Netbooks keep losing wireless. GPO suggestion?

[reggiep]

We currently have Ruckus wireless and about 90 netbooks connecting to it.

We occasionally have students bringing netbooks to us that cannot find the domain. We log on as local admin and find that the netbook is not connected to any wireless or occasionally is connected to the guest wireless, which will not allow any access without a guest password.

 

I am wondering whether this is because 1. the students are playing with the wireless network connection settings and disconnecting from the wireless or choosing guest

2. something else wrong with netbooks.

 

Is there a way to disable the access to the wireless network connections via gpo?

 

I want to try to block this firts and then if it still keeps dropping off the correct wireless i could investigate further.

 

thanks

[Michael]

It's difficult to say why they're losing wireless settings, but yes, you can disable users accessing the advanced network settings:

 

User Config > Admin Templates > Network > Network Connections. There are lots of policies to tweak here

[Little-Miss]

That's almost the same as me! Not Ruckus but managed.

 

Mine are set via GPO. They are in a group called wireless. The only way i can fix it at the moment is to reimage the machine. Would love it if someone can get to the bottom of it!

[Sheridan]

We have lots of netbooks and a Ruckus wireless system. We tend to find that occasionally (especially with XP) some will just not connect. Checking the settings (pushed out by GPO) shows everything is correct but they refuse to connect.

 

Connecting them up via the lan port and then rebooting the wireless starts to work - and usually continues to for a good long while. It seems quite random as to when and why this happens.

[Irazmus]

We've had a spate of these lately. Our issue is caused by Windows seemingly losing the wireless certificate provided by GPO. A quick gpupdate when hard-wired solves the issue, but we haven't yet found the underlying problem.

[plexer]

Apart from windows built in wireless management being sucky?

 

Ben

[reggiep]

Thanks for the replies. We don't set wireless via gpo, we just initially connect the laptops to the wireless after we image them. I will have to look more in to the gpos.

[Jamo]

We've had a spate of these lately. Our issue is caused by Windows seemingly losing the wireless certificate provided by GPO. A quick gpupdate when hard-wired solves the issue, but we haven't yet found the underlying problem.

 

You using PEAP-MS-CHAP? I found it was machine passwords timing out (they have a lifespan of about a month I think and a timeout of 2 weeks or so in which if the laptop reconnects during the second 2 week period the password will be downloaded and stored until required, I thinks). This seems to show up in education as the teachers and student machines are not used for large periods of time during the holidays usually and during this time the machine passwords time out.

 

The certificates provided by autoenrollment are usually set to last for a whole year so it is unlikely that certificate policy is incorrect here.

 

I have switched us to EAP-TLS which has removed the failing to connect issue, have had to switch to machine only authentication as we don't have roaming certificates and the users would have too many certificates if I turned on autoenrollment for users!

[spc-rocket]

Hi,

 

James is right, it is the machine password that has expired and needs to be renewed but of course there is no connection (with EAP- PEAP/MS-CHAP v2) so it can't do this. When you connect to the LAN (wired) the machine password update is successfully and therefore future wireless connections are fine until it expires again.

 

I think you can change the policy for the machine password from the normal 30 days to a lot longer in the GPO i believe. Have a look at the link below for the exact setting.

 

Domain member: Maximum machine account password age: Security Configuration Editor

 

Ash.

[witch]

Just about to deploy netbooks on a wireless network - you're scaring me

[Little-Miss]

Ok, guys...numpty mode.

 

What's a Machine Password? Is this something a computer uses to authenticate with the Domain?

[Little-Miss]

Right, i've just had a sheet handed to me with two machines that have the error "domain School not available" which is usually sign that they arent connecting to the wireless correctly. So, do you think changing that setting will help this?

[IanT]

Wireless Driver all up-to-date?

 

I had something like this in my last place, driver update did the trick.

[spc-rocket]

@Little-Miss,

 

It could be due to a number of things olike out of date drivers as Ian has mentioned, the timeout period for EAP or some incompatibility with the AP. Its a process of elimination and i would beigin with what Ian has suggested, Driver updates for the wireless cards on the Netbooks. The next thing to look at is the firmware upgrade on the AP or Controller.

 

If group policies are not applying at startup then you can set the options explained the MS article below:

 

Group Policy application fails on a computer that is running Windows 2000, Windows XP Service Pack 1, or Windows XP Service Pack 2

 

It would be worth setting the machine password expiry to say 180 days i.e. 6 months in the domain GPO perhaps. The machine password is used by the domain joined computer to access the domain and its security related info. When it expires the computer automatically tries to renew this with the domain controller but in the case of Wireless setup with EAP PEAP/MS CHAPv2 it cannot do this and this is one of the reasons that it can't connect to the wireless network,

 

HTH,

 

Ash.

[MThornback]

Wireless Driver all up-to-date?

 

I had something like this in my last place, driver update did the trick.

 

Also do the BIOS and Chipset. I've had driver updates cause big issues because they are missing information from the Bios/board.