Unknown device trying to authenticate wirelessly that is failing

[Doopzzy]

There is a user in my company that is receiving constant lockout, after investigating there is a device that is using his username to try and authenticate but wrong password to our wireless meraki. We can not locate the device we only have the MAC that is trying to authenticate. The people on premise have tried to locate the device, but no success. I came on here to try and see if anyone has a solution that can be done on our network.

[balaji.bandi]

May you need to Look what AP it is trying to connect then physically need to locate that device and remove it.

https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Search_Tool

[Doopzzy]

We do know which AP it is, but the tech in that office can not locate anything with the matching MAC.

[balaji.bandi]

this is hard to find, its like some one plannted  a sniff tool, where we dont know.

best to block the MAC address.

[Scott Fella]

Do you have a radius server in which you can look at the logs and see which ap that device is associating to?  I have seen this happen when the user has other devices and forgets on has cached credentials.

[Doopzzy]

Yeah I should have included that but we do know which AP it is exactly. It most likely is cached credentials, but the user does not know which device it could be. He is a tech so he could have helped other users and accidently stored his.

[Scott Fella]

Can't you just ban that device mac address?

[Leo Laohoo]

I am with @Scott Fella.  Ban/block the MAC address.  
The wireless device will turn up eventually.

[Haydn Andrews]

Like others have said, utilise block mac address to prevent the device authenticating and locking the user out.

As to help with what device it is put the mac address into https://macvendors.com/ it will give you some idea of the manufacturer of the device.

After a couple weeks, unblock the device if it keeps happening from that mac address at least you know its connected to a power source.

If you have access to NetAllys Aircheck, you could use the find device tool to find the device.