Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

hi I've attempted the following guide and in a bit of a pickle.

My main goal is to have a username / password based wireless authentication with active directory integration.

I keep getting the error

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.
Security ID: domain\rhysbeta
Account Name: rhysbeta
Account Domain: domain Fully Qualified Account Name: domain\rhysbeta

Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
OS-Version: -
Called Station Identifier: 00-12-BF-00-71-3C:wirelessname
Calling Station Identifier: 00-23-76-5D-1E-31

NAS IPv4 Address:
NAS IPv6 Address: -
NAS Identifier: -
NAS Port-Type: Wireless - IEEE 802.11
NAS Port: 2

RADIUS Client:
Client Friendly Name: Belkin54g
Client IP Address: x.x.x.10

Authentication Details:
Connection Request Policy Name: Secure Wireless Connections
Network Policy Name: Secure Wireless Connections
Authentication Provider: Windows
Authentication Server:
Authentication Type: EAP
EAP Type: -
Account Session Identifier: -
Logging Results: Accounting information was written to the local log file.
Reason Code: 22
Reason: The client could not be authenticated because the Extensible Authentication Protocol (EAP) Type cannot be processed by the server.

I would love to have it so that non domain devices

share|improve this question
Does your NPS server have a valid machine certificate? –  Nic Nov 10 '11 at 8:55
Yep, but not a global verified only self signed by PDC. –  Aceth Nov 20 '12 at 13:29
Did you ever figure this out? We're experiencing the same issue on some Ubuntu machines here.. The EAP Type should say "Microsoft: Secured password (EAP-MSCHAP v2)" but it is blank. –  Plux Jun 27 '14 at 8:34
To be honest I have completely forgotten about this project, I know I got it working in the end, I'll have a look in work tomorrow and report back –  Aceth Jun 29 '14 at 15:37

1 Answer 1

Start diagnosting from CAPI2 (Eventlog -> Applications and Services -> Microsoft -> CAPI2 -> Operational -> Enable). There are tons of things you can miss. First diagnose on client side, second on server side. There also was an issue with SChannel when you have too many trusted Root CAs installed on your system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.