The user does not have an account in the Active Directory Users and Computers snap-in.

Create an account for the user.

The Dial-in properties of the user account or computer account in Active Directory Users and Computers is set to Deny access.

Set the user and computer account Dial-in properties to Allow access.

Note
In 802.1X networks that use IAS to authenticate connections, set the user account Dial-in properties to Control access through Remote Access Policy.

The user account is disabled.

In Active Directory Users and Computers, in Users, right-click the account, and then click Enable.

The user account has expired.

In Active Directory Users and Computers, right-click the account, click Properties, and then on the Account tab, in Account expires, select Never, or in End of set a new expiration date.

The user is attempting a connection at a prohibited time, as specified in the logon hours of the user account (the default setting is Logon Permitted for all hours).

In Active Directory Users and Computers, in the user account properties, on the Account tab, click Logon Hours, and then configure the settings to specify the hours that the client is allowed to connect to the network.

The user is attempting a prohibited connection by using a computer that is not specified in the Log On To setting of the user account properties, or the default setting All computers is not selected.

In Active Directory Users and Computers, in the user account properties, on the Account tab, click Log On To, and then either select All computers, or select The following computers. In Computer name, specify the computers that the user is allowed to use to connect to the network.

The Domain Name System (DNS) service is stopped or is not configured.

On your DNS server, in the Services snap-in, right click DNS Server, and then click Start.

The client computer is not a member of the domain.

Join the computer to the domain.

The client is attempting to log on to the domain by using non-domain credentials. A common error with new computers or user accounts is that users log on to the computer by using their computer account.

At the log on window, in Log on to, select the domain if it is available, and then use the domain user account. For newly joined computers, logon using the domain name and user account in the format DomainName\UserName.

The DHCP scope is full, and therefore the DHCP server cannot lease addresses to requesting DHCP clients.

If the DHCP scope does not use the full address range, edit the scope to expand the address range.

The IP address of the DHCP server was changed and now DHCP clients cannot get IP addresses.

Make sure that the static IP address and subnet mask of the DHCP server are within the addressing scheme of the subnet.

The DHCP service is stopped.

On your DHCP server, in the Services snap-in, right-click DHCP Server, and then click Start.

On a newly configured DHCP server:

• The DHCP server is not authorized in Active Directory.
  
  
• The IP address range of the DHCP scope is incorrectly specified.
  
  
• The DHCP scope is not activated.
  
  
• The DHCP server is not on the same subnet as the clients.
  
  
• The DHCP server is offline.
  
  

In the DHCP snap-in, right-click the domain container, and then click Authorize.

Set the IP address range and subnet mask in the scope to match the addressing scheme of your subnet.

In the DHCP snap-in, right-click the domain container, right-click the scope for the subnet that is presenting connectivity problems, and then click Activate.

Physically connect the DHCP server to the correct subnet.

Restart the DHCP server.

The Active Directory domain functional level is not raised to Windows Server 2003. IAS Remote Authentication Dial-In User Service (RADIUS) settings require the Windows Server 2003 domain functional level.

In the Active Directory Domains and Trusts snap-in, click Action, and then click Raise Domain Functional Level.

Important

If domain controllers on your network are running Windows NT 4.0 and earlier, then do not raise the domain functional level to Windows 2000 native. After the domain functional level is set to Windows 2000 native, it cannot be changed back to Windows 2000 mixed. Likewise, if domain controllers on your network are running Windows 2000 or Windows NT 4.0 and earlier, then do not raise the domain functional level to Windows Server 2003. After the domain functional level is set to Windows Server 2003, it cannot be changed back to Windows 2000 mixed or Windows 2000 native.

In Active Directory Users and Computers, the dial-in properties of the user account are not configured to Control access through Remote Access Policy.

In the Active Directory Users and Computers snap-in, in the domain container, open Users, right-click the user account, click Properties, and then on the Dial-in tab, select Control access through Remote Access Policy.

The IAS remote access policy grants access for members of an Active Directory security group. However, the user is not a member of the security group that is specified in the remote access policy.

In Active Directory Users and Computers, in the domain container, open Users, right-click the security group that is specified in the applicable IAS remote access policy, click Properties. On the Members tab, click Add, and then in Enter the object names to select, type the user account to add the user to the security group.

The authentication method specified in Wireless Network (IEEE 802.11) Policies does not match the authentication method specified in the IAS remote access policy.

For example, if network clients running Windows Vista are configured by Wireless Network (IEEE 802.11) Policies to use Protected Extensible Authenticated Protocol Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MS-CHAPv2) authentication, but no IAS remote access policy specifies PEAP-MS-CHAPv2 authentication, the mismatch prevents client authentication.

Change the Extensible Authenticated Protocol (EAP) authentication method specified in either the IAS remote access policy or in Wireless Network (IEEE 802.11) Policies to match the method deployed for your network.

The Wireless ZeroConfig Service is not running. By default, the Wireless ZeroConfig Service starts automatically.

For an individual computer, manually start the service in the Services snap-in.

For multiple computers, in Group Policy Object Editor, open Wireless Network (IEEE 802.11) Policies. In the details pane, right-click the applicable wireless policy, click Properties, and then on the General tab, select Use Windows to configure wireless network settings for clients.

When using Extensible Authenticated Protocol-Transport Layer Security (EAP-TLS) authentication, the client does not have a certificate that contains the Client Authentication purpose in the Enhanced Key Usage extension. Instead, the client is configured according to minimum client certificate requirements.

Instruct the user to log on to the network by using a wired Ethernet connection and domain credentials; the enhanced certificate is automatically installed.

When using EAP-TLS, the user does not have a client certificate.

Instruct the user to log on to the network by using a wired Ethernet connection and domain credentials; the certificate is automatically installed.

The client does not have a corresponding root CA certificate that matches the issuing CA of the IAS server certificate.

1. In Group Policy Object Editor, open Wireless Network (IEEE 802.11) Policies.
   
   
2. In the details pane, right-click the applicable wireless policy, and then click Properties.
   
   
3. On the Preferred Networks tab, in Networks, select the corresponding wireless network, and then click Edit.
   
   
4. On the 802.1x tab, in EAP type, click Settings, and then in Trusted Root Certification Authorities, select the certificate that matches the IAS server certificate.
   
   

The RADIUS shared secret on the wireless AP does not match the shared secret configured for RADIUS clients in IAS.

Configure the wireless AP to use the same shared secret. The shared secret is specified in the RADIUS Clients node of the IAS snap-in.

The IAS remote access policy properties are configured to reject the user or computer requests. For example:

• On the Settings tab, the properties of the policy are set to Deny remote access permission.
  
  
• On the Dial-in Constraints tab of the remote access policy, time restrictions prohibiting the connection are configured.
  
  
• On the Dial-in Constraints tab, an incorrect media type is specified.
  
  

• In the IAS snap-in, right-click the applicable remote access policy, click Properties, and then click Grant remote access permission.
  
  
• In the IAS snap-in, right-click the applicable remote access policy, click Properties, click Edit Profile. On the Dial-in Constraints tab, select Allow access only on these days and at these times, and then click Edit to specify allowed access times.
  
  
• In the IAS snap-in, right-click the applicable remote access policy, click Properties, click Edit Profile, and then on the Dial-in Constraints tab, do one of the following:
  
  
  • Clear Allow access only through these media (NAS-Port-Type)
    
    
  • Select Allow access only through these media (NAS-Port-Type), and then select Wireless - IEEE 802.11.
    
    

A mismatch exists between the trusted root CA that issued the RADIUS server certificate specified in the IAS remote access policy, and the trusted root CA specified in the selected EAP type in Wireless Network (IEEE 802.11) Policies.

1. In Group Policy Object Editor, open Wireless Network (IEEE 802.11) Policies.
   
   
2. In the details pane, right-click the applicable wireless policy, and then click Properties.
   
   
3. On the Preferred Networks tab, in Networks, select the corresponding wireless network, and then click Edit.
   
   
4. On the 802.1x tab, in EAP type, click Settings, and then in Trusted Root Certification Authorities, select the certificate that matches the IAS server certificate.
   
   

The vendor-specific attributes (VSAs) for the wireless AP are configured incorrectly.

Check the wireless AP product documentation for VSA usage, and then specify the IAS Vendor specific attributes in IAS. If you are unsure about the correct VSA setting, select RADIUS Standard.

The IP address of the wireless AP (RADIUS client) specified in IAS is incorrect.

1. In the IAS snap-in, select RADIUS Clients.
   
   
2. In the details pane, right-click the RADIUS client that corresponds to the wireless AP, and then click Properties.
   
   
3. On the settings tab, in Address (IP or DNS) type the correct IP address, and then click Verify.
   
   

The IAS server certificate has expired.

For information about requesting an IAS Server certificate, see the Windows Server 2003 Help topic Computer certificates for certificate-based authentication.

The IAS service is stopped.

In the Services snap-in, right-click Internet Authentication Service, and then click Start.

EAP is configured differently in the applicable remote access policy than it is in Wired Network (IEEE 802.11) Policy in Active Directory.

Configure both the IAS remote access policy and Wired Network (IEEE 802.11) Policy to use the EAP method that corresponds with your network deployment.

On a newly configured IAS server:

• IAS is not registered in Active Directory.
  
  
• The IAS server does not have a server certificate.
  
  

• In the IAS snap-in, right-click Internet Authentication Service, and then click Register Server in Active Directory.
  
  
• See the Windows Server 2003 Help topic Computer certificates for certificate-based authentication for information about requesting an IAS Server certificate.
  
  

The wireless AP does not have the correct or latest firmware.

Contact the wireless AP manufacturer for the latest firmware.

The IP address of the wireless AP is incorrectly configured for the subnet.

Configure the wireless AP with a static IP address and subnet mask according to your network TCP/IP addressing scheme.

The wireless AP does not specify the correct IP address of the IAS RADIUS server.

On the wireless AP, configure the RADIUS server IP address to match the IP address of your IAS server.