Получена явная ошибка eap 0x50005

I’m back on this now Christmas is out of the way

I had some default policies still enabled on my 2016 NPS Server, which I’ve disabled. They were:

Connection Request Policies > Use Windows authentication for all users.

Network Policies > Connections to other access servers.

Network Policies > Connections to Microsoft Routing and Remote Access server.

With those 3 disabled, I’m no longer getting the following Information level event logged in Event Viewer:

Reason code: 66

Reason: The user attempted to use an authentication method that is not enabled on the matching network policy.

Instead, I am now getting:

Reason code: 48

Reason: The connection request did not match any configured network policy.

I have 3 conditions set for the Staff WiFi Network Policy:

Condition: NAS Port Type, Value: Wireless — IEEE 802.11 OR Wireless — Other

Condition: User Groups, Value: MYDOMAINMeraki Staff Group

Condition: Machine Groups, Value: MYDOMAINMeraki Computer Group

The laptop I’m testing on is a member of the Meraki Computer Group, and the user account I’m logged on with belongs to the Meraki Staff Group.

I get a ‘Reason Code: 48’ event logged twice each time I try to connect; first for the user, then 10 seconds later for the machine:

————————————————————————————————————-

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:
     Security ID: MYDOMAINElectroDan
     Account Name: MYDOMAINElectroDan
     Account Domain: MYDOMAIN
     Fully Qualified Account Name: MYDOMAINElectroDan

Client Machine:
     Security ID: NULL SID
     Account Name: —
     Fully Qualified Account Name: —
     Called Station Identifier: 9A-15-54-AB-52-67:Radius_Test
     Calling Station Identifier: 84-3A-4B-56-F4-5C

NAS:
     NAS IPv4 Address: 10.99.108.26
     NAS IPv6 Address: —
     NAS Identifier: —
     NAS Port-Type: Wireless — IEEE 802.11
     NAS Port: —

RADIUS Client:
     Client Friendly Name: Meraki — Purchasing
     Client IP Address: 10.99.108.26

Authentication Details:
     Connection Request Policy Name: WiFi_Staff
     Network Policy Name: —
     Authentication Provider: Windows
     Authentication Server: DC03.mydomain.local
     Authentication Type: EAP
     EAP Type: —
     Account Session Identifier: 41413346334133424138354636383335
     Logging Results: Accounting information was written to the local log file.
     Reason Code: 48
     Reason: The connection request did not match any configured network policy.

————————————————————————————————————-

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:
     Security ID: MYDOMAINITSPARE01$
     Account Name: host/ITSPARE01.mydomain.local
     Account Domain: MYDOMAIN
     Fully Qualified Account Name: MYDOMAINITSPARE01$

Client Machine:
     Security ID: NULL SID
     Account Name: —
     Fully Qualified Account Name: —
     Called Station Identifier: 9A-15-54-AB-56-2D:Radius_Test
     Calling Station Identifier: 84-3A-4B-56-F4-5C

NAS:
     NAS IPv4 Address: 10.99.108.25
     NAS IPv6 Address: —
     NAS Identifier: —
     NAS Port-Type: Wireless — IEEE 802.11
     NAS Port: —

RADIUS Client:
     Client Friendly Name: Meraki — Accounts
     Client IP Address: 10.99.108.25

Authentication Details:
     Connection Request Policy Name: WiFi_Staff
     Network Policy Name: —
     Authentication Provider: Windows
     Authentication Server: DC03.mydomain.local
     Authentication Type: EAP
     EAP Type: —
     Account Session Identifier: 41433342464337434233394535444334
     Logging Results: Accounting information was written to the local log file.
     Reason Code: 48
     Reason: The connection request did not match any configured network policy.

————————————————————————————————————-

A couple of things I’ve noticed.

1) The machine account (MYDOMAINITSPARE01$) is being listed in the User section, and the Client Machine section is empty.

2) The 2nd entry (for MYDOMAINITSPARE01$) is registering via a different AP (Meraki — Accounts). Both AP’s are within range of my test laptop.

Fun.

Not.

I am trying to get NPS (Running Windows Server 2008 R2) setup as a RADIUS server to authenticate my wireless clients (running Windows 7 Enterprise). When attempting this, I get the following in the event log on the DC/NPS:

— System

  — Provider

   [ Name]  Schannel
   [ Guid]  {1F678132-5938-4686-9FDC-C8FF68F15C85}

 
   EventID 36888

 
   Version 0

 
   Level 2

 
   Task 0

 
   Opcode 0

 
   Keywords 0x8000000000000000

 
  — TimeCreated

   [ SystemTime]  2009-08-17T20:27:15.913829000Z

 
   EventRecordID 136791

 
   Correlation

 
  — Execution

   [ ProcessID]  540
   [ ThreadID]  1748

 
   Channel System

 
   Computer DOMAINCONTROLLER.domain

 
  — Security

   [ UserID]  S-1-5-18

— EventData

  AlertDesc 20
  ErrorState 960

And the following in the NPS log:
«DOMAINCONTROLLER»,»IAS»,08/18/2009,09:13:28,1,»DOMAINUSER»,»DOMAINuser»,»001c1011af08″,»001bfcb1bd23″,,,»001c1011af08″,»WAP IP»,47,0,»WAP IP»,»WAP Hostname»,,,19,,,,11,»Secure Wireless Connections»,0,»311 1 DOMAINCONTROLLERIP 08/17/2009 16:55:48 120″,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,»Secure Wireless Connections»,1,,,,
«DOMAINCONTROLLER»,»IAS»,08/18/2009,09:13:28,3,,»DOMAINuser»,,,,,,,,0,»WAP IP»,»WAP Hostname»,,,,,,,11,»Secure Wireless Connections»,23,»311 1 DOMAINCONTROLLERIP 08/17/2009 16:55:48 120″,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,»Secure Wireless Connections»,1,,,,

And the following in the client security log:
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/18/2009 9:13:28 AM
Event ID:      5632
Task Category: Other Logon/Logoff Events
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      LAPTOP.domain
Description:
A request was made to authenticate to a wireless network.

Subject:
      Security ID:            DOMAINuser
      Account Name:            user
      Account Domain:            DOMAIN
      Logon ID:            0x23e79

Network Information:
      Name (SSID):            DOMAIN-wlan
      Interface GUID:            {90952a3d-ac07-4f0d-9598-50afdea22da8}
      Local MAC Address:      00:1B:FC:B1:BD:23
      Peer MAC Address:      00:1C:10:11:AF:08

Additional Information:
      Reason Code:            Explicit Eap failure received (0x50005)
      Error Code:            0x0
      EAP Reason Code:      0x0
      EAP Root Cause String:      
      EAP Error Code:            0x0

The client is receiving the root certificate that has an intended purpose of <All> according to the certificate MMC snap-in. Is there some other kind of certificate I need to issue, and if so, how? Also, if I’m reading the NPS log correctly I’m getting authentication type 11 and Result Code 23 neither of which show up in http://technet.microsoft.com/en-us/library/cc771748%28WS.10%29.aspx.

Very confused.

[SOLVED | See edit #2]

I saw another user have that issue on their school network back on build 10240, but I’m seeing it happen to me on the new fast ring build, 10565. Can anyone else confirm this? My event viewer is riddled with these errors after failing to connect:

Authentication failed for EAP method type 25. The error was 0x54F    

and

EapHostPeerGetResult returned a failure.
Eap Method Friendly Name: Microsoft: Protected EAP (PEAP)
Reason code: 0
Root Cause String: NULL
Repair String: NULL

The guest network is fine, since there’s no authentication (obviously)

Is there a fix for this somewhere or will I have to resort to using ethernet/guest networking for the while?

(I hope MS fixes this soon… this is enterprise-breaking levels of bad)

Edit: Posted in the wrong sub, can someone help me fix this please? Made a new post linking to here for now: https://www.reddit.com/r/windowsinsiders/comments/3ort8f/8021x_peap_is_broken_with_wpa2enterprise_windows10/

Edit #2: I GOT IT! A Software Lead Designer at MS contacted me and he walked through the issue. The fix was to add a registry key:

reg add HKLMSYSTEMCurrentControlSetServicesRasManPPPEAP13  /v TlsVersion /t REG_DWORD /d 0xc0

following that, restart and try connecting again. Hopefully this helps someone else