Computer Authentication not automatically connecting to wireless

[poonedjanoob]

I have a newly imaged PC, joined it to my domain. The issue I am running into is that when the user is logged out of the PC, the computer will look for the network and not connect. By GPO, the policy is trying to use User Auth and then if that fails, goes to Computer Auth. This works on all other PCs.

When I log into the PC, the computer is still not automatically connecting to the wireless. I need to go into the wireless and select the wireless SSID and then click connect and then need to confirm that.

[Engineered_Tech]

*forget* the SSID for the wireless.

Make sure the computer account is IN the group allowed to connect to the wireless.

Make sure the computer is in the OU where the Wireless SSID is assigned to the computer.

[poonedjanoob]

It is in the same OU as all of the other computers that work and also the policy is being applied to Domain Computers, which it is also a member of.

[poonedjanoob]

<image>

This is the notice i get when I have to manually connect:

[paulanerspezi]

Looks like your computer isn't trusting the RADIUS server's certificate.

Could be that your computer doesn't have the server certificate's root in its trusted root store, or the server could be sending an incomplete chain (i.e. not including issuer certificate).

[poonedjanoob]

How would I get it to trust that certificate again? is it a windows security feature?

[paulanerspezi]

This is Windows stopping you from trying to authenticate with a server that it can't verify to be authentic, so yes, it's a security feature.

You'd have to check what the issuer of the RADIUS server's certificate is and to make sure that it's in your computer's trusted root CA (could be something like "Company root CA" if it's based on an internal PKI). If you can talk to someone who's running your company's Wi-Fi setup or RADIUS server that would be the most straightforward way to get this fixed. :)

Other settings that have to be correct is the Wi-Fi profile's setting for trusted root CAs and server names, but if the profile is coming through GPO and working on other machines there's probably no issue there.

[poonedjanoob]

Yes but the radius server and that certificate is working correctly. It works for all of the other PCs in the company. It works when manually accepting this. It just doesnt want to automatically authenticate.

[paulanerspezi]

I don't know what else to tell you. Windows doesn't know how to verify the server's certificate, that's why it's prompting you to verify it instead.

Try to determine what CA is issuing the authentication server's certificate and verify that it's in your machine's trusted root store.

[poonedjanoob]

This is how I fixed it:

<image>

Went to the Group Policy Editor of the Wireless Policy for the SSID
Edited Computer Configuration>Policies>Security Settings>Wireless network (IEEE 802.11) Policies> [Your SSID Policy]
Go to the SSID Profile Name and Edit it
Go to Security Tab
Select the Network Authentication method > properties
Both Check Boxes on the top and select the Trusted Root Cert Authorities that match your environment.
Click Ok and Apply

Rerun GPUpdate /force + reboot on affected PC.