NPS Network Policy

Question

I am trying to setup a NPS that uses RADIUS for our Wi-Fi. The logon name and password should be the computers MAC address. I have created the new user in AD with the mac as the account name and password. The computer tries to connect to the Wi-Fi, and the logs show it giving the right information. I get my connection request policy back, but the Network Policy will not show up in the log. Therefore, the computer cannot get connected to Wi-Fi.

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:

	Security ID:			Domain\60452e38fb8a

	Account Name:			60452e38fb8a

	Account Domain:			Domain

	Fully Qualified Account Name:	Domain\60452e38fb8a

Client Machine:

	Security ID:			NULL SID

	Account Name:			-

	Fully Qualified Account Name:	-

	Called Station Identifier:		10f3119946a0

	Calling Station Identifier:		60452e38fb8a

NAS:

	NAS IPv4 Address:		10.x.x.12

	NAS IPv6 Address:		-

	NAS Identifier:			2504

	NAS Port-Type:			Wireless - IEEE 802.11

	NAS Port:			1

RADIUS Client:

	Client Friendly Name:		WLC

	Client IP Address:			10.x.x.12

Authentication Details:

	Connection Request Policy Name:	Secure Wireless Connections

	Network Policy Name:		-

	Authentication Provider:		Windows

	Authentication Server:		SERVER2.Domain

	Authentication Type:		PAP

	EAP Type:			-

	Account Session Identifier:		36363930303739392F36303A34353A32653A33383A66623A38612F32313137

	Logging Results:			Accounting information was written to the local log file.

	Reason Code:			48

	Reason:				The connection request did not match any configured network policy.

Here is my Network Policy - "MAC Authentication Policy":

Conditions:
NAS Port Type Wifeless - IEEE 802.11

Calling Station ID    XXXXXXXXXXXX

Windows Groups  Domain\Wifi-MAC-filtering

Settings:

Authentication Method Unencrypted authentication (PAP,SPAP)

Access Permission Grant Access

Framed-Protocol PPP

Service-Type Framed
Encryption Policy Disabled

I think I need help forming the Network Policy. Any help would be appreciated.

Answer 1

Hello Chris,

If the trace start command worked, then it reports where the output file is located. You can also specify a full path for the tracefile argument.

I also just found a good description of the various types of ETW providers: About Event Tracing - Win32 apps | Microsoft Learn

Gary

> netsh trace start scenario=wlan report=disabled capture=yes tracefile=why.etl 

Trace configuration: 

------------------------------------------------------------------- 

Status:             Running 

Trace File:         C:\Users\Gary\Home\2024\why.etl 

Append:             Off 

Circular:           On 

Max Size:           512 MB 

Report:             Disabled

Answer 2

I don't think it is working. I am not getting the Trace Configuration.

Answer 3

Hello Chris,

Do you see anything like this:

>netsh trace start scenario=wlan report=disabled capture=yes tracefile=why.etl 

The requested operation requires elevation (Run as administrator).

If not, just forget it, before the situation gets too much like the nursery rhyme "There was an old lady who swallowed a fly" (tackling problems increasingly removed from the original/real issue).

Gary

Answer 4

Nope nothing like that, it just goes to a blank line.

Answer 5

So i finally got it, It was an update stopping it from working.