AD bound Macs internittent login issues over 802.1x wifi

[RabbieBurns]

We have a fleet of Macbooks, Imacs and Mac Airs which are running a mix of 10.9.4 and 10.9.5 and have an 802.1x wifi configuration profile to join our wifi and facilitate the login to AD.

 

The user enters their credentials which authenticates them on the Wifi, and then logs them in to the Mac using their credentials.

 

I have proved the wifi config profile joins them onto the wireless network OK, every time, but the actual logging in to the domain is inconsistent.

 

I'm not sure what to trouble shoot to see where this process might be breaking?

[Hulbert99]

Having the same issues with 10 Mac Minis Yosemite 10.10.2 and very inconsistent logins wired and wireless. Would like a heads up of what to troubleshoot also please!

[sted]

check the time on them. Change the time server on the macs to be a domain controller they can be very fussy about time differences of even a few seconds ive found

[davidacland]

Hi,

 

If any of the devices are desktops (iMacs and Mac Minis), I would recommend using Ethernet. 802.1x WiFi on OS X is often troublesome.

 

For those that must use WiFi, the first thing to determine is whether it is struggling to get a stable network connection or a stable connection to the AD domain controller.

 

When you have one that is failing to login as an AD user, login as the local admin, test connectivity to other network services (file server etc) and see if you can browse AD at all (you can use dscl in the Terminal). If you can connect to other network services but not join AD, it would indicate that the network connection is OK and you need to troubleshoot the connection to the AD DC.

[psydii]

A person who claimed to have learned his trade at the feet of @AntonioRocco told me the way to do this is use Profile Manager to build a computer account based authentication profile (aka configuring the supplicant in System Mode). Nothing else works reliably, apparently.

 

You've probably already read:

 

http://training.apple.com/pdf/WP_8021X_Authentication.pdf

 

I put it here for others who might not have.

[Hulbert99]

A person who claimed to have learned his trade at the feet of @AntonioRocco told me the way to do this is use Profile Manager to build a computer account based authentication profile (aka configuring the supplicant in System Mode). Nothing else works reliably, apparently.

 

n00b question. How do I do that? lol

[psydii]

n00b question. How do I do that? lol

 

No idea, he did it for me. I would guess the link might offer up some clues.

[Hulbert99]

Is he a member on here?

[psydii]

Is he a member on here?

 

Possibly, but he works for a vendor, and we were paying them.

[Hulbert99]

Ahhh ok. Better get researching!

 

Thanks

[Hulbert99]

Are there some log files somewhere that might give me a clue as to why they aren't logging on?

@RabbieBurns Do your machines just sit in the login screen and spin the circle then just go back to the username and password boxes?

[computer_expert]

Are there some log files somewhere that might give me a clue as to why they aren't logging on?

@RabbieBurns Do your machines just sit in the login screen and spin the circle then just go back to the username and password boxes?

 

Have a look in the event log under custom views > server roles > NPS (if you have an Windows NPS server providing RADIUS). I may be getting confused with linux boxes here but I think looking at the syslog log file (on the mac) has provided troubleshooting info for a few related issues.

 

I find that despite being configured to use a DC as an NTP server the macs can sometimes lose time sync and reject the logon too.