-->

1. 802.1x Gpo Settings
2. 802.1x State

You should see 802.1x authentication’s settings are listed in GPO details Apply this policy to target machines. On client site, once the GPO is applied (you can run gpupdate /force in cmd.exe), user should get the settings. We do 802.1x on wired PCs and control wired NIC settings through Group Policy. Below is a sample copy of our Group Policy settings. Not sure if that is what you were looking for or if you were looking for additional parameters and settings. 802.1X Client Configuration with Group Policy. Access Group Policy Extensions for 802.1X Wired and Wireless. Open or Add and Open a Group Policy Object; Activate Default Wired or Wireless Network Policies; Open Wired or Wireless Network Policies for Editing; Configure 802.1X Wired Access Clients by using Group Policy Management.

Overview

This article includes general troubleshooting for 802.1X wireless and wired clients. While troubleshooting 802.1X and wireless, it's important to know how the flow of authentication works, and then figure out where it's breaking. It involves a lot of third-party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. We don't make access points or switches, so it's not an end-to-end Microsoft solution.

Scenarios

This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS.

Known issues

None

Data collection

See Advanced troubleshooting 802.1X authentication data collection.

Troubleshooting

Viewing NPS authentication status events in the Windows Security event log is one of the most useful troubleshooting methods to obtain information about failed authentications.

NPS event log entries contain information about the connection attempt, including the name of the connection request policy that matched the connection attempt and the network policy that accepted or rejected the connection attempt. If you don't see both success and failure events, see the NPS audit policy section later in this article.

Check Windows Security Event log on the NPS Server for NPS events that correspond to rejected (event ID 6273) or accepted (event ID 6272) connection attempts.

In the event message, scroll to the very bottom, and then check the Reason Code field and the text that's associated with it.

Example: event ID 6273 (Audit Failure)
‎Example: event ID 6272 (Audit Success)

‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one.

On the client side, go to Event Viewer (Local)Applications and Services LogsMicrosoftWindowsWLAN-AutoConfig/Operational for wireless issues. For wired network access issues, go to ..Wired-AutoConfig/Operational. See the following example:

Most 802.1X authentication issues are because of problems with the certificate that's used for client or server authentication. Examples include invalid certificate, expiration, chain verification failure, and revocation check failure.

First, validate the type of EAP method that's used:

802.1x Gpo Settings

If a certificate is used for its authentication method, check whether the certificate is valid. For the server (NPS) side, you can confirm what certificate is being used from the EAP property menu. In NPS snap-in, go to Policies > Network Policies. Select and hold (or right-click) the policy, and then select Properties. In the pop-up window, go to the Constraints tab, and then select the Authentication Methods section.

The CAPI2 event log is useful for troubleshooting certificate-related issues.By default, this log isn't enabled. To enable this log, expand Event Viewer (Local)Applications and Services LogsMicrosoftWindowsCAPI2, select and hold (or right-click) Operational, and then select Enable Log.

For information about how to analyze CAPI2 event logs, seeTroubleshooting PKI Problems on Windows Vista.

When troubleshooting complex 802.1X authentication issues, it's important to understand the 802.1X authentication process. Here's an example of wireless connection process with 802.1X authentication:

If you collect a network packet capture on both the client and the server (NPS) side, you can see a flow like the one below. Type EAPOL in the Display Filter for a client-side capture, and EAP for an NPS-side capture. See the following examples:

Client-side packet capture data

NPS-side packet capture data
‎

Note

If you have a wireless trace, you can also view ETL files with network monitor and apply the ONEX_MicrosoftWindowsOneX and WLAN_MicrosoftWindowsWLANAutoConfig Network Monitor filters. If you need to load the required parser, see the instructions under the Help menu in Network Monitor. Here's an example:

Audit policy

By default, NPS audit policy (event logging) for connection success and failure is enabled. If you find that one or both types of logging are disabled, use the following steps to troubleshoot.

View the current audit policy settings by running the following command on the NPS server:

If both success and failure events are enabled, the output should be:

If it says, 'No auditing,' you can run this command to enable it:

Even if audit policy appears to be fully enabled, it sometimes helps to disable and then re-enable this setting. You can also enable Network Policy Server logon/logoff auditing by using Group Policy. To get to the success/failure setting, select Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff > Audit Network Policy Server.

Additional references

Troubleshooting Windows Vista 802.11 Wireless Connections
Troubleshooting Windows Vista Secure 802.3 Wired Connections

For networks with 802.1X authentication, joining a domain is slightly more complicated.During 802.1X authentication, the client authenticates the server's identity by ensuring thatthe server certificate is valid and was issued by a trusted certification authority (CA). However,if you used an internal CA (such as one hosted by Windows Server 2003 certificate services)to issue the server certificate, the CA will not be trusted by default until the computer joins adomain. Therefore, to join the domain, you must temporarily configure the client computer toignore the 802.1X authentication server's certificate.

Note If you have configured your 802.1X authentication servers with a server certificateissued by a public CA that is trusted by Windows by default, you can leave the ValidateServer Certificate check box selected.

To join a domain with 802.1X authentication enabled, follow these steps:

1. Start the Services console, start the Wired AutoConfig service, and set the WiredAutoConfig service to start automatically.
2. Open Network And Sharing Center and then click Manage Adapter Settings.
3. Right-click the network adapter and then click Properties.
4. In the Properties dialog box, click the Authentication Tab. Click the Choose A NetworkAuthentication Method list and then click Microsoft: Protected EAP (PEAP).
5. Click Settings. In the Protected EAP (PEAP) Properties dialog box, clear the ValidateServer Certificate check box. Click OK twice.
6. Follow the standard instructions for joining the computer to a domain, as described inthe previous section.
7. After the computer has joined the domain and is restarted, perform steps 2 though 5again. This time, in step 5, select the Validate Server Certificate check box.

To automate this process partially, configure a computer running Windows 7 to not validatethe server certificate. Then use the Netsh lan export profile command to export a profile forthe configured network adapter. You can create a script to import that profile on other clientcomputers to allow them to join a domain without validating a server certificate.

802.1x State

In this tutorial: