Troubleshooting the Windows Wireless Client

When troubleshooting wireless connectivity, it is important to first determine whether some or all of your wireless clients are experiencing problems. If all of your wireless clients are experiencing problems, issues may exist in your authentication infrastructure. If some of your wireless clients are experiencing problems, issues may exist for your wireless APs or individual wireless clients.

The following are some common problems with wireless connectivity and authentication that are encountered by a Windows wireless client:

• Wireless network is not found: Verify that you are within range of the wireless AP for the wireless network by using tools provided by the wireless adapter vendor. You can move the wireless AP or the wireless client, adjust the transmission power level on the wireless AP, or reposition or remove sources of radio frequency attenuation or interference.
• Unable to authenticate: Some wireless network adapters have a link light that indicates sent or received data frames. However, because IEEE 802.1X authentication occurs before the wireless network adapter begins sending or receiving data frames, the link light does not reflect 802.1X authentication activity. If the link light does not indicate any wireless traffic, the cause could be a failed 802.1X authentication.
  Verify that the user or computer account for the wireless client exists, is enabled, and is not locked out (via account properties or remote access account lockout); and that the connection is being attempted during allowed logon times.
  Verify that the connection attempt for the user or computer account matches a network policy. For example, if you are using a group-based network policy, verify that the user or computer account is a member of the group specified in the Windows Groups condition of the appropriate network policy.
  Verify that the root CA certificates for the issuing CAs of the NPS server certificates are installed in the Trusted Root Certification Authorities Local Computer store on the wireless client computer.
  For an EAP-TLS- or PEAP-TLS-based wireless client, verify that the computer or user certificate meets the conditions described in the "Validating the Wireless Client's Certificate" section of this tutorial.
  For a PEAP-MS-CHAP v2-based wireless client, investigate whether the wireless client's account password has expired and verify that the Allow Client to Change Password After It Has Expired check box in the EAP MS-CHAP v2 Properties dialog box is enabled on the NPS servers.
• Unable to authenticate with a certificate: The most typical cause for this message is that you do not have either a user or computer certificate installed. Depending on the configured authentication mode, you might need to have both installed. Verify that you have a computer certificate, a user certificate, or both installed by using the Certificates snap-in.
  Another possible cause for this message is that you have certificates installed, but they either cannot be used for wireless authentication, or they cannot be validated by all of your NPS servers. For more information, see the section "Troubleshooting Certificate-Based Validation" in this tutorial.