Finding PEAP/802.1x Usernames on Windows

Finding PEAP/802.1x Usernames in Windows: A Comprehensive Guide

In this article, we will discuss the process of finding PEAP (Protected EAP) / 802.1x usernames in Windows environments. This is particularly useful in scenarios where you need to identify username account details for devices authenticated in an 802.1x network.

Overview of PEAP/802.1x Authentication

PEAP/802.1x is a standard for network access control that utilizes the Extensible Authentication Protocol (EAP) to secure user authentication. Through this method, devices connecting to a network are required to provide valid credentials before access is granted. This provides an additional layer of security compared to traditional network authentication methods.

Finding PEAP/802.1x Usernames in Windows

There are multiple methods for finding PEAP/802.1x usernames in Windows. We'll cover the following:

• Using the Event Viewer
• Parsing EAP Logs with PowerShell

Method 1: Using the Event Viewer

The Event Viewer is a built-in Windows utility that logs system, security, and application events. When PEAP/802.1x authentication occurs, details about the event are logged in the Event Viewer. Follow these steps to find usernames:

1. Press Win + R and type eventvwr. Press Enter to open the Event Viewer.
2. In the left pane, navigate to Windows Logs > Security.
3. Click on the "Filter Current Log" option in the right pane.
4. In the "Event sources" field, select Authentication Packages (Windows-AuthPackages) and click "OK".
5. In the main window, look for events with an ID of 6273. This indicates successful PEAP/802.1x authentication. Double-click on an event to view its details.
6. In the event details, locate the "Authentication Package" value. This is typically set to MS-EAP-PEAP or MS-EAP-TLS.
7. Below the "Authentication Package" value, find the "Authentication ID" field. This contains the username used for authentication in the format DOMAIN\Username.

Method 2: Parsing EAP Logs with PowerShell

An alternative method for finding PEAP/802.1x usernames is to parse the EAP logs using PowerShell. Follow these steps:

1. Press Win + X and select "Windows PowerShell (Admin)" or "PowerShell (Admin)" from the menu.
2. Run the following command to locate the EAP log files:

3. To parse the logs and extract usernames, use the following command:

This command will output the usernames and domains for each successful authentication event found in the EAP logs.

In this article, we covered the process of finding PEAP/802.1x usernames in Windows using the Event Viewer and PowerShell. Utilizing these methods can help identify account details for devices connecting to an 802.1x network, aiding in establishing a secure network and troubleshooting connectivity issues.

References

• 802.1X Authentication and PEAP (Microsoft Docs)
• Select-Node (Microsoft Docs)