Wifi – Windows 10 WLAN prelogon not working

active-directoryubiquitiwifiwindows 10

First time posting here, although I've found many helpful answers on the various StackExchange sites over time.

My current problem is that I cannot get WLAN prelogon to work on wireless laptops, no matter what I do. If the user logs on once using a wired connection, Windows will cache their credentials and let them log on after that with no problems, but if they haven't logged onto a particular laptop, or if the cached credentials expire, then the logon doesn't work.

I've set up the WLAN Prelogon registry key, and I've added the selected WLAN profile via a group policy. Domain controller certificates are, likewise, pushed down to the system via a group policy.

I've got a Windows 2012 R2 AD domain that all the laptops are members of. Wifi network is Ubiquiti UniFi using RADIUS back to the domain for wifi authentication. Laptops are a mix of Dell models, but most are running Windows 7 (I know) or Windows 10.

I've honestly been beating my head against this on and off for months and can't find the problem. I've searched for solutions but every one I find lists steps I've already taken. If anyone has suggestions on steps to take to isolate the cause of the problem, or if anyone has run into the same problem before, I'd appreciate any guidance.

Best Answer

Sounds to me like working as intended. Just have the user hardwire in, log in. then do what is needed.

Related Solutions

Wifi – How to enable domain authentication over wireless in Windows 7/2k8

Try this (on the client computer):

Login locally using a user with administrator privileges.
Connect to your office's wireless network, save the credentials, and then make sure you check the "Connect automatically" checkbox.
Open a command prompt window and type the following command to find the profile name of your wireless network: netsh wlan show profiles
Let's say the profile to use in the example is "office-network". Open regedit and look for the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Create a new String Value (REG_SZ) at that location, and name it anything you want (i.e. WIFI_Connect), and enter the following command string: %comspec% /c netsh wlan connect name="<profile name>" where profile name in our example would be "office-network".
Reboot the laptop for this to take effect.
If it still doesn't work or fails to connect to your office network at pre-logon, try enabling the following Local Group Policy (using gpedit.msc): Computer Configuration\Policies\Administrative templates\System\Logon\Always wait for the network at computer startup and logon. A full description of what this policy does is present on the dialog when you edit it. (It's too long to paste here).
If it still says it cannot find a valid domain, it could be a DNS issue. Make sure that the wireless router providing you the connection is setup to provide the proper DNS servers over DHCP, and that the domain can be resolved with them.

If not of that works, I don't know what is wrong, but it's nothing obvious. Every KB I've read so far point to this solution, and it seems to work well for others.

Wifi – Handling domain joined laptops that are rarely on the local LAN

Depending on the work they have to do inside the Domain, consider working with a Terminal Server, (or just a Host Inside your company Network).

They could even work with their private Hardware (if they want to) and you are in full control of the Terminal Server. Just give them access via VPN, or directly via RDP (if you have trust in Microsoft protocols :)

OpenVPN would also have a service feature where you could connect to a VPN an system startup. You could pare this with Certificate Authentication (unexportable from the certificate store) and a revocation list for NOT allowing users to connect anymore.

openvpn config needs to edited something like this:

ca "YOUR_CA.pem"
cryptoapicert "SUBJ:OpenVPN-Client"

the certificate (with a matching subject name) needs to be imported, inside the users certificate store (the user who starts up the openvpn service)

Related Topic

Wifi – WLAN profile GPO settings and saved user credentials