Wireless policy losing settings

[Bobo]

I made a topic before a while back but the problem has come about more frequently this time and I feel I could explain it better.

 

What we have is several schools set up like this:

 

Self SSL certificate made on server 03 pushed out by a GPO to clients.

Radius server with shared secret with several Cisco Aironet 1200 APs.

PEAP-WPA Mschapv2 security authentication all sent via GPO.

 

What happens is, most of the time they work fine, then all of a sudden a few laptops will stop connecting when booted up and they need a policy refresh to log in. It's almost as if a GPO stops working for some reason. I would set up a local policy and put the settings in there, but it looks like you have to put the settings in manually as opposed to having a local policy of some sort.

 

At one of my schools when this happens sometimes the adapters just stop working properly and you have to literally reinstall them, once you do, they instantly start connecting.

 

I'm wondering whether when they run out of power the time is lost as is some of the GPO settings? Or is it that we are using pretty poor WLAN cards (atheros and dell cards) or do others use them well?

 

I don't know the best way to make the policy stick? Any ideas?

 

Sorry for the rant, thanks in advance (woffle woffle woffle)

[Bobo]

Does anyone use GPOs to push out wireless at all?

[plexer]

Hi Bobo,

 

We notice this same issue at times most of our laptops run intel b/g cards.

 

Ben

[Bobo]

Thanks for the response, seems like a pain that shouldn't happen, do you think putting the settings locally would help?

[Michael]

I've never been properly successful pushing out wireless settings by GPO. Setting up wireless settings locally does work reliably in my experience. I'm guessing you are using Windows XP/Vista's wireless utility and not a third party Intel utility?

[Bobo]

Yes, wireless zero, don't find any third party utilities to be as reliable (even if they always seem to have better connection, strength, can see each individual AP and can roam a lot better).

 

Through GPOs it works very well, but its those odd few, I dont know how it can just "lose" settings, I mean, it's not like each time the computer logs off all the Group policy settings are set back to zero.

[Irazmus]

We have a similar setup and experience a similar problem. For us it's always the certificate that gets lost so a quick reboot while hardwired sorts it.

It also happens fairly rarely (~once a month) so I don't worry about it too much.

[Bobo]

Seems like it is a fairly common problem, has noone found a workaround, or will putting in the certificate manually sort this out?

[itwasntme]

Have the same difficulty here, pretty much identical except we're using nortel ap's. As you say, it just forgets settings. Logging on to the laptop while wired refreshes the policy and all is good again - for a while.

I've been trying to understand if there is any pattern to it, i.e. is it the same laptops losing settings each time? Could it be that the laptops losing the settings are laptops that perhaps haven't been logged on to at all for XX days, and some thing gets reset in this time (thinking along the lines of dhcp scavenging although I know radius is not supposed to work like this). All dell latitude d531s here with intel a/g cards using the windows zero service.

[Michael]

Just a thought, does the certificate expire after x amount of days if not re-connected to the network? or can you specify a number of days it's valid for?

 

I'm working at a school I setup about 80% wireless and 20% wired and I manually configured WEP information manually on each laptop. This has worked perfectly for about 3 months now. Not a single problem of a laptop being unable to find the network or unable to get an IP.

[plexer]

I'm not using a certificate at the moment.

 

I still get laptops occasionally not connecting.

 

Just starting to modify the cards to stop kids being able to turn the radios off and updating to the april 2008 released version of the 2200bg driver.

 

Ben

[Bobo]

Have the same difficulty here, pretty much identical except we're using nortel ap's. As you say, it just forgets settings. Logging on to the laptop while wired refreshes the policy and all is good again - for a while.

I've been trying to understand if there is any pattern to it, i.e. is it the same laptops losing settings each time? Could it be that the laptops losing the settings are laptops that perhaps haven't been logged on to at all for XX days, and some thing gets reset in this time (thinking along the lines of dhcp scavenging although I know radius is not supposed to work like this). All dell latitude d531s here with intel a/g cards using the windows zero service.

 

I was thinking more along the lines of power? Maybe if you run out of power and the time is reset, the certificate expires as the date is before certificate creation?

 

@Michael, you say you manually added the settings? Is this including a certificate or just encryption?

[maniac]

Old thread reserrected from the depths of the forum, but I'm having a very simelar problem to the ones described in this thread and was wondering has anyone ever found a solution to this?

 

In all other respects my wireless network works fine, but ocassionally I get clients that just will not authenticate to it unless I wire them onto the network and do a GPupdate then re-boot them, very strange problem and not been able to find any sort of pattern to it yet.

 

So if anyone can shed light on why this happens, I'd ve very grateful!

 

Mike.

[spc-rocket]

Just a thought, does the certificate expire after x amount of days if not re-connected to the network? or can you specify a number of days it's valid for?

 

I'm working at a school I setup about 80% wireless and 20% wired and I manually configured WEP information manually on each laptop. This has worked perfectly for about 3 months now. Not a single problem of a laptop being unable to find the network or unable to get an IP.

 

I think the problem sometime with it is that the computer account's password expires and then it can't connect with radius. Plugging in on the network (wired) will correct this as the computer account's password is correctly update and then future wireless logons succeeds. This will happen in 802.1x authentication with radius server.

 

Usually the password would expire in 30 days time or something.

 

Found this links which states that by default the computer account's password expires every 30 days which may explain things.

 

http://technet.microsoft.com/en-us/library/cc781050%28WS.10%29.aspx

 

I'm not sure if MS did a patch for this not.

 

Ash.

Edited October 21, 2009 by spc-rocket
Found link with more info

[maniac]

I think the problem sometime with it is that the computer account's password expires and then it can't connect with radius. Plugging in on the network (wired) will correct this as the computer account's password is correctly update and then future wireless logons succeeds. This will happen in 802.1x authentication with radius server.

 

That's a perfectally plausable explanation, and there's a group policy setting for stopping machine accounts expiring so I'm going to enable that and see what happens!

 

Mike.