{"id":496,"date":"2013-10-29T17:31:12","date_gmt":"2013-10-29T15:31:12","guid":{"rendered":"http:\/\/dety.net.ua\/?p=496"},"modified":"2013-10-29T17:31:12","modified_gmt":"2013-10-29T15:31:12","slug":"windows-2008-r2-nps-ubiquiti-ap-pro-radius-issues","status":"publish","type":"post","link":"https:\/\/dety.net.ua\/?p=496","title":{"rendered":"Windows 2008 R2 NPS + Ubiquiti AP Pro + Radius = issues"},"content":{"rendered":"

Some time ago I wrote about configuring WiFi network with Radius authentication.<\/p>\n

Recently I got some issues with that: some devices couldn’t connect to WiFi for a long time, then suddenly could and so on.<\/p>\n

So, I started the investigation …<\/p>\n

1. I look at the NPS log – You can find it in the Event Viewer – Custom Views – Server Roles – Network Policy and Access server.<\/p>\n

\"\"<\/p>\n

2. I found that some requests were denied with a reason 65(Dialin properties is set to Deny for user) although it was set to “Managed by Network Policy”.<\/p>\n

I used a script to set this parameter as “Enable”:<\/p>\n

Dim oContainer
\nSet oContainer=GetObject(“LDAP:\/\/OU=Users,DC=local,DC=com”)
\nModifyUsers oContainer
\n‘cleanup
\nSet oContainer = Nothing
\nWScript.Echo “Finished”<\/p>\n

Sub ModifyUsers(oObject)
\nDim oUser
\noObject.Filter = Array(“user”)
\nFor Each oUser in oObject
\noUser.Put “msNPAllowDialin”,”TRUE”
\noUser.SetInfo
\nNext
\nEnd Sub<\/p><\/blockquote>\n

3. After that I saw another error in the log: The user attempted to use an authentication method that is not enabled on the matching network policy<\/strong>.<\/p>\n

I used this tip:<\/p>\n

Incorrect connection request policy configuration<\/a><\/p>\n

\n
\n<\/div>\n
\n

If you are using NAP with 802.1X enforcement or VPN enforcement, you must select Override network policy authentication settings<\/strong> when you configure connection request policy. If this setting is not configured, then client access requests will be denied with the following reason: The user attempted to use an authentication method that is not enabled on the matching network policy<\/strong>.<\/p>\n

\n
\n
Resolution<\/a><\/p>\n
\n
\n<\/div>\n<\/div>\n<\/div>\n
\n

When you use NAP with 802.1X enforcement or VPN enforcement, access requests must be authenticated in connection request policy.<\/p>\n

Membership in the local Administrators<\/strong> group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups<\/a> (http:\/\/go.microsoft.com\/fwlink\/?LinkId=83477).<\/p>\n

\n
\n
To repair this problem<\/a><\/p>\n
\n
\n<\/div>\n<\/div>\n<\/div>\n
\n
    \n
  1. On a server running NPS, click Start<\/strong>, click Run<\/strong>, type nps.msc<\/strong>, and press ENTER.<\/li>\n
  2. In the NPS console tree, open Policies\\Connection Request Policies.<\/li>\n
  3. Right-click the name of your NAP client connection request policy, and then click Properties<\/strong>.<\/li>\n
  4. On the Settings<\/strong> tab, click Authentication methods<\/strong>.<\/li>\n
  5. Select Override network policy authentication settings<\/strong>, and then click OK<\/strong>.<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/blockquote>\n

    And got this:<\/p>\n

    \"\"<\/p>\n

    All three EAP types were added. In the EAP(PEAP) all two types were added.<\/p>\n

    4. In the Network Policies – the same:<\/p>\n

    \"\"<\/p>\n

    Good Link about NPS errors: technet.microsoft.com\/en-us\/library\/dd348487(v=ws.10).aspx<\/a><\/p>\n

    After these actions I saw the clear NPS log without errors.<\/p>\n

    Some errors appeared later but they appeared rarely and were caused by device specific issues and weak signal. There were a lot of errors before.<\/p>\n

    You can change level of logging:<\/p>\n

    \n

    Logging Schannel events<\/h2>\n

    Secure channel (Schannel) is a security support provider (SSP) that supports a set of Internet security protocols, such as Secure Sockets Layer (SSL) and Transport Layer Security (TLS). These protocols provide identity authentication and secure, private communication through encryption.<\/p>\n

    Logging of client certificate validation failures is a secure channel event, and is not enabled on the server running NPS by default. You can enable additional secure channel events by changing the following registry key value from 1 (REG_DWORD type, data 0x00000001) to 3 (REG_DWORD type, data 0x00000003):<\/p>\n

    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\EventLogging<\/strong><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

    Some time ago I wrote about configuring WiFi network with Radius authentication. Recently I got some issues with that: some devices couldn’t connect to WiFi for a long time, then suddenly could and so on. So, I started the investigation … 1. I look at the NPS log – You can find it in the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,12],"tags":[],"class_list":["post-496","post","type-post","status-publish","format-standard","hentry","category-novosti","category-windows"],"_links":{"self":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=496"}],"version-history":[{"count":3,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/496\/revisions"}],"predecessor-version":[{"id":499,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/496\/revisions\/499"}],"wp:attachment":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}