NPS RADIUS – “Message-Authenticator attribute is not valid

[athan1234]

Hi everyone,

Some time ago, I configured an SSID using 802.1X authentication with NPS, and it has been working correctly.

Now, I need to add a new SSID to the same NPS server. In this case, the computer that will connect to the SSID is not joined to the domain.

I created a new Network Policy in NPS and placed it at the top of the policy list. The conditions are:

• NAS Port Type: Wireless – IEEE 802.11
• Calling Station ID: *.wifiname$

The complete IP range is already configured under RADIUS Clients.

However, when I try to connect to the Wi-Fi network, I receive the following error in the NPS Event Viewer:

An Access-Request message was received from RADIUS client x.x.x.x with a Message-Authenticator attribute that is not valid.

I have been reading about this error, and several posts suggest that it may be related to an incorrect shared secret.

I have checked the shared secret and it seems to be correct. Nevertheless, to rule this out, I created a new RADIUS client containing only this AP and configured a completely new shared secret on both sides, Meraki and NPS.

Unfortunately, I still receive exactly the same error.

Has anyone experienced this issue before or have any idea what else I could check?

Thanks in advance.

[aleabrahao]

You can certainly use MS-CHAPv2 without the machine being joined to the domain, but, if you don't mind me asking, if it's just a test machine, wouldn't it be much easier to set up a test SSID with PSK and enable it only when you need to run a test?

Do you really think it's worth all that effort? Sometimes the simple solution is the best one.