Phake

Hi, Usually you need to have a policy in NPS that has the windows computer groups added as allowed. You can check the NPS logs to see why the client is being denied from the event viewer > custom views > roles in 2k8+ You then have to create the GPO with computer authentication + the valid options. Then you need to make sure you have gpupdated with a valid connection to your domain controller to get this policy change e.g plug in a lan cable or have a wireless SSID that has this access to make it work. If you can add some screenshots of you NPS configuration or PM them to me I can assist. Also what are you using for 802.1x ? EAP-TLS? etc.

Original Question Answer: You could do this and technically not have a lot of issues, however you would have to obviously implement this setup, it would only be accessible from one place (surrounding the AP) and you will add interference to the channels used by the AP. The amount of co-channel interference would depend on your current density of wireless coverage/ap's and whether you are broadcasting on 2.4ghz or 5ghz. You could either go for an "onboarding" solution which does exactly this but with some further automation which various vendors offer. Or as the previous user has stated. have a captive portal which has either onboarding instructions. I would also recommend that you put this on a separate VLAN and DHCP scope (as with an open network a lot of devices will autojoin and take your valid IP's) also implement some firewall rules to deny access to other LAN devices and make it non route-able etc. In regards to the captive portal you can customise these usually so you could remove the login forms etc and just attach the data that you need. Hope my post makes sense?

Also note that the hardware the client device has will dictate the speeds reached. A 2x2:2 Mimo configuration will reach around 300mbps max theoretical. A 3x3:3 Mimo configuration will only reach 450mbps max theoretical in most configurations.

If you want to keep your amount of broadcasted SSID's down and are using a Windows server, You can use Dynamic VLAN Assignment. You will need to create another VLAN and tag it on the appropriate ports etc. e.g BYOD_Staff vid=10 BYOD_Students vid=20 VLAN Attributes Used in Network Policy -> NPS Side Attirbutes you will need to configure http://a030f85c1e25003d7609-b98377aee968aad08453374eb1df3398.r40.cf2.rackcdn.com/tech-briefs/tn-working-with-radius-attributes-and-accounting.pdf -> Ruckus Side configuration and Vendor Specific Attributes However there is also a ruckus document with the required Vendor Specific attributes you will need to configure. Basically you want to pass on if they are a student or a staff member to NPS then have it pass back the VLAN assignment based on which group they are in. Good Luck!