Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Trying to configure RADIUS for a college network, and have run into the following frustration:

I can't set an "AND" condition for group membership of authenticated objects in the network policy rules, e.g. I'm trying to create a NPS rule that says, essentially "IF user is a member of [list of user groups] And is authenticating from a computer in [wireless computer group] then allow access.

This does not work

The screenshot above is the rule I am having trouble with. It does not work as written. The rule underneath it, which is identical in every aspect except the conditions rule, does work.

This does work

I've tried changing the non-working rule to define each set of groups as "Windows group" rather than specifically as machine and user groups, with no change.

With the "faulty" rule enabled and the working one disabled, any attempt to login with a valid account from a machine that is in the wireless computers group gives a 6273 audit event in the windows event log: Reason code 66 - "the user attempted to use an authentication method that is not enabled on the matching network policy". Disabling the "faulty" rule, enabling the other rule and logging in with the same account and computer works just fine.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Under conditions tab, rather then adding all groups into one condition rule, add a group to each rule/line. Basically add a user group, then click add do it again, where you'll have a list of "user groups" under condition column. When you add all groups into one condition line they default to OR.

share|improve this answer
    
Thanks Bret - I want several users groups in an "OR" statement together, and combine that with an "AND" - e.g. what I'm trying to say is "Allow users from any of the following groups AND who are using a computer in the following group" –  RobM Jun 6 '11 at 13:32
1  
Your rules in the picture above do exactly what you just described. Are you trying to use NPS to allow computers on Wireless using 802.1x? If so you will have troubles trying to force computer AND user auth. I believe you'll need to choose one or the other. Windows will auth as computer when no user is logged in, and will auth as the user when someone is logged in... but not both at the same time. support.microsoft.com/kb/929847/en-us –  Bret Fisher Jun 6 '11 at 14:55
    
You're absolutely right Bret. That is what we're trying to do and from that kbase article it won't work. How annoying. Thanks for your time! –  RobM Jun 6 '11 at 17:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.