topic Re: windows 10 trying to do machine auth thru ise in Network Access Control

windows 10 trying to do machine auth thru ise

Meuserid1979 — Wed, 09 Dec 2020 07:23:41 GMT

Hi experts, im not really sure how to title this discussion. the scenario is this:

wireless network is on 802.1x authentication thru ise (version 2.7).

windows10 <--->cisco AP<--->WLC <--> Cisco ise

AD is integrated to ise. users are authenticating thru a lists of AD OUs.

authC - AD usernames/password are being checked against those selected OUs populated on ise

authZ - is either permit access or dynamic vlan assignement

on windows 10 wireless properties , "user or computer authentication" is the selected option.

machine authentication is disabled on ISE. But on ise logs, some windows are trying to do machine authentication first then after a while the user authentication will be done and user will get connected.

is that windows10 machine behaviour or there is some settings on ise that can be changed so that the laptops will stop doing the machine authentication? thanks in advance

Re: windows 10 trying to do machine auth thru ise

Mohammed al Baqari — Wed, 09 Dec 2020 08:10:02 GMT

Hi,

when you boot the machine it will try to login using machine authentication
(before the user login). The same thing when you logoff from your machine,
it will try machine authentication to stay connected as there is no user
details in the credentials store (lsass.exe).

This is normal pattern with windows clients whether using native supplicant
or anyconnect supplicant. If you disable machine authm you will start
getting issues like machine not connected to network at boot with password
changed. The user will attempt new password but it will accept cached
password only as it can't see AD.

***** please remember to rate useful posts

Re: windows 10 trying to do machine auth thru ise

Meuserid1979 — Wed, 09 Dec 2020 10:07:10 GMT

thanks . appreciate the reply.

Re: windows 10 trying to do machine auth thru ise

Meuserid1979 — Thu, 10 Dec 2020 03:09:55 GMT

do ise have a mechanism to reject an authentication request (for a period of time) after a laptop keeps failing to authenticate?

then once the duration is finished ise will allow laptop for a new auth request.