[SOLVED] Wireless 802.1x PEAP Windows 7 and Windows 2012 NPS and CA

Question

Hello,
We are in progress of migrating our RADIUS (Windows 2003 R2) and Certificate (Windows 2003 R2) servers to 2012 (R2). This went fine, no problems. After that we have changed
our Wireless controller a Cisco 5508. We have change our certificate from a 1024bits to a 2048bits certificate.
We tested the other certificate functions and that went fine too.
But we experience a problem with wireless 802.1x in combination with Windows 7 machines. We have Windows 8 and 8.1 machines that do not experience this problem and wireless 802.1x?
We recreated the wireless policy but also no success.
We have seen this problem before, with a customer who had a Windows 2008 R2 certificate server and Windows XP machines with wireless 802.1x . Exact the same problem. After
decommissioning the Windows 2008 R2 certificate server and changed it to a Windows 2003 R2 certificate server, there where no problems any more.
It looks like that older versions of Windows do not work with newer certificate servers?
Do we miss something? Can someone confirm this.
We already looked for these forum posts, but with no success
http://social.technet.microsoft.com/Forums/windows/en-US/796d447f-518c-4ccb-81ff-921ee561d742/win2k8r2-peapnps-with-cisco-wireless-controller-problem?forum=winserverNIS
http://social.technet.microsoft.com/Forums/windowsserver/en-US/76644dcc-911d-451e-b7f1-39269db43ac7/nps-event-6273-reason-code-16
http://social.technet.microsoft.com/Forums/windowsserver/en-US/d543fe75-0cf9-49e7-bbfa-dd0df219cfe5/the-radius-request-did-not-match-any-configured-connection-request-policy-crp
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID:                            
domainname\NB80W7$
Account Name:          
host/NB80W7.domainname.local
Account Domain:                               
domainname
Fully Qualified Account Name: domainname\NB80W7$
Client Machine:
Security ID:                            
NULL SID
Account Name:                                  
Fully Qualified Account Name: -
OS-Version:                            
Called Station Identifier:                    
08-d0-9f-ec-96-60:domain
Calling Station Identifier:                   
a0-88-b4-35-2e-08
NAS:
NAS IPv4 Address:                 
192.168.2.6
NAS IPv6 Address:                 
NAS Identifier:                       
WLC5500
NAS Port-Type:                                  
Wireless - IEEE 802.11
NAS Port:                               
1
RADIUS Client:
Client Friendly Name:             
WLC5500
Client IP Address:                              
192.168.2.6
Authentication Details:
Connection Request Policy Name:     
WLC5500
Network Policy Name:            
Authentication Provider:                    
Windows
Authentication Server:                       
DC01.domainname.local
Authentication Type:              
EAP
EAP Type:                               
Account Session Identifier:               
Logging Results:                                
Accounting information was written to the local log file.
Reason Code:                        
48
Reason:                                             
The connection request did not match any configured network policy.
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID:                            
domainname\Username
Account Name:                                  
domainname\Username
Account Domain:                               
domainname
Fully Qualified Account Name: domainname.local/ICT Specialisten/Username
Client Machine:
Security ID:                            
NULL SID
Account Name:                                  
Fully Qualified Account Name: -
OS-Version:                            
Called Station Identifier:                    
08-d0-9f-ec-96-60:domain
Calling Station Identifier:                   
a0-88-b4-35-2e-08
NAS:
NAS IPv4 Address:                 
192.168.2.6
NAS IPv6 Address:                 
NAS Identifier:                       
WLC5500
NAS Port-Type:                                  
Wireless - IEEE 802.11
NAS Port:                               
1
RADIUS Client:
Client Friendly Name:             
WLC5500
Client IP Address:                              
192.168.2.6
Authentication Details:
Connection Request Policy Name:     
WLC5500
Network Policy Name:            
WLC5500
Authentication Provider:                    
Windows
Authentication Server:                       
DC01.domainname.local
Authentication Type:              
PEAP
EAP Type:                               
Account Session Identifier:               
Logging Results:                                
Accounting information was written to the local log file.
Reason Code:                        
16
Reason:                                             
Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

Answer 1

Hi,
Please confirm the Win7 clients has renew the certificate and deleted the old certificate. And confirm you are not using the default server certificate template.
More information:
Renew a Certificate
http://technet.microsoft.com/en-us/library/cc730605.aspx
NPS Server Certificate: Configure the Template and Autoenrollment
http://msdn.microsoft.com/en-us/library/cc754198.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.