Hello there, we're having some problems with windows user password changes in our 802.1x network environment and as I'm not sure how to deal with it, I'd like to ask for help.
Our environment:
We are running windows domain on top of 802.1x-enabled network with single sign on, meaning that user has single credentials for both the network and his AD account. Network-wise, if the user authenticates successfully against our MS NPS (radius) servers, he is placed into authenticated vlan. If he doesn’t, he is placed into guest (unauthenticated) vlan, with no way of reaching the AD computers.
As far as I know, the Windows computer first authenticates to the network and then tries to reach the domain and log in via domain account. This generally does work very well, however we have some problems with situation where user tries to log in with expired password.
What works:
Due to our AD password expiration policy, user passwords expire every few months. After user tries to log in with expired password, he is greeted with windows password reset dialog. If the user enters password that meets the complexity requirements, he changes his password successfully. So far so good.
What does not work:
If the user enters password that doesn’t meet the complexity requirements, he is not informed about this failure, but this failure is recorded in the NPS Event log (event ID 6273). This results in “access denied” for the user, which means that the user ends up in unauthorized (guest) network. However, Windows logs the user in successfully (with the expired password!). How is this possible?
User password isn’t changed, checkbox "User must change password at next logon" is checked in his AD profile. If the user tries to log in again, he is again greeted with password reset dialog and if he again fails to meet the complexity requirements, the whole problem repeats itself.
The problem seems to be that the NPS deny message (The user could not change his or her password because the new password did not meet the password requirements for this network) is something windows doesn't understand and instead of showing the user another password dialog, it just fails completely and falls into unauthorized VLAN. But this is just pure speculation.
I'm also attaching screenshots of the event log message and our 802.1x wired profile settings.
