Wi-Fi authentication failures - best way to deal with these?

[LRSFC_DanJ]

We use Cisco Meraki as our Wi-Fi system and for our BYOD SSID we use 802.1X with PEAP and MSCHAPv2 so users can connect personal devices to Wi-Fi using their same login and password that they use for the computers / email / etc.

A few weeks ago we found it necessary to enforce a password change on all our users.

Unfortunately, although we did mention to them that they would need to update the wi-fi settings on their personal devices, we're still seeing a high level of authentication failures on the Meraki dashboard.

Can anyone suggest ways in which we can deal with or mitigate this?

Is there a way to force devices to re-prompt the user to re-authenticate? Or even to force the device to "forget" the network if their authentication fails a certain number of times?

Would increasing or changing the lockout duration on users' AD accounts help at all?

Edited November 30, 2021 by LRSFC_DanJ

[jthompson]

I'd be tempted to just scrub the SSID and replace it with a new one (different name) and have everyone join that.

[RLR]

We use Cisco Meraki as our Wi-Fi system and for our BYOD SSID we use 802.1X with PEAP and MSCHAPv2 so users can connect personal devices to Wi-Fi using their same login and password that they use for the computers / email / etc.

A few weeks ago we found it necessary to enforce a password change on all our users.

Unfortunately, although we did mention to them that they would need to update the wi-fi settings on their personal devices, we're still seeing a high level of authentication failures on the Meraki dashboard.

Can anyone suggest ways in which we can deal with or mitigate this?

Is there a way to force devices to re-prompt the user to re-authenticate? Or even to force the device to "forget" the network if their authentication fails a certain number of times?

Would increasing or changing the lockout duration on users' AD accounts help at all?

 

We get similar issues but not enough to change SSID name. Every now and then a user will change their password and update their main device and forget about any old devices they connected like a phone or kindle. This means their device constantly tries to connect to wifi with the wrong credentials and ends up locking their account for 10 minutes. We sometimes have to track down the devices mac address which leads to a hint on which device it might be.

[MatthewL]

We get the same issue when passwords are changed, when we unlock their account for the x number of times they do get around to sorting it after been told although many say their phone isn't connected when it clearly has been!