3

Environment Background:
4 Domain Controllers, DC01 DC02 DC03 DC04
DC01 is my PDC
DC02 is my NPS Server
The other two are load balancing and site specific.

I'm using a Ruckus Zone Director with Ruckus WAPs in my office. Our environment consists of 80% Mac, 19% PCs, ~1% Linux computers.

We are migrating off our old wireless infrastructure to this new one. The old was utilizing MAC address filtering (pain in the butt) with a WPA2 Password; the new setup however is utilizing Radius, as we are trying to move towards Active Directory.

Not everyone has been moved to AD yet, but we are switching everyone over patiently.

All my Macs can connect to the SSID that is serving Radius MSCHAPv2 certificates (PEAP) with no issues. The PC's however are hit and miss. So far I have two users in particular that consistently fail to connect to the SSID while no one else (that we know of) is having issues.

I checked the event log on the NPS Server (DC02) and I get the below error.

Network Policy Server denied access to a user.


>Contact the Network Policy Server administrator for more information.


>User:
> Security ID: NULL SID
> Account Name: CORP\user.name
> Account Domain: CORP
> Fully Qualified Account Name: CORP\user.name


>Client Machine:
> Security ID: NULL SID
> Account Name: -
> Fully Qualified Account Name: -
> OS-Version: -
> Called Station Identifier: 84-18-3A-3A-03-9C:SSID-NAME
> Calling Station Identifier: 7C-7A-91-19-A3-BB


>NAS:
> NAS IPv4 Address: 172.16.1.101
> NAS IPv6 Address: -
> NAS Identifier: 84-18-3A-3A-03-9C
> NAS Port-Type: Wireless - IEEE 802.11
> NAS Port: 7


>RADIUS Client:
> Client Friendly Name: Primary-Ruckus
> Client IP Address: 172.16.1.101


>Authentication Details:
> Connection Request Policy Name: Ruckus Wireless
> Network Policy Name: -
> Authentication Provider: Windows
> Authentication Server: DC02.corp.domain.com
> Authentication Type: PEAP
> EAP Type: -
> Account Session Identifier: -
> Logging Results: Accounting information was written to the local log file.
> Reason Code: 16
> Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

I've added a Group Policy for Wireless Network (IEEE 802.11) policies and yet nothing is working.

Any tips or ideas on where I can look next? Starting to worry my rollout timeline will be pushed back.

  • Is this machine specific or user specific? Can the users logon to the wifi with their credentials from other machines or does it fail on every machine? If the latter, it points to a configuration error in your security group, if the former it is likely a configuration error on the wireless profile of the machine. – Naryna Mar 22 '16 at 20:01
0

Alright, I've been fighting with exactly same issue for long time. It had same error message

Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

Later I found that I switched main certificates. With default Windows CA configuration, the generally trusted PositiveSSL certificate didnt worked for that.

Surprisingly, when I switched the certificate to old (almost everywhere) distrusted StartCom certificate, it started to work.

You should probably solve the certificate trust chain or get certificate from another trusted certification authority.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.