then click Run as administrator.
   
   The menu shortcut opens a Command Prompt window and automatically sets environment variables to point to all the necessary tools. By default, all tools are installed in the C:\Program Files\Windows AIK\Tools folder.
2. At the command prompt, run the Copype.cmd script. The script requires two arguments: hardware architecture and destination location.
   
   For example, run copype.cmd <architecture> <destination>, where <architecture> can be x86, amd64, or ia64, and <destination> is the path of the local directory.
   
   For example, run this command:
   copype.cmd x86 c:\winpe_x86
   The script creates the following directory structure and copies all the necessary files for that architecture:
   \winpe_x86
   \winpe_x86\ISO
   \winpe_x86\mount
3. Copy the base image (Windows PE.wim) into the \Winpe_x86\ISO\sources folder, and rename the file to boot.wim. 

   copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim

4. Mount the base Windows PE image. In this step, you mount the base image to a local directory so that you can add or remove packages. 

   Dism /Mount-Wim /WimFile:C:\winpe_x86\ISO\sources\boot.wim /index:1 /MountDir:C:\winpe_x86\mount

5. Add the following packages to the image. Be aware that each command should be a single line, and the command must not wrap.
   
   Add WINPE-WMI package

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-wmi.cab"
   
   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\winpe-wmi_en-us.cab" 

   Add WINPE-Scripting package

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-scripting.cab"
   
   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\winpe-scripting_en-us.cab" 

   Add WINPE-HTA package

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-hta.cab"
   
   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\winpe-hta_en-us.cab"

6. Extract the contents of the 394904_intl_i386_zip.exe update to the c:\972831 folder.
   
7. Add the update for 802.1X support to the image:

   dism.exe /image:C:\winpe_x86\mount /add-package /packagepath:"c:\972831\Windows6.1-KB972831-86.cab" 

8. Create a folder to contain additional files for 802.1X support. To do this, run the following command: 
   md C:\winpe_x86\mount\winpe
9. Copy certutil.exe and certutil.exe.mui from a Windows 7-based computer to the c:\winpe_x86\mount\winpe folder. These files can be found in the %windir%\system32 folder.
   
   Note You must copy the correct version of these files, based on the architecture of your Windows PE image.
10. Edit the Wired-WinPE-EAP-TLS.xml file, and change the following line to enter the Root CA certificate thumbprint/hash for the correct certification authority: 

    <TrustedRootCA>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</TrustedRootCA> 

11. Copy your connection profile to the Windows PE directory by using EAP-TLS:

    Copy Wired-WinPE-EAP-TLS.xml C:\winpe_x86\mount\winpe 

12. Edit the USERDATA-EAP-TLS.xml file, and change the following lines for Username and UserCert:

    <eapTls:Username>contoso\username</eapTls:Username>
    
    <eapTls:UserCert>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</eapTls:UserCert>

13. Copy your connection profile to the Windows PE directory by using EAP-TLS:

    copy USERDATA-EAP-TLS.xml C:\winpe_x86\mount\winpe 

14. Copy your root certificate and any subordinate CA certificates to the c:\winpe_x86\mount\winpe folder.
15. Copy your User Certificate pfx to the c:\winpe_x86\mount\winpe folder.
16. Edit StartDot3.vbs file, and change the following line:

    certutil –user –p PASSWORD -importpfx \winpe\USERcert.pfx NOEXPORT,NOCHAIN 

    Note In this line, you must change PASSWORD to the password that was assigned to the certificate when it was exported.
17. Copy StartDot3.Vbs to the c:\winpe_x86\mount\winpe folder.
18. Edit startnet.cmd to run StartDot3.vbs automatically:

    notepad C:\winpe_x86\mount\windows\system32\startnet.cmd

19. Add .\winpe\StartDot3.vbs after the wpeinit command, and then save the startnet.cmd file.
20. Unmount and commit changes to the .WIM:

    Dism /Unmount-Wim /MountDir:C:\winpe_x86\mount /Commit

21. Create your bootable media by using the steps that are outlined in the Windows 7 AIK Help file under the following topics:
    • "To create a bootable CD-ROM"
    • "To create a bootable UFD"

Script samples

StartDot3.VBS

‘================================
‘StartDot3.VBS
‘================================
Dim WshShell
Set WshShell = CreateObject("WScript.Shell")

commandLine = "certutil -addstore Root \winpe\Rootcert.cer"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "certutil -addstore CA \winpe\SubCAcert.cer"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "certutil –user –p PASSWORD -importpfx \winpe\USERcert.pfx NOEXPORT,NOCHAIN"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "net start dot3svc"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "netsh lan add profile filename=\winpe\Wired-WinPE-EAP-TLS.xml"
Return  = WshShell.Run(commandLine, 0, true)

commandLine = "netsh lan set eapuserdata filename=\winpe\Wired-WinPE-UserData-EAP-TLS.xml allusers=yes interface=*"
Return  = WshShell.Run(commandLine, 0, true)

USERDATA-EAP-TLS.xml

<?xml version="1.0"?>
<EapHostUserCredentials xmlns="http://www.microsoft.com/provisioning/EapHostUserCredentials" xmlns:eapCommon="http://www.microsoft.com/provisioning/EapCommon" xmlns:baseEap="http://www.microsoft.com/provisioning/BaseEapMethodUserCredentials">
 <EapMethod>
  <eapCommon:Type>13</eapCommon:Type>
  <eapCommon:AuthorId>0</eapCommon:AuthorId>
 </EapMethod>
 <Credentials xmlns:eapUser="http://www.microsoft.com/provisioning/EapUserPropertiesV1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:baseEap="http://www.microsoft.com/provisioning/BaseEapUserPropertiesV1" xmlns:eapTls="http://www.microsoft.com/provisioning/EapTlsUserPropertiesV1">
  <baseEap:Eap>
  <baseEap:Type>13</baseEap:Type>
   <eapTls:EapType>
    <eapTls:Username>contoso\username</eapTls:Username>
    <eapTls:UserCert>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</eapTls:UserCert>
   </eapTls:EapType>
  </baseEap:Eap>
 </Credentials>
</EapHostUserCredentials>

Wired-WinPE-EAP-TLS.xml

<?xml version="1.0"?>
<LANProfile xmlns="http://www.microsoft.com/networking/LAN/profile/v1">
 <MSM>
  <security>
   <OneXEnforced>false</OneXEnforced>
   <OneXEnabled>true</OneXEnabled>
   <OneX xmlns="http://www.microsoft.com/networking/OneX/v1">
    <authMode>user</authMode>
    <EAPConfig><EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod>
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type>
<VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId>
<VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType>
<AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId>
</EapMethod>
<Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
<Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>13</Type>
<EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1">
<CredentialsSource>
<CertificateStore>
<SimpleCertSelection>true</SimpleCertSelection>
</CertificateStore>
</CredentialsSource>
<ServerValidation>
<DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation>
<ServerNames></ServerNames>
<TrustedRootCA>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</TrustedRootCA>
</ServerValidation>
<DifferentUsername>false</DifferentUsername>
<PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation>
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</AcceptServerName>
</EapType>
</Eap>
</Config>
</EapHostConfig>
</EAPConfig>
   </OneX>
  </security>
 </MSM>
</LANProfile>