How To Distribute Network Profiles to Windows Devices via ManageEngine Mobile Device Manager Plus

Overview - How to Distribute Network Profiles to Windows Devices via ManageEngine

To connect your ManageEngine Windows Devices to your network, you need to distribute a configuration profile that includes the necessary network settings, authentication methods, and certificates. This guide will walk you through the steps to configure and push these profiles to Windows Devices using ManageEngine for EAP-TLS.

Step-by-Step Guide - How To Configure Network Profile ManageEngine Configuration Policies for Windows Devices

Follow these steps to configure and push the necessary ManageEngine configuration policies for Windows Devices:

Prerequisites for Configuring Windows Network Profiles via ManageEngine

Before you begin configuring network profiles for Windows Devices via ManageEngine, ensure that you have completed all the necessary prerequisites:

1. The Keytos Entra ID applications are registered in your tenant.
2. You have signed up for a Keytos Shield Plan.
3. You have existing access policies in Keytos Shield.
4. You are a Subscription Owner or Network Administrator.
5. You are an ManageEngine Administrator.

Step 1 - How to Push your Shield CA Certificates as Trusted Certificates in ManageEngine

The first step is to push your Shield CA certificates as trusted certificates in ManageEngine. This ensures that your Windows devices recognize and trust the certificates issued by your Shield CA.

How to Download Your Root and Issuing CA Certificates in Keytos Shield

Begin by downloading your Root and Issuing CA certificates from the Keytos Shield portal.

• Onboarding guide
• Network profiles page

How to Upload Your Shield CA Certificates to ManageEngine

Now that you have downloaded your Shield Root and Issuing CA certificates, you can upload them to ManageEngine.

1. In your ManageEngine Mobile Device Manager Plus portal, navigate to the Device Mgmt page.

2. Using the left-hand menu, under Manage select Certificates.

   

3. Using the tabs at the top of the Certificates page, ensure you are on Certificates.

   

4. Click the + Add Certificate button.

   

5. Upload the Root CA certificate you just downloaded from Keytos Shield.

6. Once uploaded, click Add Certificate.

7. If you also have an Issuing CA certificate, repeat the above steps to upload it as well.

How to Add Your Shield CA Certificates to a ManageEngine Profile

To add your Shield CA certificates to a ManageEngine profile, follow these steps:

1. From Device Mgmt, navigate to Profiles.

   

2. Either selecting an existing Profile Name or select + Create Profile.

   

3. From the left-hand nav-bar, select Certificate.

   

4. From the Certificate drop-down menu, select the Root CA certificate that you uploaded earlier and then click Save.

   

5. Click the Publish button to apply the changes to the profile. We’ll come back to this in a bit to finish configuring the profile.

6. Done. This certificate will now be pushed to all devices that are associated with this profile.

Step 2 - How to Create a CA Server for Windows Devices in ManageEngine

A SCEP (Simple Certificate Enrollment Protocol) certificate allows your Windows device to authenticate with its own unique certificate, which can be used for secure network access and other authentication purposes. Follow these steps to issue a SCEP certificate to your Windows device via ManageEngine.

How to Get Your Keytos Shield Static SCEP URL and Password

Begin by retrieving your Keytos Shield Static SCEP URL and password from the Keytos Shield portal.

• Onboarding guide
• Network profiles page

How to Create a SCEP CA Server in ManageEngine

Now that you have your SCEP URL, you will have to create a SCEP CA Server in ManageEngine.

1. In your ManageEngine Mobile Device Manager Plus portal, navigate to the Device Mgmt page.

2. Under Manage select Certificates.

   

3. Using the tabs at the top of the Certificates page, ensure you are on CA Servers.

   

4. Click the + Add CA Server button.

   

5. For the Server Type dropdown, select Generic SCEP.

   

6. Give the CA a friendly name.

7. Paste the SCEP URL you copied from Keytos Shield.

   

8. For the CA certificate dropdown, select the issuing CA certificate you previously added to ManageEngine.

   

9. Click Save at the bottom of the page.

Step 3 - How to Create a SCEP Template in ManageEngine

The following steps will guide you on how to create a ManageEngine SCEP profile to issue device certificates to your Windows devices.

How to Create a SCEP CA Template in ManageEngine

1. In your ManageEngine Mobile Device Manager Plus portal, navigate to the Device Mgmt page.

2. Under Manage select Certificates.

   

3. Using the tabs at the top of the Certificates page, select Templates.

   

4. Click the + Add Template button.

   

5. For the Select server dropdown, select the server you just created.

   

6. Specify a friendly name for the Certificate Template Name.

7. For the Subject field, enter:

   • User Certificates: CN=%username%
   • Device Certificates: CN=%devicename%

8. For the Subject Alternative Name Type dropdown, select RFC 822 Name.

9. Set the Subject Alternative Name Value:

   • User Certificates: %email%
   • Device Certificates: %devicename%
   

10. Set NT Principal Name to:

    • User Certificates: %username%
    • Device Certificates: %devicename%@ezradius.io

11. Enter the following values:

    • Maximum number of failed attempts: 10.
    • Time interval between attempts: 5 seconds.
    • Challenge type: Static.
    • Enrollment challenge password: paste the SCEP challenge you copied from Keytos Shield.
    • Key Size: 2048.
    • Use as Digital Signature: Yes.
    • Use for Key Encipherment: Yes.
    • Certificate Automatic Renewal Before: 15 days.
    

12. Scroll to the bottom of the page and click Save.

13. Repeat these steps for all CA server(s) you added to ManageEngine.

Step 4 - How to Create a Wi-Fi Profile in ManageEngine for Certificate-Based Authentication

Now that you have all the building blocks in place, you can create a Wi-Fi profile that uses certificate-based authentication for your Windows devices.

How to Configure a SCEP Profile in ManageEngine

Begin by configuring a SCEP certificate in your profile.

1. From Device Mgmt, navigate to Profiles.

   

2. Either selecting an existing Profile Name or select + Create Profile.

   

3. Give the profile a name then click Continue.

4. Set the Profile Type to MDM Profile.

5. On the Configure Profile page, navigate to the SCEP section using the left-hand menu.

   

6. For Certificate Type, select Device to make your ManageEngine devices use device certificates or User for user certificates.

   Make sure to choose the same auth type you set in the SCEP template

   The authentication type you select here must match the one previously configured in your SCEP template.

7. From the Key storage provider (KSP) dropdown, select Enroll to trusted Platform Module (TPM) KSP if present, otherwise Software KSP.

   

8. Select the SCEP Template you previously created.

   

9. Scroll down the bottom of the page and click Save.

How to Configure a Wi-Fi Profile in ManageEngine

Next, add a Wi-Fi profile to your profile.

1. Click on the Wi-Fi section using the left-hand menu.

   

2. In the Wi-Fi SSID textbox, type the SSID of your Wi-Fi network (this is case sensitive).

3. Enable Connect to this Wi-Fi automatically if you would like devices to automatically join the network without prompting users.

4. Select Yes for Hidden network only if your Wi-Fi access point does not broadcast its SSID.

5. Set the Security type to WPA2-Enterprise.

   

6. From the EAP method dropdown, select TLS.

7. In the CA certificate dropdown, select the Root CA certificate you previously uploaded.

   

8. Scroll down to the bottom of the page and click Save.

9. Once the profile is saved, click Publish.

Done! You have now created a Wi-Fi profile for EAP-TLS authentication in ManageEngine.

Step 5 - How to Associate Your Wi-Fi Profile to Groups or Devices in ManageEngine

Now that you have create a Wi-Fi profile for certificate-based authentication, you will need to distribute it to all your Windows devices.

1. In your ManageEngine Mobile Device Manager Plus portal, navigate to the Device Mgmt page.

2. Using the left-hand menu, under Manage select Groups & Devices.

3. Select any Group, Device, or User you would like to add this Wi-Fi profile to.

4. Click Action > Associate Profile > Configuration Profile.

   

5. Under Available Profiles select the Windows Wi-Fi profile you just created.

   

6. At the bottom of the page, click Associate.

Done! Your Wi-Fi profile is now created and will be pushed to your devices. Once the profile is applied, users will be able to connect to the Wi-Fi network using certificates.

How to Test the Wi-Fi Certificate Authentication Setup

Now that you have created and deployed the Wi-Fi profile, it’s important to test the setup to ensure everything is functioning correctly. Follow these steps to test your Wi-Fi profile:

1. On a managed Windows device, go to Settings > Network & Internet > Wi-Fi > Manage known networks. You should see the SSID you configured in the list.
2. If you use User-based certificate authentication, attempt to connect to the Wi-Fi network. You should be connected without being prompted for a username or password. If you use Device-based certificates, the device should connect automatically without user interaction. You may need to restart the device to trigger the connection.

How to Troubleshoot RADIUS Authentication for Keytos Shield

If you are unable to connect to your network, refer to our troubleshooting guide.