@echo off setlocal EnableExtensions EnableDelayedExpansion title Poytek WiFi Fix - Windows 7 - v2.0.0 rem =========================================================================== rem Poytek WiFi Fix for Windows 7 SP1 x64 rem Version 2.0.0 (Unified Resilient Edition) rem rem Purpose rem Repairs WPA2-Enterprise / PEAP-MSCHAPv2 association with SSID "Poytek" rem on Windows 7 SP1 x64 clients. rem rem Key Architectural Corrections in v2.0.0: rem 1. Non-blocking prerequisite: evaluates rastls.dll without halting execution. rem 2. RFC 5280 compliance: PURGES Leaf Cert (CA:FALSE) from Root store to fix rem CERT_E_ROLE / TRUST_E_BASIC_CONSTRAINTS (Alert 49 / Error 0x80420204). rem 3. Dual-Store Isolation: Root CA -> LocalMachine\Root & CA. rem Leaf Cert -> LocalMachine\CA & TrustedPeople (Never in Root). rem 4. WLAN Profile XML: Pins ONLY Root CA under . rem Declares explicit for Subject DN collision resolution. rem 5. Crypto Cache: Resyncs CAPI2 chain cache and restarts network services. rem =========================================================================== set "FIX_VERSION=2.0.0" set "WORK=%ProgramData%\Poytek\WiFiFix" set "LOG=%WORK%\fix_v2.log" set "SSID_NAME=Poytek" set "REBOOT_REQUIRED=1" set "PROFILE_APPLIED=0" rem Poytek RADIUS Root CA - self signed, CA:TRUE, valid 2026-07-05 to 2036-07-02 set "CA_SHA1=996426851C342052387AC541D6D7904E3C3FE621" rem Active Poytek RADIUS server certificate - EKU serverAuth, valid 2026-07-29 to 2027-07-29 set "LEAF_SHA1=466DD2083C6960C17A38C572C09F646F8F07ECCF" rem Recommended minimum rastls.dll build containing EAP TLS 1.2 support set "RASTLS_MIN=6.1.7601.18540" rem --------------------------------------------------------------------------- rem Elevation check rem --------------------------------------------------------------------------- net session >nul 2>&1 if errorlevel 1 ( echo Requesting administrator permission... >"%temp%\poytek-elevate.vbs" echo Set UAC = CreateObject^("Shell.Application"^) >>"%temp%\poytek-elevate.vbs" echo UAC.ShellExecute "%~s0", "", "", "runas", 1 cscript //nologo "%temp%\poytek-elevate.vbs" del /f /q "%temp%\poytek-elevate.vbs" >nul 2>&1 exit /b 0 ) rem --------------------------------------------------------------------------- rem Supported platform guard - Windows 7 SP1 x64 only rem --------------------------------------------------------------------------- set "WIN_VER=" for /f "tokens=3" %%A in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentVersion 2^>nul ^| findstr /I /C:"CurrentVersion"') do set "WIN_VER=%%A" set "CSD_VER=" for /f "tokens=3" %%A in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v CSDVersion 2^>nul ^| findstr /I /C:"CSDVersion"') do set "CSD_VER=%%A" set "IS_X64=0" if /I "%PROCESSOR_ARCHITECTURE%"=="AMD64" set "IS_X64=1" if defined PROCESSOR_ARCHITEW6432 if /I "%PROCESSOR_ARCHITEW6432%"=="AMD64" set "IS_X64=1" if not "%WIN_VER%"=="6.1" ( echo. echo This repair tool only supports Windows 7. echo Detected Windows version: %WIN_VER% echo No change was made. echo. pause exit /b 10 ) if /I not "%CSD_VER%"=="0x100" ( echo. echo Windows 7 Service Pack 1 is required. echo Detected service pack value: %CSD_VER% echo No change was made. echo. pause exit /b 11 ) if not "%IS_X64%"=="1" ( echo. echo This repair tool only supports the 64-bit ^(x64^) edition of Windows 7. echo Detected architecture: %PROCESSOR_ARCHITECTURE% echo No change was made. echo. pause exit /b 12 ) rem --------------------------------------------------------------------------- rem Working directory, timestamped backup directory, log rem --------------------------------------------------------------------------- if not exist "%WORK%" mkdir "%WORK%" >nul 2>&1 set "TS=" for /f "delims=" %%T in ('powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-Date -Format yyyyMMdd-HHmmss" 2^>nul') do if not defined TS set "TS=%%T" if not defined TS set "TS=notimestamp" set "BACKUP=%WORK%\backup-%TS%" if not exist "%BACKUP%" mkdir "%BACKUP%" >nul 2>&1 >"%LOG%" echo Poytek WiFi Fix %FIX_VERSION% >>"%LOG%" echo Started: %date% %time% >>"%LOG%" echo Windows version: %WIN_VER% ServicePack: %CSD_VER% Arch: %PROCESSOR_ARCHITECTURE% >>"%LOG%" echo Computer: %COMPUTERNAME% >>"%LOG%" echo Backup directory: %BACKUP% >>"%LOG%" echo Expected Poytek Root CA SHA1: %CA_SHA1% >>"%LOG%" echo Expected Poytek RADIUS server certificate SHA1: %LEAF_SHA1% >>"%LOG%" echo No password or secret is ever written to this log. >>"%LOG%" echo. cls echo ===================================================================== echo Poytek Wi-Fi Repair Tool for Windows 7 (v%FIX_VERSION%) echo ===================================================================== echo. echo Please wait. Do not close this window. echo. rem --------------------------------------------------------------------------- rem STAGE 1 - non-blocking diagnostic & prerequisite evaluation rem --------------------------------------------------------------------------- set "STAGE=1-evidence-and-eap-check" >>"%LOG%" echo === STAGE 1: collecting evidence and checking EAP binary === echo [*] Step 1/6: Checking Windows environment and TLS components... netsh.exe wlan show drivers >"%BACKUP%\wlan-drivers.txt" 2>&1 netsh.exe wlan show interfaces >"%BACKUP%\wlan-interfaces.txt" 2>&1 netsh.exe wlan show profiles >"%BACKUP%\wlan-profiles.txt" 2>&1 wmic qfe get HotFixID^,InstalledOn /format:table >"%BACKUP%\installed-updates.txt" 2>&1 powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$out=@(); foreach($s in @('Cert:\LocalMachine\Root','Cert:\LocalMachine\CA','Cert:\LocalMachine\My','Cert:\LocalMachine\TrustedPeople','Cert:\CurrentUser\Root','Cert:\CurrentUser\CA','Cert:\CurrentUser\My')){ if(Test-Path $s){ Get-ChildItem $s | Where-Object { ($_.Subject + ' ' + $_.Issuer) -match '(?i)poytek' } | ForEach-Object { $out += ($s + ' | ' + ($_.Thumbprint -replace ' ','').ToUpper() + ' | ' + $_.Subject + ' | issuer=' + $_.Issuer + ' | NotBefore=' + $_.NotBefore.ToString('s') + ' | NotAfter=' + $_.NotAfter.ToString('s')) } } }; if($out.Count -eq 0){ $out = @('none') }; Set-Content -LiteralPath '%BACKUP%\poytek-certificates-before.txt' -Value $out" >>"%LOG%" 2>&1 reg export "HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13" "%BACKUP%\eap13-before.reg" /y >>"%LOG%" 2>&1 reg export "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols" "%BACKUP%\schannel-protocols-before.reg" /y >>"%LOG%" 2>&1 netsh.exe wlan export profile name="%SSID_NAME%" folder="%BACKUP%" >>"%LOG%" 2>&1 set "PROFILE_BACKUP=" for %%F in ("%BACKUP%\*%SSID_NAME%*.xml") do if not defined PROFILE_BACKUP set "PROFILE_BACKUP=%%~fF" set "RASTLS_VER=" for /f "delims=" %%V in ('powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$p=Join-Path $env:windir 'System32\rastls.dll'; if(Test-Path $p){ (Get-Item $p).VersionInfo.FileVersion } else { 'missing' }" 2^>nul') do if not defined RASTLS_VER set "RASTLS_VER=%%V" if not defined RASTLS_VER set "RASTLS_VER=unknown" >>"%LOG%" echo Effective System32\rastls.dll file version: %RASTLS_VER% set "NEED_KB=0" powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$p=Join-Path $env:windir 'System32\rastls.dll'; if(-not (Test-Path $p)){ exit 1 }; $raw=(Get-Item $p).VersionInfo.FileVersion; if($raw -notmatch '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)'){ exit 1 }; if([version]$matches[1] -lt [version]'%RASTLS_MIN%'){ exit 1 }; exit 0" >>"%LOG%" 2>&1 if errorlevel 1 ( >>"%LOG%" echo rastls.dll is older than %RASTLS_MIN%. Will attempt local update if present, but continuing configuration non-blockingly. set "NEED_KB=1" ) rem Check for local KB package alongside script or in files/ subfolder if exist "%~dp0Windows6.1-KB2977292-x64.msu" ( echo Found local update package Windows6.1-KB2977292-x64.msu. Applying... >>"%LOG%" echo Applying local update package from script directory... wusa.exe "%~dp0Windows6.1-KB2977292-x64.msu" /quiet /norestart >>"%LOG%" 2>&1 ) else if exist "%~dp0files\Windows6.1-KB2977292-x64.msu" ( echo Found local update package in files folder. Applying... >>"%LOG%" echo Applying local update package from files directory... wusa.exe "%~dp0files\Windows6.1-KB2977292-x64.msu" /quiet /norestart >>"%LOG%" 2>&1 ) if "%NEED_KB%"=="1" ( echo [i] Note: Legacy EAP TLS component detected. Continuing automatic configuration... ) else ( echo [+] TLS 1.2 EAP component verified. ) rem --------------------------------------------------------------------------- rem STAGE 2 - purge malformed / conflicting certificates (Fix Root Pollution) rem --------------------------------------------------------------------------- set "STAGE=2-certificate-cleanup" >>"%LOG%" echo. >>"%LOG%" echo === STAGE 2: purging conflicting certificates and correcting stores === echo [*] Step 2/6: Purging conflicting certificates and correcting stores... rem CRITICAL FIX: Delete the Leaf certificate from Root store if v1.3.0 put it there certutil.exe -delstore Root %LEAF_SHA1% >>"%LOG%" 2>&1 certutil.exe -delstore -user Root %LEAF_SHA1% >>"%LOG%" 2>&1 powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$keep=@('%CA_SHA1%','%LEAF_SHA1%'); $stores=@('Cert:\LocalMachine\Root','Cert:\LocalMachine\CA','Cert:\LocalMachine\TrustedPeople','Cert:\LocalMachine\My','Cert:\CurrentUser\Root','Cert:\CurrentUser\CA'); foreach($s in $stores){ if(-not (Test-Path $s)){ continue }; foreach($c in @(Get-ChildItem $s)){ $tp=($c.Thumbprint -replace ' ','').ToUpper(); if($keep -contains $tp){ continue }; if(($c.Subject + ' ' + $c.Issuer) -match '(?i)poytek'){ try { Remove-Item -LiteralPath $c.PSPath -Force -ErrorAction Stop; Add-Content -LiteralPath '%LOG%' -Value ('Removed ' + $s + ' , ' + $tp + ' , ' + $c.Subject) } catch {} } } }" >>"%LOG%" 2>&1 echo [+] Certificate stores cleaned from invalid/conflicting anchors. rem --------------------------------------------------------------------------- rem STAGE 3 - deploy certificates (RFC 5280 Compliant Store Assignment) rem --------------------------------------------------------------------------- set "STAGE=3-certificate-install" >>"%LOG%" echo. >>"%LOG%" echo === STAGE 3: deploying certificates via RFC 5280 compliant store assignment === echo [*] Step 3/6: Deploying Poytek Root CA and Server Certificate... set "CA_B64=MIIDdzCCAl+gAwIBAgIUd4EKjia9UISZGsDfybHakEq9E7wwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCSVIxEDAOBgNVBAgMB0lzZmFoYW4xDzANBgNVBAoMBlBveXRlazEZMBcGA1UEAwwQcG95dGVrLXYyLXJhZGl1czAeFw0yNjA3MDUwNDI2MjBaFw0zNjA3MDIwNDI2MjBaMEsxCzAJBgNVBAYTAklSMRAwDgYDVQQIDAdJc2ZhaGFuMQ8wDQYDVQQKDAZQb3l0ZWsxGTAXBgNVBAMMEHBveXRlay12Mi1yYWRpdXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6Yz4g97g5NRi7Pxe21V13uI8vjB5H4sOZI37iB/T4uM0RF8pZR6ruX2UwgZ6I4JwCH3aFYW+juuU3UEuYaaokOfKAzi0t8mDxEJjfVyzGagR9NaGmfVpnoG/q9G0ApXtR8O6E1LZIXzBqFvuMf/3tGCqG2lFFEBhYx4WgTfteS3CcGYVp83Cncn2KP67shcowafXmASIMqJ6CNI+BbLcKWZ5Ref+R9i7r8LBKjAprPTihifs5PtdiudSsTkdDp1os8vmfiigLVTm+9GdWEvNVuakp1LWpJo87x6Tb/PhZ2+pKtVmgVxx7yRxGMbdro+EsTPgGW6i9V+gxLD2Bhbq9AgMBAAGjUzBRMB0GA1UdDgQWBBTRZkxo756pZXiEScpdDqBhqRZZzDAfBgNVHSMEGDAWgBTRZkxo756pZXiEScpdDqBhqRZZzDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBfs5CU+HOGCX2sdr4EQyamXXc1NMAIeb7DMsKq5A2Nltx2o0v+TUB0mRNHLgtGuQ3Xk+N08xNPO9lbdjx4Kn7I2MmLI9JVi5XjAEixlfGLD0NAyBd2qj4L8Y0+J3m5rlkttqFvwD++zqEtOVdp+wJyvTDZPKH9Yzvz5b12GiKibSVomIUnnSPlO4JpYFukchKemYvo7VCJxvq8wz4ZXL6LkOPW/pQvqCWqsw5ph48iyI2rHHAHgoDHP+Trts5kQ4pF/w7IYlI02BnF+5mrum6bdORjnqgV2Jdhst6T7ILtxfaoRJGZ0y+BedWPa+nqkbLPVy3f4LvGKJTpKNQZXpOB" set "LEAF_B64=MIIESDCCAzCgAwIBAgIRAMkza7zLyBFS9vZPIZ5o8scwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCSVIxEDAOBgNVBAgMB0lzZmFoYW4xDzANBgNVBAoMBlBveXRlazEZMBcGA1UEAwwQcG95dGVrLXYyLXJhZGl1czAeFw0yNjA3MjkwODAwNDZaFw0yNzA3MjkwODAwNDZaMEsxCzAJBgNVBAYTAklSMRAwDgYDVQQIDAdJc2ZhaGFuMQ8wDQYDVQQKDAZQb3l0ZWsxGTAXBgNVBAMMEHBveXRlay12Mi1yYWRpdXMwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQC9BSFNmMPGFZ1Tx3MDePcT5OTtt3cVRazXJ8HPhbr2bztfLwoZUl8j5TgYy4ISNUP3ORjLpNm175m/C3CFunDgV/PAKkTBQut+LEM9g7MJ/ypoUR+PH2XzyEt9zi/mNZLbt0NCSwW6Cl3ZxazglgFWCBXNwH8zqkLB6rNH/YXBqTQ9zPnluFNXMdI72Epm+sfqh/55tgUabV6JTSEBFDPpK5w/HlcqxcAkA9naZBTxpLmk/p9Hkotug3lOP7JVr7a/ETRmLxvhBk+SlcspT1sZHypIS1zChwYBJf8i5ZYU5HerkXzjObIig+NWtHFw6xjnRa3d/4YKwioKG4P6lGN896YrRyslilRmPgTsAccbbcj9t6yEhYLHPOXscl8vJrqJzukvjmZv5BjXCZi8H5bKFuL1UoWz0OHQGKuwbxt5+V432rlY7AtnwtKguuozsRfdarDCplJuR7lJBQJmUBvvz4Fj0WYE2yvp4U5i9DaIGlllFDIf63p9TB2paqjyxE0CAwEAAaOBpjCBozAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQURMWctqbjL+MYH/FcdKXB3h5E5+4wHwYDVR0jBBgwFoAU0WZMaO+eqWV4hEnKXQ6gYakWWcwwLgYDVR0RBCcwJYIQcG95dGVrLXYyLXJhZGl1c4IRcmFkaXVzLnBveXRlay5jb20wDQYJKoZIhvcNAQELBQADggEBABhKECdiKl9+dfixyeoErXopQ4Me5zdGwqOGLSSuxUEDmCE/wnaiQLUS5bbgukrj+gDkiBPkVadsottoA91pTwnsKGVEqqjCYiIjdKJmodDDxQrT8blxw3qphuxWEGTPAXFoswg+C25HIJO6nGWraLZxL92vvryCH3QLRXFEhx32txEJ5/MeewCoF+jsSpku8rMts/WrWfbck4QUvDmD3bvnVRBtlEt2+YtK5zR8KX7dBjnBzNcTicmtxeYVogN3ZUQzElRcu7by9qFJcqX679nJY4DA00L8VqOSjuJCyIcpJ8pw6bH1eiOlCGSzaCCuK24jUJ8c/zZLwzkCaTmNa9g=" del /f /q "%WORK%\poytek-ca.b64" "%WORK%\poytek-ca.cer" "%WORK%\poytek-radius.b64" "%WORK%\poytek-radius.cer" >nul 2>&1 >"%WORK%\poytek-ca.b64" echo %CA_B64% certutil.exe -f -decode "%WORK%\poytek-ca.b64" "%WORK%\poytek-ca.cer" >>"%LOG%" 2>&1 if errorlevel 1 goto :cert_decode_error >"%WORK%\poytek-radius.b64" echo %LEAF_B64% certutil.exe -f -decode "%WORK%\poytek-radius.b64" "%WORK%\poytek-radius.cer" >>"%LOG%" 2>&1 if errorlevel 1 goto :cert_decode_error rem 1. Root CA (CA:TRUE) -> LocalMachine Root & CA >>"%LOG%" echo Installing Root CA into LocalMachine Root and CA stores. certutil.exe -addstore -f Root "%WORK%\poytek-ca.cer" >>"%LOG%" 2>&1 if errorlevel 1 goto :cert_store_error certutil.exe -addstore -f CA "%WORK%\poytek-ca.cer" >>"%LOG%" 2>&1 if errorlevel 1 goto :cert_store_error rem 2. Leaf Certificate (CA:FALSE) -> LocalMachine CA & TrustedPeople (NEVER Root) >>"%LOG%" echo Installing Leaf Certificate into LocalMachine CA and TrustedPeople stores. certutil.exe -addstore -f CA "%WORK%\poytek-radius.cer" >>"%LOG%" 2>&1 if errorlevel 1 goto :cert_store_error certutil.exe -addstore -f TrustedPeople "%WORK%\poytek-radius.cer" >>"%LOG%" 2>&1 if errorlevel 1 goto :cert_store_error echo [+] Poytek certificates securely registered in appropriate trust stores. rem --------------------------------------------------------------------------- rem STAGE 4 - registry configurations (Schannel & EAP-TLS 1.2) rem --------------------------------------------------------------------------- set "STAGE=4-registry" >>"%LOG%" echo. >>"%LOG%" echo === STAGE 4: enabling TLS 1.2 for Schannel and EAP engine === echo [*] Step 4/6: Enabling TLS 1.2 for Schannel and EAP engine... reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 0 /f >>"%LOG%" 2>&1 if errorlevel 1 goto :registry_error reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 1 /f >>"%LOG%" 2>&1 if errorlevel 1 goto :registry_error reg add "HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13" /v TlsVersion /t REG_DWORD /d 3072 /f >>"%LOG%" 2>&1 if errorlevel 1 goto :registry_error reg add "HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\25" /v TlsVersion /t REG_DWORD /d 3072 /f >>"%LOG%" 2>&1 if errorlevel 1 goto :registry_error echo [+] Registry configuration for TLS 1.2 applied. rem --------------------------------------------------------------------------- rem STAGE 5 - construct and install Wi-Fi Profile XML rem --------------------------------------------------------------------------- set "STAGE=5-wlan-profile" >>"%LOG%" echo. >>"%LOG%" echo === STAGE 5: building and registering Poytek WLAN profile === echo [*] Step 5/6: Building and registering Poytek WLAN profile... set "PROFILE_B64=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVMtQVNDSUkiPz4KPFdMQU5Qcm9maWxlIHhtbG5zPSJodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vbmV0d29ya2luZy9XTEFOL3Byb2ZpbGUvdjEiPgogIDxuYW1lPlBveXRlazwvbmFtZT4KICA8U1NJRENvbmZpZz4KICAgIDxTU0lEPgogICAgICA8aGV4PjUwNkY3OTc0NjU2QjwvaGV4PgogICAgICA8bmFtZT5Qb3l0ZWs8L25hbWU+CiAgICA8L1NTSUQ+CiAgPC9TU0lEQ29uZmlnPgogIDxjb25uZWN0aW9uVHlwZT5FU1M8L2Nvbm5lY3Rpb25UeXBlPgogIDxjb25uZWN0aW9uTW9kZT5hdXRvPC9jb25uZWN0aW9uTW9kZT4KICA8YXV0b1N3aXRjaD5mYWxzZTwvYXV0b1N3aXRjaD4KICA8TVNNPgogICAgPHNlY3VyaXR5PgogICAgICA8YXV0aEVuY3J5cHRpb24+CiAgICAgICAgPGF1dGhlbnRpY2F0aW9uPldQQTI8L2F1dGhlbnRpY2F0aW9uPgogICAgICAgIDxlbmNyeXB0aW9uPkFFUzwvZW5jcnlwdGlvbj4KICAgICAgICA8dXNlT25lWD50cnVlPC91c2VPbmVYPgogICAgICA8L2F1dGhFbmNyeXB0aW9uPgogICAgICA8T25lWCB4bWxucz0iaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL25ldHdvcmtpbmcvT25lWC92MSI+CiAgICAgICAgPGNhY2hlVXNlckRhdGE+dHJ1ZTwvY2FjaGVVc2VyRGF0YT4KICAgICAgICA8YXV0aE1vZGU+dXNlcjwvYXV0aE1vZGU+CiAgICAgICAgPEVBUENvbmZpZz4KICAgICAgICAgIDxFYXBIb3N0Q29uZmlnIHhtbG5zPSJodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcHJvdmlzaW9uaW5nL0VhcEhvc3RDb25maWciCiAgICAgICAgICAgICB4bWxuczplYXBDb21tb249Imh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wcm92aXNpb25pbmcvRWFwQ29tbW9uIgogICAgICAgICAgICAgeG1sbnM6YmFzZUVhcD0iaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Byb3Zpc2lvbmluZy9CYXNlRWFwTWV0aG9kQ29uZmlnIj4KICAgICAgICAgICAgPEVhcE1ldGhvZD4KICAgICAgICAgICAgICA8ZWFwQ29tbW9uOlR5cGU+MjU8L2VhcENvbW1vbjpUeXBlPgogICAgICAgICAgICAgIDxlYXBDb21tb246QXV0aG9ySWQ+MDwvZWFwQ29tbW9uOkF1dGhvcklkPgogICAgICAgICAgICA8L0VhcE1ldGhvZD4KICAgICAgICAgICAgPENvbmZpZyB4bWxuczpiYXNlRWFwPSJodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcHJvdmlzaW9uaW5nL0Jhc2VFYXBDb25uZWN0aW9uUHJvcGVydGllc1YxIgogICAgICAgICAgICAgICAgICAgIHhtbG5zOm1zUGVhcD0iaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Byb3Zpc2lvbmluZy9Nc1BlYXBDb25uZWN0aW9uUHJvcGVydGllc1YxIgogICAgICAgICAgICAgICAgICAgIHhtbG5zOm1zQ2hhcFYyPSJodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcHJvdmlzaW9uaW5nL01zQ2hhcFYyQ29ubmVjdGlvblByb3BlcnRpZXNWMSI+CiAgICAgICAgICAgICAgPGJhc2VFYXA6RWFwPgogICAgICAgICAgICAgICAgPGJhc2VFYXA6VHlwZT4yNTwvYmFzZUVhcDpUeXBlPgogICAgICAgICAgICAgICAgPG1zUGVhcDpFYXBUeXBlPgogICAgICAgICAgICAgICAgICA8bXNQZWFwOlNlcnZlclZhbGlkYXRpb24+CiAgICAgICAgICAgICAgICAgICAgPG1zUGVhcDpEaXNhYmxlVXNlclByb21wdEZvclNlcnZlclZhbGlkYXRpb24+dHJ1ZTwvbXNQZWFwOkRpc2FibGVVc2VyUHJvbXB0Rm9yU2VydmVyVmFsaWRhdGlvbj4KICAgICAgICAgICAgICAgICAgICA8bXNQZWFwOlNlcnZlck5hbWVzPnBveXRlay12Mi1yYWRpdXM7cmFkaXVzLnBveXRlay5jb208L21zUGVhcDpTZXJ2ZXJOYW1lcz4KICAgICAgICAgICAgICAgICAgICA8bXNQZWFwOlRydXN0ZWRSb290Q0E+OTk2NDI2ODUxQzM0MjA1MjM4N0FDNTQxRDZENzkwNEUzQzNGRTYyMTwvbXNQZWFwOlRydXN0ZWRSb290Q0E+CiAgICAgICAgICAgICAgICAgIDwvbXNQZWFwOlNlcnZlclZhbGlkYXRpb24+CiAgICAgICAgICAgICAgICAgIDxtc1BlYXA6RmFzdFJlY29ubmVjdD5mYWxzZTwvbXNQZWFwOkZhc3RSZWNvbm5lY3Q+CiAgICAgICAgICAgICAgICAgIDxtc1BlYXA6SW5uZXJFYXBPcHRpb25hbD5mYWxzZTwvbXNQZWFwOklubmVyRWFwT3B0aW9uYWw+CiAgICAgICAgICAgICAgICAgIDxiYXNlRWFwOkVhcD4KICAgICAgICAgICAgICAgICAgICA8YmFzZUVhcDpUeXBlPjI2PC9iYXNlRWFwOlR5cGU+CiAgICAgICAgICAgICAgICAgICAgPG1zQ2hhcFYyOkVhcFR5cGU+CiAgICAgICAgICAgICAgICAgICAgICA8bXNDaGFwVjI6VXNlV2luTG9nb25DcmVkZW50aWFscz5mYWxzZTwvbXNDaGFwVjI6VXNlV2luTG9nb25DcmVkZW50aWFscz4KICAgICAgICAgICAgICAgICAgICA8L21zQ2hhcFYyOkVhcFR5cGU+CiAgICAgICAgICAgICAgICAgIDwvYmFzZUVhcDpFYXA+CiAgICAgICAgICAgICAgICAgIDxtc1BlYXA6RW5hYmxlUXVhcmFudGluZUNoZWNrcz5mYWxzZTwvbXNQZWFwOkVuYWJsZVF1YXJhbnRpbmVDaGVja3M+CiAgICAgICAgICAgICAgICAgIDxtc1BlYXA6UmVxdWlyZUNyeXB0b0JpbmRpbmc+ZmFsc2U8L21zUGVhcDpSZXF1aXJlQ3J5cHRvQmluZGluZz4KICAgICAgICAgICAgICAgICAgPG1zUGVhcDpQZWFwRXh0ZW5zaW9ucyAvPgogICAgICAgICAgICAgICAgPC9tc1BlYXA6RWFwVHlwZT4KICAgICAgICAgICAgICA8L2Jhc2VFYXA6RWFwPgogICAgICAgICAgICA8L0NvbmZpZz4KICAgICAgICAgIDwvRWFwSG9zdENvbmZpZz4KICAgICAgICA8L0VBUENvbmZpZz4KICAgICAgPC9PbmVYPgogICAgPC9zZWN1cml0eT4KICA8L01TTT4KPC9XTEFOUHJvZmlsZT4=" del /f /q "%WORK%\Poytek-WiFi.xml.b64" "%WORK%\Poytek-WiFi.xml" >nul 2>&1 >"%WORK%\Poytek-WiFi.xml.b64" echo %PROFILE_B64% certutil.exe -f -decode "%WORK%\Poytek-WiFi.xml.b64" "%WORK%\Poytek-WiFi.xml" >>"%LOG%" 2>&1 if errorlevel 1 goto :profile_decode_error if not exist "%WORK%\Poytek-WiFi.xml" goto :profile_decode_error netsh.exe wlan delete profile name="%SSID_NAME%" interface=* >>"%LOG%" 2>&1 netsh.exe wlan add profile filename="%WORK%\Poytek-WiFi.xml" user=all >>"%LOG%" 2>&1 if errorlevel 1 goto :profile_apply_error netsh.exe wlan set profileparameter name="%SSID_NAME%" connectionmode=auto >>"%LOG%" 2>&1 set "PROFILE_APPLIED=1" echo [+] Poytek profile successfully added to Windows wireless manager. rem --------------------------------------------------------------------------- rem STAGE 6 - cache resynchronization & service refresh rem --------------------------------------------------------------------------- set "STAGE=6-cache-and-services" >>"%LOG%" echo. >>"%LOG%" echo === STAGE 6: resynchronizing crypto cache and refreshing network services === echo [*] Step 6/6: Resynchronizing crypto cache and refreshing network services... certutil.exe -setreg chain\ChainCacheResyncFiletime @now >>"%LOG%" 2>&1 certutil.exe -urlcache * delete >>"%LOG%" 2>&1 ipconfig /flushdns >nul 2>&1 netsh.exe wlan disconnect >>"%LOG%" 2>&1 net stop WlanSvc /y >>"%LOG%" 2>&1 net stop EapHost /y >>"%LOG%" 2>&1 net start EapHost >>"%LOG%" 2>&1 net start WlanSvc >>"%LOG%" 2>&1 rem --------------------------------------------------------------------------- rem Success rem --------------------------------------------------------------------------- set "STAGE=done" >>"%LOG%" echo. >>"%LOG%" echo === RESULT: SUCCESS === >>"%LOG%" echo Completed: %date% %time% echo. echo ===================================================================== echo REMEDIATION SUCCESSFULLY APPLIED! echo ===================================================================== echo. echo 1. Click on the Wi-Fi icon in your system tray. echo 2. Select the "%SSID_NAME%" network and click Connect. echo 3. Enter your Poytek username ^(National ID^) and password when prompted. echo. echo If connection does not initiate immediately, please restart your PC echo to ensure all Windows 7 cryptographic and TLS changes take full effect. echo. pause exit /b 0 rem =========================================================================== rem Failure handlers rem =========================================================================== :cert_decode_error set "FAIL_CODE=20" set "FAIL_TEXT=The embedded Poytek certificate could not be decoded." goto :fail :cert_store_error set "FAIL_CODE=22" set "FAIL_TEXT=A Poytek certificate could not be installed into the Windows certificate store." goto :fail :registry_error set "FAIL_CODE=30" set "FAIL_TEXT=TLS 1.2 could not be enabled for the Windows EAP client." goto :fail :profile_decode_error set "FAIL_CODE=50" set "FAIL_TEXT=The Poytek wireless profile could not be prepared." goto :fail :profile_apply_error set "FAIL_CODE=51" set "FAIL_TEXT=The Poytek wireless profile could not be applied." goto :fail :fail >>"%LOG%" echo. >>"%LOG%" echo === RESULT: FAILED === >>"%LOG%" echo Failed stage: %STAGE% >>"%LOG%" echo Failure code: %FAIL_CODE% >>"%LOG%" echo Failure: %FAIL_TEXT% del /f /q "%WORK%\poytek-ca.b64" "%WORK%\poytek-radius.b64" "%WORK%\Poytek-WiFi.xml.b64" >nul 2>&1 if "%PROFILE_APPLIED%"=="0" ( if defined PROFILE_BACKUP ( >>"%LOG%" echo Restoring previous wireless profile from !PROFILE_BACKUP! netsh.exe wlan delete profile name="%SSID_NAME%" >>"%LOG%" 2>&1 netsh.exe wlan add profile filename="!PROFILE_BACKUP!" user=all >>"%LOG%" 2>&1 ) ) if exist "%BACKUP%\eap13-before.reg" ( >>"%LOG%" echo Restoring previous EAP registry values. reg import "%BACKUP%\eap13-before.reg" >>"%LOG%" 2>&1 ) del /f /q "%WORK%\Poytek-WiFi.xml" >nul 2>&1 echo. echo ============================================================ echo The Poytek WiFi repair did NOT complete. echo ============================================================ echo. echo %FAIL_TEXT% echo Failed stage: %STAGE% echo. echo Your previous settings were restored where possible. echo Please send this log file to Poytek support: echo %LOG% echo. pause exit /b %FAIL_CODE%