Problems getting XP SP3 to Authenticate to NPS (Server 2008

[andrewj]

I have a Server 2008 R2 domain with windows xp sp3 clients. The Server 2008 R2 is a DC, Certificate Authority and NAP Server. I have cisco switches setup correctly to use 802.1x as I used to have a server 2003 domain with IAS and everything was fine.

 

In NPS I have created a wired policy to put clients on to Vlan 2. In group policy, there are wired settings for clients to use PEAP and the Certificate to connect.

 

The clients use machine credential. When I try and connect the client to the network..... I get Authentication Failed and in the Event Viewer on the NPS server I get:

 

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 06/08/2010 21:26:46

Event ID: 6273

Task Category: Network Policy Server

Level: Information

Keywords: Audit Failure

User: N/A

Computer: DC2008.ad.londonacademy.org.uk

Description:

Network Policy Server denied access to a user.

 

Contact the Network Policy Server administrator for more information.

 

User:

Security ID: S-1-5-21-1961120552-2230764613-812287295-2925

Account Name: host/DIANAFINANCE.ad.londonacademy.org.uk

Account Domain: LONDONACADEMY

Fully Qualified Account Name: ad.londonacademy.org.uk/Admin Computers/Admin Desktops/Finance/DIANAFINANCE

 

Client Machine:

Security ID: NULL SID

Account Name: -

Fully Qualified Account Name: -

OS-Version: -

Called Station Identifier: 00-17-E0-05-90-B2

Calling Station Identifier: 00-1B-78-AE-D5-2E

 

NAS:

NAS IPv4 Address: 172.17.1.167

NAS IPv6 Address: -

NAS Identifier: -

NAS Port-Type: Virtual

NAS Port: 60046

 

RADIUS Client:

Client Friendly Name: 0E06-167-3560PS

Client IP Address: 172.17.1.167

 

Authentication Details:

Connection Request Policy Name: Use Windows authentication for all users

Network Policy Name: Admin_PCs_Vlan2

Authentication Provider: Windows

Authentication Server: DC2008.ad.londonacademy.org.uk

Authentication Type: PEAP

EAP Type: -

Account Session Identifier: -

Logging Results: Accounting information was written to the local log file.

Reason Code: 23

Reason: An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors.

 

Can anyone please help?????

[lramos]

Hey... I'm having the same problem as yours. Could you tell me how to solve that?

The NPS message is below:

 

Thank you in advance.

 

 

Network Policy Server denied access to a user.

 

Contact the Network Policy Server administrator for more information.

 

User:

Security ID: NULL SID

Account Name: host/notetelemed.lab.local

Account Domain: LAB

Fully Qualified Account Name: LAB\NOTETELEMED$

 

Client Machine:

Security ID: NULL SID

Account Name: -

Fully Qualified Account Name: -

OS-Version: -

Called Station Identifier: -

Calling Station Identifier: 00-1C-7E-A7-AA-23

 

NAS:

NAS IPv4 Address: 192.168.0.214

NAS IPv6 Address: -

NAS Identifier: 001ec1f29882

NAS Port-Type: Ethernet

NAS Port: 16843152

 

RADIUS Client:

Client Friendly Name: SWLAB

Client IP Address: 192.168.0.214

 

Authentication Details:

Connection Request Policy Name: NAP 802.1X (Wired)

Network Policy Name: -

Authentication Provider: Windows

Authentication Server: server1.lab.local

Authentication Type: EAP

EAP Type: Microsoft: Smart Card or other certificate

Account Session Identifier: -

Logging Results: Accounting information was written to the local log file.

Reason Code: 16

Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

[tenacity]

Are you using windows server 2008 R2 or R2 SP1 Beta/RC?

[jamesfed]

This may help you-

IAS Log Viewer - DeepSoftware.com

 

Works with Server 2k8 NPS and helped us to find the problem with our authenticated Wireless.

[SmellyLlama]

Having much the same problem here.

 

2003 to 2008 and all the clients seem to be stuck on verifying. We did at one point have it working on our phones.

[sukh]

Hi all

 

Is this still an issue?

 

Regards

Sukh