nps
11 Topics
Windows 11 clients cannot authenticate to NPS server using computer authentication
We have a Windows server 2019 datacenter server running NPS. Our WiFi Office clients authenticate to this server for access to the corporate WiFi network. We use computer authentication, so members of the "domain computers" group are allowed access in the policy (we only want domain computers on this network and we don't want users to need to enter their user credentials). We use GPO to provision a WiFi profile to the domain computers, in which we configure that computer authentication is needed. Our Windows 10 clients (literally all of them) are connecting nicely (I have anonimized the event log for security purposes: Network Policy Server granted access to a user. User: Security ID: DOMAIN\COMPUTER$ Account Name: host/COMPUTER.domain.nl Account Domain: DOMAIN Fully Qualified Account Name: DOMAIN\COMPUTER$ Client Machine: Security ID: NULL SID Account Name: - Fully Qualified Account Name: - Called Station Identifier: xx-xx-xx-xx-xx-xx:SSID Calling Station Identifier: XX-XX-XX-XX-XX-XX NAS: NAS IPv4 Address: x.x.x.x NAS IPv6 Address: - NAS Identifier: AP01 NAS Port-Type: Wireless - IEEE 802.11 NAS Port: 1 RADIUS Client: Client Friendly Name: SonicPoint HQ 1 Client IP Address: x.x.x.x Authentication Details: Connection Request Policy Name: NAP 802.1X (Wireless) Network Policy Name: NAP 802.1X (Wireless) Non NAP-Capable Authentication Provider: Windows Authentication Server: NPS.DOMAIN.nl Authentication Type: PEAP EAP Type: Microsoft: Secured password (EAP-MSCHAP v2) Account Session Identifier: "edited" Logging Results: Accounting information was written to the local log file. When a Windows 11 client (all of them actually) tries to connect, we see the following logged (again, anonimized): Network Policy Server denied access to a user. Contact the Network Policy Server administrator for more information. User: Security ID: NULL SID Account Name: host/COMPUTER.domain.nl Account Domain: DOMAIN Fully Qualified Account Name: DOMAIN\COMPUTER$ Client Machine: Security ID: NULL SID Account Name: - Fully Qualified Account Name: - Called Station Identifier: XX-XX-XX-XX-XX-XX:SSID Calling Station Identifier: XX-XX-XX-XX-XX-XX NAS: NAS IPv4 Address: x.x.x.x NAS IPv6 Address: - NAS Identifier: AP01 NAS Port-Type: Wireless - IEEE 802.11 NAS Port: 1 RADIUS Client: Client Friendly Name: SonicPoint HQ 1 Client IP Address: x.x.x.x Authentication Details: Connection Request Policy Name: NAP 802.1X (Wireless) Network Policy Name: - Authentication Provider: Windows Authentication Server: NPS.domain.nl Authentication Type: PEAP EAP Type: - Account Session Identifier: "edited" Logging Results: Accounting information was written to the local log file. Reason Code: 16 Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect. The only real difference I see is that for the Windows 11 client, NULL SID is provided as "Security ID". Could it be that this is causing NPS to not be able to verify that the machine that is attempting to connect is a member of the security group which is allowed to connect (the default group "Domain Computers")? Looking forward to either a quick bug fix or a configuration change I need to make. Maybe other Windows Server admins are also experiencing this issue?Solved159KViews2likes20Comments