I manage 3 different orgs, and all three have this error this morning when trying to connect with AnyConnect.  Also when connecting with a browser to view the certificate I can see that all three have a new temp certificate.   Are others seeing this?   ... View more

I have my SSID "Secured-Company" setup with Enterprise using my RADIUS server. I have NPS setup with the following:   Connection Request Policy NAS Port Type = Wireless - IEEE 802.11 OR Wireless Other Network Policy NAS Port Type = Wireless - IEEE 802.11 OR Wireless Other Windows Groups = Domain Computers OR Domain Users I deployed a GPO to all my domain joined computers with the settings needed to connect to "Secured-Company".  When is at the logon, the computer is able to connect to the SSID and I can still remote manage it.  When the user logs in, they remain connected as long as it is a Domain account.  A local account causes the access to the SSID to be denied.   The issue is with the Network Policy condition "Windows Groups = Domain Computers OR Domain Users".  Someone can still bring in their home laptop and use their credentials to connect to my secured "Secured-Company" SSID.  Is there a way to configure this so ONLY Domain Users with Domain Joined computers can connect?   I tried to set the Network Policy to just "Windows Groups = Domain Computers", which allowed the computer to connect at boot up, but when the user logs in, they lose connection. ... View more

In Active Directory we have Complex Password requirements enabled.  We want to setup an SSID for our Printers use MAC authentication with Radius using NPS.  We can use the MAC addresses to create the users, but we are unable to set the Password to the MAC and instructed.   How can we use the MAC authentication if we cannot set the user account passwords to the MAC address? ... View more

Just about to switch all the users over to using 802.1X with custom RADIUS authentication from PSK (WPA2) but I am having a little trouble getting the clients to connect without any user intervention.   When I would setup the PSK (WPA2) SSIDs I would configure one of the computers and export the configuration using:   Netsh wlan export profile [“profile name”] [key=clear] folder=”C:\Temp” Which would create the WiFi-NetworkName.xml then I would just create a script to run Netsh wlan add profile filename=WiFi-NetworkName.xml user=all   After running the "add profile", clients would just connect automatically to the SSID.  I am doing the same thing with the new 802.1x setup but the users still have to select the network once and click Connect even though I have the Windows Group setting set to include Domain Computers.   After I push down the wireless settings I can go to a computer at the Windows logon screen and click the Wireless option where I can see the SSID.  I just have to click Connect and I am on.  I just want to eliminate that step.   Here is the XML file used for Netsh wlan add:   <WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1"> <name>Secure-Emp</name> <SSIDConfig> <SSID> <hex>5365637572652D456D70</hex> <name>Secure-Emp</name> </SSID> <nonBroadcast>false</nonBroadcast> </SSIDConfig> <connectionType>ESS</connectionType> <connectionMode>auto</connectionMode> <autoSwitch>false</autoSwitch> <MSM> <security> <authEncryption> <authentication>WPA2</authentication> <encryption>AES</encryption> <useOneX>true</useOneX> </authEncryption> <OneX xmlns="http://www.microsoft.com/networking/OneX/v1"> <EAPConfig> <EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"> <EapMethod> <Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type> <VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId> <VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType> <AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId> </EapMethod> <Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"> <Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"> <Type>25</Type> <EapType xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1"> <ServerValidation> <DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation> <ServerNames/> </ServerValidation> <FastReconnect>true</FastReconnect> <InnerEapOptional>false</InnerEapOptional> <Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"> <Type>26</Type> <EapType xmlns="http://www.microsoft.com/provisioning/MsChapV2ConnectionPropertiesV1"> <UseWinLogonCredentials>true</UseWinLogonCredentials> </EapType> </Eap> <EnableQuarantineChecks>false</EnableQuarantineChecks> <RequireCryptoBinding>false</RequireCryptoBinding> <PeapExtensions> <PerformServerValidation xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false</PerformServerValidation> <AcceptServerName xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false</AcceptServerName> </PeapExtensions> </EapType> </Eap> </Config> </EapHostConfig> </EAPConfig> </OneX> </security> </MSM> </WLANProfile> ... View more

Just started testing the AnyConnect client but did not see an option for assigning access to use the VPN.  Does AnyConnect with the AD Authentication utilize Network Policy Server like RRAS, does it use the Dial In option in the users Active Directory property, or does it just allow any active AD user?   Can't seem to find this info in the docs. ... View more