WPA2 EAP-PEAP error, may be Windows Server 2008 or...

Question

I've studied posts like /t5/Connectivity/Not-able-to-connect-to-company-WLAN-WPA2-AES-PEAP-with-E71/m-p/420301/highlight/tru... , updated firmware, no joy. On E71, get
WLAN: EAP-PEAP authentication failed
In the event log of the domain controller+NPS server, get:
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          5/19/2010 10:24:18 AM
Event ID:      6274
Task Category: Network Policy Server
Level: Information
Keywords: Audit Failure
User: N/A
Computer: Actinium.s********.com
Description: Network Policy Server discarded the request for a user. Contact the Network Policy Server administrator for more information.
User:
     Security ID: S****\****
     Account Name: d***@*****.com
     Account Domain: S*******
     Fully Qualified Account Name: S******\*****
Client Machine:
     Security ID: NULL SID
     Account Name: -
     Fully Qualified Account Name: -
     OS-Version: -
     Called Station Identifier: 000B8651*****
     Calling Station Identifier: 0021FE3****
NAS:
     NAS IPv4 Address: 10.0.1.253
     NAS IPv6 Address: - NAS Identifier: 10.0.1.253
     NAS Port-Type: Wireless - IEEE 802.11
     NAS Port: 1
RADIUS Client:
     Client Friendly Name: OAW-4308
     Client IP Address: 10.0.1.253
Authentication Details:
     Connection Request Policy Name: Secure Wireless Connections
     Network Policy Name: Secure Wireless Connections
     Authentication Provider: Windows Authentication Server: Actinium.s********.com
     Authentication Type: EAP
     EAP Type: -
     Account Session Identifier: -
     Reason Code: 1
     Reason: An internal error occurred. Check the system event log for additional information.
I get a different "Reason" when I deliberately use the wrong certificate, so that part is probably OK. Tried many combinations of sAMAccountName, userPrincipalName, etc. in user and realm fields. I saw a perhaps related issue with somebody using a maemo device that stopped working when they upgraded to Windows Server 2008 on the back end. No problem with iPhones, Blackberry Storms, laptops.
Help...

Answer 1

In the SCVMM world a 'template' is composed of the following: a VHD with an OS that has been generalized (sysprep), virtual hardware profile (settings), and an OS profile.
The OS profile is required to have a product key.  A MAC activation key at the minimum.  But the key is required.
If you deploy a VM from a VHD, the same customization assumptions are not at play.  Which is why it succeeds.  (there is no template in this case, there is also no requirement that the OS in the VHD be sysprep'd).
SCVMM has rules.  And lots of things don't make sense until you begin to understand them and play within them. (I am not saying that the SCVMM rules are a good thing, just saying they exist)
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.