Solved: 802.1X EAP failure while connected

MarkKruse5137 · ‎03-11-2021

Got a bit of a strange issue going on.

I'm seeing 802.1X EAP failure with an identity of host/then the full pc name

During the time this event occurs the pc is actually connected to the wireless network. It is connected with the normal user credentials.

Same MAC address for both the connected and failing events. Same SSID as well.

Anyone seen this?

Thanks

Philip D'Ath · ‎03-14-2021

You don't provide quite enough info to help.

Let's assume you are using Windows 10. Windows 10 (via group policy) can be configured to:

Authenticate using only the computer name. When you do this it can attach to the network prior to the user logging in, apply group policies, and authenticate directly against AD controllers rather than using cached credentials.
Authenticating using only the user's login details. When you do this the computer can't join the WiFi network till after the user has logged in. As a result, the user can only ever log in using cached credentials, and can never apply group policy changes prior to login.
Authenticate using the computer account first, and then the user account. This is the best of both worlds. When the computer boots up it connects to WiFi using its account. Then when the user logs in it re-authenticates as that user.

View solution in original post

Philip D'Ath · ‎03-14-2021

You don't provide quite enough info to help.

Let's assume you are using Windows 10. Windows 10 (via group policy) can be configured to:

Authenticate using only the computer name. When you do this it can attach to the network prior to the user logging in, apply group policies, and authenticate directly against AD controllers rather than using cached credentials.
Authenticating using only the user's login details. When you do this the computer can't join the WiFi network till after the user has logged in. As a result, the user can only ever log in using cached credentials, and can never apply group policy changes prior to login.
Authenticate using the computer account first, and then the user account. This is the best of both worlds. When the computer boots up it connects to WiFi using its account. Then when the user logs in it re-authenticates as that user.

MarkKruse5137 · ‎03-15-2021

Thanks for the feedback.

Yes you are correct.. I'm using W10. Also WPA2 and windows NPS for authentication.

I agree that setting up authentication using the computer account and then user account is best plan and will work on setting that up.

After some further testing today I see that no matter how you connect to wireless(pre or post login) it tries a computer account first and then the user account/password you enter.