Laptops and Tablets Cannot Logon to Domain

Discussion in 'Wireless Networks' started by k3v1nr055, Aug 30, 2007.

  1. k3v1nr055

    k3v1nr055 Guest

    We are suddenly not able to logon to our domain(s) via wireless. This was not
    a problem until recently. This is a school where 1000 students share use of
    about 500 laptops and tablet PCs so it is most common for a particular user
    to grab a different laptops from different carts in a given day and use
    several different laptops from the same cart throughout a school year. I
    point this out so that you know that the common answer to our problem, which
    is to logon via the ethernet line and cache the profile before trying to
    connect via wireless is not acceptable nor practical. Additionally, we had
    no problem with this last school year. Now, three months later we are
    basically "dead in the water" with regard to technology for students and
    wireless access for staff. The actual message that we get is:" The system
    cannot log you on because the domain OURDOMAIN is not available." The same
    user account will quickly authenticate via ethernet.

    More info: This is occurring with both a new Cisco server-managed wireless
    network in one building and the old store bought access points in our other
    buildings. This is also occurring with newly re-imaged laptops that were used
    successfully last year, with newly re-imaged laptops that were purchased this
    summer and never used by anyone (except the tech who loaded the computer) and
    new out of box laptops that have not been customized for our environment. I
    point this out because we were concerned that something in the imaging
    process (RIS and WDS) might have caused this issue but since brand new Dell
    and Gateway computers also exhibit the behavior it does not appear that the
    imaging process caused this issue and therfore my job is safe since I am in
    charge of images.

    I should also point out that the only major change to our computers was the
    "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    hammered with between 150 and 200 windows updates over the summer. I suspect
    that one or both of these events is at least partially related to our

    We really need help here. Any advice?
    k3v1nr055, Aug 30, 2007
    1. Advertisements

  2. k3v1nr055

    k3v1nr055 Guest

    A few more points: This is clearly not a Cisco issue. We have been in touch
    with Cisco (who has checked all the wireless infrastructure and we all agree
    that this is a Microsoft issue. This occurs with any access point that we
    test on. Also, the clients cannot get an IP addresss because all the
    adapters are disconnected since the wireless service does not connect to any
    network APs. The only way that works is to get on the domain by the lengthy
    process I described previously so that the computers can pull down the new
    policy with the firewall off. After this the wireless connectivity works
    properly and subsequent users can authenticate. If we knew that the Windows
    Firewall was such an issue we might have purchase a better solution for when
    users take laptops off campus (hence the term "mobile" computing). The cost
    would have been small compared to the loss of service and the time it will
    take to get our students up and running. We are like a lot of networks, I
    suspect, in that we have way too much to do even when things work correctly.
    and when issues like this occur, and this is more and more often, it really
    puts a hurt on us.
    k3v1nr055, Aug 31, 2007
    1. Advertisements

  3. k3v1nr055

    Pavel A. Guest

    If you could watch the logon process with a wireless sniffer,
    it would be clear right away, which packets go to air when, and whether
    the firewall blocks something.

    Pavel A., Aug 31, 2007
  4. k3v1nr055

    k3v1nr055 Guest

    I have not used a wireless sniffer but if I used something like airsnort
    would I be able to watch what occurs on one of the problematic machines from
    a computer that is already up and running? If that's possible could you point
    me to some info on doing that?
    k3v1nr055, Aug 31, 2007
  5. k3v1nr055

    k3v1nr055 Guest

    am certain that the Windows Firewall is most responsible for this issue. In
    order to get our 400 laptops to be able to see a domain controller we had to
    turn off the standard profile firewall GPO (which exposes all laptops when
    they are outside of our perimeter....bad news). Then we had to start and log
    into each computer as the local admin and manually connect to the wireless
    signal. Next without we logged off the computer (we did not restart) and were
    able to log on with a domain account. This also pulled down the policy change
    which disabled the firewall. Then and only then were we able to connect to
    the wireless signal after a restart. This did not work until the firewall
    was turned off in Group Policy. Again I must state that this behavior was
    not exhibited last spring so something changed or was force to change for
    some unknown reason. I still believe that IE7 (urgh!!!) and it's so called
    "improvements" are the reason. If I could have my way I would uninstall this
    monster and put Firefox on every PC on our campus.
    k3v1nr055, Sep 4, 2007
  6. Hi,

    The fact that this happened on hundreds of laptops at about the same time
    makes me suspect a PKI issue, possibly related to certificate expiration.
    What wireless authentication method are you using?
    Greg Lindsay [MSFT], Sep 5, 2007
  7. k3v1nr055

    k3v1nr055 Guest

    Right now the wireless is wide open and has been for some time. Later this
    week we are having a managed Cisco system installed and we will push down
    keys and then turn on one or more security implementations. However, it
    still seems strange that computers that have an existing domain profile for
    the user that is logging on would eventually connect to the network via
    wireless but if the user was logging on for the first time and the GPO that
    disabled the firewall had not replicated to the box then that user could not
    "find a domain controller". What also puzzles me is why this began to occur
    since last June when school ended. We made no changes to our setup. The only
    things that changed were the result of MS updates that we push out via WSUS.
    We don't have time to hunt down every anomaly that occurs and these kinds of
    things seem to occur more and more often. It's very frustrating.
    k3v1nr055, Sep 5, 2007
  8. I am sorry for all the frustration, it does sound like an extremely bad
    situation. I hope that I can help, either directly or by getting some other
    experts involved.

    I'd just like to double-check that you aren't using 802.1X at all. If you
    view the properties of your wireless network, and check the authentication
    tab, is the Enable IEEE 802.1x..." check box selected? If so, what is in the
    dropdown next to EAP type?

    I'm still thinking about why the firewall affects this. It might help to set
    the firewall to start as automatic(delayed) or make it dependent on the zero
    wireless configuration service, but that is not getting to the root cause of
    the problem.

    Greg Lindsay [MSFT]

    Disclaimer: This posting is provided "AS IS" with no warranties, and confers
    no rights.

    Greg Lindsay [MSFT], Sep 6, 2007
  9. k3v1nr055

    k3v1nr055 Guest

    No, that box is NOT selected (since there is no encryption established at
    this time). The bottom line is that the only way any user can attach to the
    wireless network is after they have a profile. So either they must log on via
    the wire (not practical in a school where each user may use a different
    laptop in each class and on each day) or I must log on as local admin,
    establish a connection with wireless manually, log off, log on as a domain
    admin and verify the wireless connectivity. Then I have to test again with a
    student account. Really, this is the only way we are getting by. Having said
    this, we want to find out the root cause since we will acquire new computers
    later and/or re-image existing computers and I don't want to go through this

    k3v1nr055, Sep 7, 2007
  10. I do not think there is a solution. The wireless nic drivers and the
    connection management are not active until you get "logged on to the
    desktop". Therefore you have no connection until you are already logged on,
    thereforethere is no way for someone without a previously cached profile to
    log on with out first doing it over a wired connection.

    I would love for the nic manufactures to come up with a way for their
    products to work without the user first logging in (like the wired nics do),
    however keep in mind that a wireless nic can connect to anything that is
    within range while a wired nic will only connect to what it is physically
    connected to,...and I believe that is the crux of the wireless
    problem,...there is no way to control what the wireless nic does until you
    have already logged in.

    IMO wireless in a school or business should never be the primary means of
    connection. The primary means should always be wired. Every desk should
    have a wired jack available. The Wireless will be perfectly fine when they
    move from their normal desk and "roam" about the building or travel,...but
    it should always be the secondary means of connection.

    Phillip Windell

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    Phillip Windell, Sep 7, 2007
  11. k3v1nr055

    k3v1nr055 Guest

    As I stated earlier, this was not a problem when the last school year ended
    in June. It is a new problem that must be solved. Also, it is obvious that
    you do not work in or around schools. That seems to be part of the problem in
    all the posted solutions on Technet. In a typical business setting one does
    not find the same scenario and the problem does not impact the use as much.
    This would not be a big deal if each user used only one computer all day,
    every day. In a school it is not practical to connect via wire. We have 1300
    students who share about 650 computers. About 500 of these are laptops which
    are assigned to approximately 25 carts and the rest are desktops in labs. In
    order for this to be practical in an educational environment wireless is the
    only option. We cannot mount a 24 port switch and run 24 CAT 5 cables to each
    desk. In many schools each student gets his or her own dedicated laptop and
    there are even fewer desktops. You see, it is possible for a high school
    student to use a math laptop, a science laptop, a language arts laptop, and a
    foreign language laptop in consecutive classes since that is the way we have
    assigned and configured those laptop carts. In the 5th -8th grades carts are
    assigned to the grade so that each subject area shares the same cart. In this
    situation each period of the day could have a different combination of
    students so again it's a problem that is not easily overcome.
    Really though, I would just like to know what happened that has made the
    relationship of wireless NIC, to laptop, to Domain Controller change when the
    only differences on our network are that we moved to IE7 and allowed WSUS to
    push down several hundred updates over the past three months. (Of course WSUS
    was in place a long time before this issue arose.) I really don't believe
    that we can blame NIC manufacturers when the same equipment worked perfectly
    k3v1nr055, Sep 7, 2007
  12. No,...I work in a much much more complex, stressfull, and more technical
    environment,...while supporting the schools with my tax dollars whether I
    want to or not, while listening to them complain about not having enough
    money as they spend millions on building projects.
    ....and it is free. You want something for nothing, got something for
    nothing. More than that it was on "my dime", on my time, at work, while
    taking care of the much much more complex, stressfull, and more technical
    environment at the same time.

    Call MS Support Services for help. Pay the $245 like the rest of us.
    Here's the number, is even toll free.
    Phillip Windell, Sep 7, 2007
  13. k3v1nr055

    k3v1nr055 Guest

    Lighten up. I thought the reason that these news groups were created for the
    purpose of giving support. If you don't want to help maybe don't spend your
    precious time replying. You did not offer anything that was helpful. You
    simply posted your opinion. We pay Microsoft a lot of money to use their
    products and I think that it's not too much to ask that they don't make
    changes to the way things work without telling us how it's going to affect
    our world. Why should I have to pay for support for something that I already
    paid for. It's a joke. Anyway, there have been instances when we went the pay
    for help route and I found that the people we paid (at MS and elsewhere) were
    seldom of any help. If spending $245 to get support for something that we
    already pay for would solve this problem I am sure my boss would spend it. He
    has been ripped off too many times. I work in a private school and we don't
    have the luxury of getting your tax dollars. We also are not able to charge
    exorbitant prices for commercial time and we cannot pass extra expenses on to
    the client as you can in the broadcast industry. For the record, I pay taxes
    and I pay tuition for my kids. I also pay extra for everything I buy because
    the cost of advertising on your TV station is added to everything I need. So
    get over it. I can appreciate that your environment is more technical. It
    should be, it's a TV station. However, all of us know about the stress that
    occurs when systems fail. and I can tell you that when 1000 users go to log
    into laptops and those laptops cannot find a domain controller, my overworked
    and understaffed co-workers and myself feel as much stress and frustration as
    anyone else in this industry. Still, no one, including yourself, has been
    able to tell my why this problem has happened when it did not happen a few
    months ago. You are right about something however: I paid you nothing and
    you were of no help.
    k3v1nr055, Sep 10, 2007
  14. Sorry, I shouldn't have got so excited. But the " is obvious that you
    do not work in or around schools..." didn't sit well with me.

    If you have Intel Wireless Nics in the laptops, I saw this morning when
    loading up one of our Dells they have a component for the Driver that they
    refered to as "Pre Logon Connection (PLC)". I tried to add it with my
    driver on one this morning and it said that the component wasn't found,
    I guess my variation of the driver didn't come with it. But maybe it is
    something that can be downloaded from Intel. I know it is not a direct and
    specific solution to your problem, but it may be worth looking into. Since
    it doesn't seem anyone else has given a specific solution I don't feel I
    have failed any worse than the rest,...and you still haven't had to pay me

    Phillip Windell

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    Phillip Windell, Sep 10, 2007
  15. k3v1nr055

    k3v1nr055 Guest

    I have tested my theory on more than 50 laptops this morning and in every
    case where the Windows Firewall is on a new user cannot connect to the DC to
    authenticate. In cases where the GPO that turns off the firewall (logon via
    ethernet or from a previously loaded profile) has been applied a new user CAN
    connect to the domain controller. By the end of the day we will have touched
    each and every laptop in order to get the firewall turned off. What we need
    to know going forward is why this just began to occur and how to prevent it
    next year or whenever we reload a laptop.
    k3v1nr055, Sep 10, 2007
  16. k3v1nr055

    k3v1nr055 Guest

    I have verified that the only time there is a problem is when the firewall is
    on at startup. In each case where we have done the work to get the new GPO
    applied (no firewall) new users can contact the DC and the wireless
    connection works fine. It's definitely an issue with the firewall that did
    not occur until recently. We need to know how to avoid this problem in the
    future and what changed to make this behavior occur just recently.
    k3v1nr055, Sep 10, 2007
  17. The GPO for the Windows Firewall is unique, has double settings and is
    seen in two section and it is the only one I know of that is like this (not
    saying here isn't some I don't know about):

    1. Standard
    2. Domain

    If the DC is "seen" at startup it uses the Domain Policy.
    If the DC is not "seen" at startup it uses the Standard Policy

    The common use of that is to configure Laptops so that when they are on the
    LAN and on the Domain the Firewall is off so that it doesn't get in the way
    of normal LAN activity (like what is happening to you),...but when they are
    started up off of the LAN away from the Domain the Firewall comes on to
    protect the machine while it is "travelling".

    This all works perfectly over wired connections,...but with wireless
    connections the connection is not activated until the User is fully logged
    in (via cached profile) and at the point the Laptop has already "chosen" the
    Standard GPO setting because the DC was not already "seen" by that point
    (its using the cached profile instead). So the Firewall is on.

    The same situation can be created with VPN Clients using Desktop machines on
    Wired connections if the User doesn't remember to check the box that says
    "log on using dialup connections" at the Crtl-Alt-Del Prompt.

    If you go to the Firewall Settings Dialog and look under the General Tab and
    look all the way down at the bottom it will tell if it is using the Domain
    Settings or the non-Doman Settings.

    I had so much greif over this that I stopped using this technique
    all-together. I keep the Firewall turned off in both the Standard and the
    Domain section now.

    Phillip Windell

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    Phillip Windell, Sep 10, 2007
  18. k3v1nr055

    k3v1nr055 Guest

    Well, now our firewall settings are off for standard and for domain also.
    That is the only combination that works. What I had to do was get those
    settings to each laptop. Eventually, I might set up OUs for laptops that
    leave campus (faculty) and those that do not (student) then I could apply the
    standard profile to add a little protection while those users are out of our
    perimeter. Still, that's extra work and I still don't know why this just
    started happening when it did not occur last June.
    k3v1nr055, Sep 10, 2007
  19. k3v1nr055

    k3v1nr055 Guest

    That's OK. I did want to point out that schools such as ours work under a
    completely different paradigm than businesses do. That greatly adds to our
    work load and our STRESS. For instance, in the name of academic enrichment
    and freedom, we have to create different images for each grade, department,
    subject area, etc. We have more than 40 different images to maintain. This
    current problem means that all the base images will possibly need to be
    re-created because the originals have the old, firewall on, GPO. I will have
    to test to know for sure. Users also get away with more misuse than they
    would in a business. We work in a very "forgiving" environment, and that's
    good, but things that would get you fired in a bank, or similar corporation
    are not considered a big deal here (up to a certain point) and THAT means we
    have a lot of crap troubleshooting to deal with. I don't agree with this
    necessarily but I have to live with it. If it were up to me I would have
    planned for a whole lot of wired desktops in monitored labs instead of
    laptops on carts. However, the board of trustees felt differently and we have
    about 24 laptop carts and all the obvious issues that come with them. And so
    we cannot hook everyone up via ethernet and I am sneekernetting to each and
    every laptop in my building. It's killing my other projects.
    k3v1nr055, Sep 10, 2007
  20. I'll try to find out more about the "Pre Logon Connection" thing that I saw
    for the Intel Nic drivers on the Laptop I was working with this moring. If
    it is something that can be downloaded and if other brands have something
    similar ten it may help with the "real" profile -vs- the cached profile
    situation. But at the moment I don't know much about it, this was the first
    time I have seen the name.

    Phillip Windell

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    Phillip Windell, Sep 10, 2007
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.