[1709, fcu] Windows 10 (1709) – NPS wireless policy issues

[Mark182]

We are rolling out Windows 10 this summer and are slowly building things in the background and testing. We seem to be having an issue where our Win10 wireless clients will not connect. All we get is ‘action needed’ If I right click and click connect everything connects and works fine. We do not have this issue with our Win 7 clients. Seems like it’s not auto connecting. I am about to check the logs but wondering if anyone else has seen similar?

[Mark182]

This seen this so will give that a try

[jords91]

Hi Mark,

Just wondering if you had any luck with working this out? We are having the same issue but we are running server 2016 for our NPS.

 

Thanks

[markwilfan]

My nps is server 2016 and we have win 10 clients authd with radius. I'll pop my gpo up a bit later after briefing

[Mark182]

Hi Mark,

Just wondering if you had any luck with working this out? We are having the same issue but we are running server 2016 for our NPS.

 

Thanks

 

 

We have a feeling its something to do with this Do you use lightspeed by any chance?

[Mark182]

Also this lightspeed link

[jords91]

Thanks for the reply. Our problem only started when we moved to Win 10 1709. We have been running on 1703 now for the last 5 months without a problem. Im testing with 1709 and laptops will not machine authenticate. It connects for a second but then disconnects. When you try to connect to the network at the login screen it says that the username and password are wrong.

[markwilfan]

Thanks for the reply. Our problem only started when we moved to Win 10 1709. We have been running on 1703 now for the last 5 months without a problem. Im testing with 1709 and laptops will not machine authenticate. It connects for a second but then disconnects. When you try to connect to the network at the login screen it says that the username and password are wrong.

Have you checked the logs on the nps server?

[jords91]

NPS logs show the exact same events as a 1703 device that is working. It is something that has changed in 1709.

[Blue_Cookeh]

We have 1709 clients working just fine on our RADIUS network without any changes. We use Ubiquiti UniFi APs with Windows NPS.

 

Are you sure the machines have pulled their policies correctly, and are trusting your various RADIUS certificates? When you try to connect with a username and password are you specifying DOMAIN\username?

[jords91]

We have 1709 clients working just fine on our RADIUS network without any changes. We use Ubiquiti UniFi APs with Windows NPS.

 

Are you sure the machines have pulled their policies correctly, and are trusting your various RADIUS certificates? When you try to connect with a username and password are you specifying DOMAIN\username?

 

 

Hmmmm, the machine has all certificates. When i try to connect at login screen, no matter what username and password combination i try, they are incorrect.

 

When i check the NPS server, the logs say the machine authentication is a Audit Success but doesnt stay connected, when i click connect NPS says it was an Audit Failure.

[Mark182]

This is a screenshot of our NPS policy. (Server 2012 R2)

 

We use old legacy Cisco wireless with 2 LAN controllers on site. We updated them and all the AP's but no joy. Everything works fine for our Windows 7 clients.

 

I do feel its something to do with lightspeed with the links I attached before.

[ces973]

Does this seem more like a firewall issue? We are seeing the same thing with 1709, but we have a DELL SonicWall for our firewall. Didn't see any of these issues in 1703, though. I have had engineers from Microsoft Premier Support working on this for the better part of 3 weeks now with no solution in sight.

[Mark182]

I have been doing some digging, FYI screenshot and as you can see our laptop connected as expected for a split second and then back to as described.

 

I am speaking to Lightspeed as I cant add msftconnecttest.com to our global allowed list. I am hoping that sorts it.

[Mark182]

It's 100% 1709 related. The laptop we have been testing on we installed 1703 and everything is working as it should.

[jords91]

Just in case anyone is wondering how to remedy this situation, i fixed it by using the following.

 

The following three steps is what I did to achieve the above:

1) Set the following key in the registry (as the OP did):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet > EnableActiveProbing

set to: 0

Note: It is unclear to me if this key is specifically for Vista, or if it also applies to Win7 - but I set it in any event.

2) Edited GPO (gpedit.msc for a local machine or gpmc.msc if AD domain wide):

Computer Configuration > Administrative Templates > System > Internet Communication Management > Turn off Windows Network Connectivity Status Indicator active tests

set to: ENABLE

3) Edited a second GPO:

Computer Configuration > Policies > Administrative Templates > Network Connections > Do Not show the “local access only” network icon”

set to: ENABLE

 

I only really needed to do step one to get the machines connecting before login.

[Mark182]

Just in case anyone is wondering how to remedy this situation, i fixed it by using the following.

 

The following three steps is what I did to achieve the above:

1) Set the following key in the registry (as the OP did):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet > EnableActiveProbing

set to: 0

Note: It is unclear to me if this key is specifically for Vista, or if it also applies to Win7 - but I set it in any event.

2) Edited GPO (gpedit.msc for a local machine or gpmc.msc if AD domain wide):

Computer Configuration > Administrative Templates > System > Internet Communication Management > Turn off Windows Network Connectivity Status Indicator active tests

set to: ENABLE

3) Edited a second GPO:

Computer Configuration > Policies > Administrative Templates > Network Connections > Do Not show the “local access only” network icon”

set to: ENABLE

 

I only really needed to do step one to get the machines connecting before login.

 

 

Thanks, we'll give this a bash.

[craigcamacho]

Just in case anyone is wondering how to remedy this situation, i fixed it by using the following.

 

The following three steps is what I did to achieve the above:

1) Set the following key in the registry (as the OP did):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet > EnableActiveProbing

set to: 0

Note: It is unclear to me if this key is specifically for Vista, or if it also applies to Win7 - but I set it in any event.

2) Edited GPO (gpedit.msc for a local machine or gpmc.msc if AD domain wide):

Computer Configuration > Administrative Templates > System > Internet Communication Management > Turn off Windows Network Connectivity Status Indicator active tests

set to: ENABLE

3) Edited a second GPO:

Computer Configuration > Policies > Administrative Templates > Network Connections > Do Not show the “local access only” network icon”

set to: ENABLE

 

I only really needed to do step one to get the machines connecting before login.

 

Excellent!!! I have just created a new SCCM task sequence for 1709 and one of the steps was to slip that reg change in and its now working! I didn't bother with the other 2 steps. I cannot thank you enough pal as i was genuinely having one of those "how the f**k am i going to solve this" moments and you have just saved me from a shed load of pain and grief.

[PBrawn]

A big thanks from me for this too. I did have to use the other two settings after rolling out 1709 as an update from SCCM.