Deploying Secure 802.11 Wireless Networks with Microsoft Windows

Common Connectivity and Authentication Problems

The following are some common problems with wireless connectivity and authentication that are encountered by a Windows wireless client:

• Wireless network is not found.

  If you have configured your wireless APs to suppress the beaconing of the Service Set Identifier (SSID), also known as the wireless network name, the WZC service cannot automatically connect to the wireless network. You must manually create a preferred wireless network with the correct SSID and associated settings. After the wireless network is created and added to your list of preferred networks, the wireless client should automatically connect.

  Verify that you are within range of the wireless AP for the wireless network by using tools provided by the wireless adapter vendor or (for Windows Server 2003) the Wireless Monitor snap-in. You can move the wireless AP or the wireless client, adjust the transmission power level on the wireless AP, or reposition or remove sources of radio frequency attenuation or interference.

• The message Windows Was Unable To Find A Certificate To Log You On To The Network is displayed in the notification area.

  The most typical cause for this message is that you do not have either a user or computer certificate installed. Depending on the registry value of HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General \Global\AuthMode, you might need to have both installed. Verify that you have a computer certificate, a user certificate, or both installed using the Certificates snap-in.

  Another possible cause for this message is that you have certificates installed, but they either cannot be used for wireless authentication, or they cannot be validated by all of your Internet Authentication Service (IAS) Remote Authentication Dial-In User Service (RADIUS) servers. User and computer certificates must have a valid range of dates, must not be revoked, must have the Client Authentication purpose in the Enhanced Key Usage (EKU) field of the certificate, and must have the user principal name (UPN) of a valid user account or fully qualified domain name (FQDN) of valid computer account for the Subject Alternative Name field of the certificate. Additionally, verify that the root certification authority (CA) for the issuing CA of the user and computer certificates is installed in the Trusted Root Certification Authorities Local Computer store on each IAS RADIUS server.

• Wireless network adapter seems stuck attempting to authenticate.

  For EAP-TLS authentication with Windows XP (prior to SP1) wireless clients, if the wireless client is validating the server certificate (enabled by default) and the Connect If The Server Name Ends With string on the Smart Card And Other Certificate Properties dialog box is incorrect, authentication will fail. To view the Smart Card And Other Certificate Properties dialog box, obtain properties of the network connection that corresponds to the wireless LAN network adapter, click the Authentication tab, and then click Properties.

  For Windows XP (SP1 and later), Windows Server 2003, and Windows 2000 with the Microsoft 802.1X Authentication Client, you can specify the names of the servers that must authenticate the wireless client in Connect To These Servers, from the Smart Card Or Other Certificate EAP Properties dialog box. To view the Smart Card And Other Certificate Properties dialog box, obtain properties of the wireless network, click the Authentication tab, and then click Properties. The names of the servers must match the names of the authenticating servers, or authentication will fail.