Using the Administrator Tool

• Create a New Package
• Open an Existing Package

Set Administrator Password
Administrator Tool Settings
Administrator Profiles
Single Sign-on Considerations for Windows* Vista* and Windows* 7

• Persistent Profile
• Pre-logon Connect
• Exclude Networks
• Voice over IP (VoIP) Connection

Application Settings
Adapter Settings
EAP-FAST A-ID Groups

Overview

The Administrator Tool is used to create custom install packages that can be exported to client systems running Microsoft Windows* XP, Windows Vista* and Windows* 7. The Administrator Tool is used to configure user settings and common (shared) WiFi network profiles. The tool is used by the person who has administrator privileges on this computer. Users cannot modify Administrator settings or profiles unless they have the password for this tool. A password should be chosen that is secure and not easily guessed.

The feature must be selected during a custom installation of the Intel® PROSet/Wireless WiFi Connection Utility or the feature is not displayed.

Administrator Packages

An Administrator Package is a self-extracting executable file that contains administrative profiles and other user settings. You can copy or send an administrative package to clients on your network. When the executable runs, the contents are installed and configured on the destination computer. If a profile is part of the package, the profile governs how the destination computer connects to a specific WiFi network. For information about profiles, see Administrator Profiles.

Create a New Package

1. For Windows* XP users and Windows* 7 users: on the Tools menu, click Administrator Tool.
2. Enter your password to access the Administrator Tool.
3. Click Create a new package.

Name	Description
Create a new package	Create a package that can be exported to a client computer. The client computer can run Windows* XP, Windows Vista*, or Windows* 7. The package capabilities will vary, depending on the client OS. This package allows export of 802.1X authentication EAP-type, Pre-logon/Common and Persistent profiles. However, there are exceptions for Single Sign-on profiles that will be exported to Windows Vista* and Windows* 7 clients. See Administrator Profiles.
Open an existing package	Select to browse for and open an existing package.

4. Click OK.
5. Configure the following options to be included in the package:

Name	Description
Profiles	Click Include Profiles in this package (this should already be checked). Profiles can be shared with other users. Click Profiles here for more information and instructions.
Application Settings	Click the Application Settings tab. Click Include Application Settings in this package (this should already be checked). Specify application settings to be enabled. Click Application Settings here for more information and instructions.
Adapter Settings	Click the Adapter Settings tab. Click Include Adapter Settings in this package. Specify initial values for adapter settings used on this computer. Click Adapter Settings here for more information and instructions.
EAP-FAST A-ID Groups	Click the EAP-FAST A-ID Groups tab. Click Include A-ID Groups. Add A-ID Group to support multiple PACs from multiple A-IDs. Click EAP-FAST A-ID Groups here for more information and instructions.

6. Click Close.
7. You are notified: The current package is changed. Would you like to save the changes?
8. Click Yes. Save the executable file to a directory on the local disk drive.
9. Click Save. The file is created.
10. Click Finished to view the package contents.
    • Click Apply this package to this computer if you want to use the package configuration on the Administrator's computer.
    • Copy the executable file to any user's computer to install the configuration that has been saved in the package. When you execute the package file, it is a silent install.
11. Click OK.

Open an Existing Package

1. For Windows* XP users: on the Tools menu, click Administrator Tool.
2. Enter your password to access the Administrator Tool.



3. On the Open Administrator Package window, click Open an existing package to edit an existing package.
4. Click Browse.... Locate the package's executable file.
5. Click Open. Make your updates for package settings.
6. Here you can Add, Remove and Copy profiles. You can also click Properties to update the security settings for a profile.
7. Click Close.
8. You are notified: The current package is changed. Would you like to save the changes?
9. Click Yes. Save the executable file to a directory on the local disk drive.
10. Click Save. The file is created.
11. Click Finished to view the package contents.
• Click Apply this package to this computer if you want to use the package configuration on the Administrator's computer.
• Copy the executable file to any user's computer to install the configuration that has been saved in the package. When you execute the package file, it is a silent install.
12. Click OK.

NOTE: You can also select Open Package on the File menu to edit an Administrator Package.

NOTE: If you create an Administrator Package for a Windows* XP Professional x64 Edition system, the language files are located in the \XP\Docs and the \XP\x64\Install\Lang folders on that system.

See:

• Administrator Profiles
• Set Administrator Password
• Administrator Tool Settings

Administrator Profiles

Administrator Profiles are owned and managed by the network administrator or the administrator of this computer. These profiles are shared by all users on this computer. However, end users cannot modify these profiles. They can only be modified from the Administrator Tool, which is password protected. There are two types of Administrator Profiles: Persistent or Pre-logon/Common. You can also configure Voice over IP (VoIP) settings for export to a soft-phone application.

Single Sign-On Considerations for Windows* Vista* and Windows* 7

The following information applies only to Single Sign-On (SSO) profiles created for Windows* Vista* and Windows* 7* clients.

• Persistent profiles are not supported. Persistent profiles are ignored during package import.
• Saved credentials in profiles that are both Persistent and Pre-logon/Common are not supported.
  • Saved credential profiles become prompt for credentials profiles.
  • Profiles that are Persistent-plus-Pre-logon/Common, use machine credentials, with an exception of TTLS profiles.
  • Profiles that are Persistent-plus-Pre-logon/Common with TTLS, are not supported. Only Pre-logon/Common with TTLS profiles are supported.
• There is no pre-logon support for TLS profiles (including profiles with TLS as tunnel method).
  • No connection attempt during user log-in; TLS uses user certificates after user logon.
  • Machine certificates for user connection are not supported.
  • Machine certificate setting will become user certificate setting on import.

For specific information about each profile type, see the following:

• SSO TTLS profiles
• SSO EAP-SIM profiles
• SSO EAP-AKA profiles
• SSO LEAP profiles
• SSO EAP-FAST profiles
• SSO PEAP-GTC profiles
• SSO PEAP-MS-CHAP-V2
• SSO PEAP-TLS profiles
• SSO TLS profiles

Persistent Profile

Persistent profiles are applied at boot time or whenever no one is logged on the computer. After a user logs off, a Persistent profile maintains a wireless connection either until the computer is turned off, or a different user logs on.

Persistent profile key points:

• The following types of profiles can be created as Persistent Profiles:
  • All profiles that do not require 802.1X authentication (for example, Open authentication with WEP encryption, Open authentication with no encryption).
  • All profiles with 802.1X authentication that have the credentials saved: LEAP or EAP-FAST.
  • Profiles with security settings that include "Use the following user name and password" option.
  • Profiles that use the machine certificate to authenticate.
  • WPA-Enterprise profiles that do not use a user certificate.
  • WPA-Personal profiles.
• Persistent profiles are applied at system power up and after a user logs off.

Create a Persistent Profile for a Client Package

Following are general instructions for this type of Administrator profile. For more detailed information and restrictions, see Create Profiles for Windows*.

1. For Windows* XP users and Windows 7: on the Tools menu, click Administrator Tool.
2. Enter your password to access the Administrator Tool.
3. Select Create new package or Open existing package. For existing packages, you may browse to locate it. Then click OK.
4. Click Include Profiles in this package.
5. Click Persistent.
6. Click Add to open the General Settings.
7. Profile Name: Enter a descriptive profile name.
8. WiFi Network Name (SSID): Enter the network identifier.
9. Operating Mode: Network (Infrastructure) is selected by default.
10. Administrator Profile Type: Persistent: Active when no users are logged on is selected.
11. Click Next.
12. Click Enterprise Security to open the Security Settings. See TLS, TTLS, PEAP, LEAP, or EAP-FAST for 802.1X security configuration information.
13. Click OK.

Remove a Persistent Profile from a Package

1. On the Persistent tab, click the profile.
2. Click Remove.

Copy a Persistent Profile for a Package

You can copy an existing profile, giving the copy a new name. You may want to do this in order to have two similar profiles. To copy a profile:

1. Select the profile.
2. Click Copy.
3. Enter a new profile name.
4. Click OK.

The new profile is saved. This new profile has the same properties as the original.

Edit a Persistent Profile for a Package

1. Select the profile.
2. Click Properties.
3. Edit the properties of the new profile using the same instructions given under Create a Persistent Profile.

Pre-logon/Common Profiles

Pre-logon/Common profiles are applied once a user logs on. If Single Sign On support is installed, the connection is made prior to the Windows log-on sequence (Pre-logon/Common). If Single Sign On support is not installed, the profile is applied once the user session is active. Pre-logon/Common profiles always appear at the top of the Profiles list. Users can still prioritize profiles that they have created but they cannot reprioritize Pre-logon/Common profiles. Because these profiles appear at the top of the Profiles list, the WiFi connection utility automatically attempts to connect to the Administrator profiles first before any user-created profiles.

Pre-logon Connect key points are:

• Pre-logon Connect is active only at the Windows log on.
• The following types of profiles can be created as Pre-logon/Common profiles:
  • 802.1X PEAP, TTLS or EAP-FAST profiles that use either the "Use Windows Logon user name and password" or "Use the following user name and password" credentials when configuring the profile's security settings.
  • LEAP profiles that use the "Prompt for the user name and password." credentials when configuring the profile's security settings.
  • 802.1X PEAP or TTLS profiles with user or machine certificates (the user must have administrative rights to use machine certificates).
  • TLS profiles that use digital certificates to verify the identity of a client and a server.
  • EAP-SIM profiles that use a Subscriber Identity Module (SIM) card to validate your credentials with the network.
  • All non-802.1X (Open and WEP) Common or User Based profiles.
• A Pre-logon/Common profile is applied at Windows user log-on time.

Pre-logon/Common Connection Status

The following describes how the Pre-logon Connect feature functions from system power-up. The assumption is that a saved profile exits. This saved profile has valid security settings marked with "Use Windows Logon user name and password" that are applied at the time of Windows log on.

1. After a system power-up, enter your Windows log on domain, user name, and password.
2. Click OK. The Pre-logon/Common Profile Status page displays the progress of the network connection. After the WiFi adapter is connected to the network access point, the Status page closes and the Windows user logs on.
   • If the corresponding access point rejects your credentials during the Common connection, the profile credentials prompt you for your user credentials.
   • Enter your credentials.
   • Click OK. The profile is applied and the Status page displays the progress of the connection status until you are logged onto Windows.
   • Click Cancel on the Credentials page to select another profile.

When you log off, any wireless connection is disconnected and a Persistent profile (if one is available) is applied. Under certain circumstances, it is desirable to maintain the current connection (for example, if user-specific data needs to be uploaded to the server post-logoff or when roaming profiles are used). Create a profile that is marked as both Pre-logon/Common and Persistent to achieve this functionality. If such a profile is active when the user logs off, the connection is maintained.

Create a Pre-logon/Common Profile for a Client Package

Following are general instructions for this type of Administrator profile. For more detailed information and restrictions, see Create Profiles for Windows*.

1. For Windows* XP users: on the Tools menu, click Administrator Tool.
2. Enter your password to access the Administrator Tool.
3. Select Create new package or Open existing package. For existing packages, you may browse to locate it. Then click OK.
4. Click Include Profiles in this package.
5. Click Pre-logon/Common.
6. Click Add to open the General Settings.
7. Profile Name: Enter a descriptive profile name.
8. WiFi Network Name (SSID): Enter the network identifier.
9. Operating Mode: Network (Infrastructure) is selected by default.
10. Administrator Profile Type: Pre-logon/Common: Active when a user is logged on. This profile is shared by all users. This profile type is already selected.
11. Click Next.
12. Click Advanced to open the Advanced Settings. Configure Advanced Settings and then return to these instructions.
13. Click OK to close the Advanced Settings.
14. Click Enterprise Security to open the Security Settings. See EAP-SIM, TLS, TTLS, PEAP, LEAP, EAP-FAST for 802.1X security configuration information.
15. Click OK to save the profile and add it to the Administrator profiles list.

Remove a Pre-logon/Common Profile from a Package

1. On the Persistent tab, click the profile.
2. Click Remove.

Copy a Pre-logon/Common Profile for a Package

You can copy an existing profile, giving the copy a new name. You can edit the new profile. You may want to do this in order to have two similar profiles. To copy a profile:

1. Select the profile.
2. Click Copy.
3. Enter a new profile name.
4. Click OK.

The new profile is saved. This new profile has the same properties as the original.

Edit a Pre-logon/Common Profile for a Package

1. Select the profile.
2. Click Properties.
3. Edit the properties of the new profile using the same instructions given under Create a Persistent Profile.

Click Creating Administrator Profiles for Enterprise Security for more information.

Exclude Networks

Administrators can designate networks to be excluded from connection. Once a network is excluded, only an administrator can remove the network from the Exclude list. The excluded network is displayed in the Exclude List Management, and is indicated by this icon:

To exclude a network:

1. Click Include Profiles in this package.
2. Click Exclude.
3. Click Add to open the Exclude Network (SSID).
4. Network Name: Enter the network name of the network that you want to exclude.
5. Click OK to add the network name to the Exclude list.

To remove a network from exclusion:

1. Select the network name in the Exclude list.
2. Click Remove. The network is deleted from the Exclude list.

Voice over IP (VoIP) Connection

The WiFi connection utility supports VoIP third-party soft-phone applications. Third-party VoIP applications support Voice Codecs. Codecs generally provide a compression capability to save network bandwidth. The WiFi connection utility supports the following International Telecommunications Union (ITU) codec standards:

Codec	Algorithm
ITU G.711	PCM (Pulse Code Modulation)
ITU G.722	SBADPCM (Sub-Band Adaptive Differential Pulse Code Modulation)
ITU G.723	Multi-rate Coder
ITU G.726	ADPCM (Adaptive Differential Pulse Code Modulation)
ITU G.727	Variable-Rate ADPCM
ITU G.728	LD-CELP (Low-Delay Code Excited Linear Prediction)
ITU G.729	CS-ACELP (Conjugate Structure Algebraic-Code Excited Linear Prediction)

An administrator can export VoIP settings to configure various codec data rates and frame rates to improve voice quality in VoIP transmissions. To create a VoIP profile:

1. Click Include Profiles in this package.
2. Click VoIP.
3. Click Add to open the Create VoIP Profiles page.
4. Select the Codec bandwidth, application usage, and frame rate. For Voice Data:

G711 has 10ms frame rate with 64kbps bit rate
G722 has 10ms frame rate with 64kbps bit rate
G723 has 30ms frame rate with either 5.3kbps or 6.4kbps bit rate
G726-32 has 10ms frame rate with 32kbps bit rate
G728 has 2.5ms frame rate with 16kbps bit rate
G729 has 10ms frame rate with 10kbps bit rate

Select parameters from the drop down menus.

Codec	Usage	Frame Rate
G711_64kbps G722_64kbps G722_56kbps G722_48kbps G722_1_32kbps G722_1_24kbps G722_1_16kbps G726_16kbps G726_24kbps G726_32kbps G726_40kbps G728_16kbps G729a_8kbps G729e_11_8kbps GIPS_iPCM_VARIABLE G722_2_VARIABLE	Interactive voice Audio conference Voice data Video Streaming audio	20 30

5. Click OK to return to the Profiles list.
6. Click Close to save the profile settings to a package.

Application Settings

An administrator can configure the WiFi connection utility Application Settings to control how the application behaves on the user's computer, and to select what level of control users have over various aspects of their wireless connections. See Application Settings.

Adapter Settings

An administrator can configure the adapter settings for the WiFi adapter installed on the user's computer. See Adapter Settings.

EAP-FAST A-ID Groups

An Authority Identifier (A-ID) is the RADIUS server that provisions Protected Access Credentials (PACs) A-ID groups. A-ID groups are shared by all users of the computer and allow EAP-FAST profiles to support multiple PACs from multiple A-IDs. The A-ID groups can be pre-configured by the administrator and set up through an Administrator Package on a user's computer. When a wireless network profile encounters a server with an A-ID within the same group of the A-ID specified in the wireless network profile, it uses this PAC without a prompt to the user.

To add an A-ID Group:

1. Select Include A-ID Groups.
2. Click Add.
3. Enter a new A-ID group name.
4. Click OK. The A-ID group is added to the A-ID Group list.

If the A-ID group is locked, then additional A-IDs cannot be added to the group.

To add an A-ID to an A-ID group:

1. Select a group from the A-ID Groups list.
2. Click Add in the A-IDs section.
3. Select an A-ID.
4. Click OK. The A-ID is added to the list.