Laptops and Tablets Cannot Logon to Domain - Wireless

This is a discussion on Laptops and Tablets Cannot Logon to Domain - Wireless ; We are suddenly not able to logon to our domain(s) via wireless. This was not a problem until recently. This is a school where 1000 students share use of about 500 laptops and tablet PCs so it is most common ...

+ Reply to Thread
Results 1 to 20 of 20

Thread: Laptops and Tablets Cannot Logon to Domain

  1. Laptops and Tablets Cannot Logon to Domain

    We are suddenly not able to logon to our domain(s) via wireless. This was not
    a problem until recently. This is a school where 1000 students share use of
    about 500 laptops and tablet PCs so it is most common for a particular user
    to grab a different laptops from different carts in a given day and use
    several different laptops from the same cart throughout a school year. I
    point this out so that you know that the common answer to our problem, which
    is to logon via the ethernet line and cache the profile before trying to
    connect via wireless is not acceptable nor practical. Additionally, we had
    no problem with this last school year. Now, three months later we are
    basically "dead in the water" with regard to technology for students and
    wireless access for staff. The actual message that we get is:" The system
    cannot log you on because the domain OURDOMAIN is not available." The same
    user account will quickly authenticate via ethernet.

    More info: This is occurring with both a new Cisco server-managed wireless
    network in one building and the old store bought access points in our other
    buildings. This is also occurring with newly re-imaged laptops that were used
    successfully last year, with newly re-imaged laptops that were purchased this
    summer and never used by anyone (except the tech who loaded the computer) and
    new out of box laptops that have not been customized for our environment. I
    point this out because we were concerned that something in the imaging
    process (RIS and WDS) might have caused this issue but since brand new Dell
    and Gateway computers also exhibit the behavior it does not appear that the
    imaging process caused this issue and therfore my job is safe since I am in
    charge of images.

    I should also point out that the only major change to our computers was the
    "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    hammered with between 150 and 200 windows updates over the summer. I suspect
    that one or both of these events is at least partially related to our
    problem.

    We really need help here. Any advice?


  2. Re: Laptops and Tablets Cannot Logon to Domain

    If all wireless computers have this issue, I don't think it is IE 7 issue. Do they receive IP addresses from DHCP? If you use WPA Enterprise, also check the IAS server. Or this link may help.

    Cisco: Wireless client can't ...Situation: The client tries to setup Cisco wireless 1310 bridge. The client can receive the signal but can't logon the domain. Ipconfig shows the client ...
    http://www.chicagotech.net/netforums...7d707b0e6327bf


    Bob Lin, MS-MVP, MCSE & CNE
    Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
    How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
    "k3v1nr055" wrote in message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    We are suddenly not able to logon to our domain(s) via wireless. This was not
    a problem until recently. This is a school where 1000 students share use of
    about 500 laptops and tablet PCs so it is most common for a particular user
    to grab a different laptops from different carts in a given day and use
    several different laptops from the same cart throughout a school year. I
    point this out so that you know that the common answer to our problem, which
    is to logon via the ethernet line and cache the profile before trying to
    connect via wireless is not acceptable nor practical. Additionally, we had
    no problem with this last school year. Now, three months later we are
    basically "dead in the water" with regard to technology for students and
    wireless access for staff. The actual message that we get is:" The system
    cannot log you on because the domain OURDOMAIN is not available." The same
    user account will quickly authenticate via ethernet.

    More info: This is occurring with both a new Cisco server-managed wireless
    network in one building and the old store bought access points in our other
    buildings. This is also occurring with newly re-imaged laptops that were used
    successfully last year, with newly re-imaged laptops that were purchased this
    summer and never used by anyone (except the tech who loaded the computer) and
    new out of box laptops that have not been customized for our environment. I
    point this out because we were concerned that something in the imaging
    process (RIS and WDS) might have caused this issue but since brand new Dell
    and Gateway computers also exhibit the behavior it does not appear that the
    imaging process caused this issue and therfore my job is safe since I am in
    charge of images.

    I should also point out that the only major change to our computers was the
    "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    hammered with between 150 and 200 windows updates over the summer. I suspect
    that one or both of these events is at least partially related to our
    problem.

    We really need help here. Any advice?


  3. Re: Laptops and Tablets Cannot Logon to Domain

    Robert,

    It appears that the Windows Firewall is part of the problem. In the past
    this did not seem to affect the initial logon. Now it appears that the
    wireless signal is being processed after the cached credentials. It also
    appears that the GPO that enables the Window Firewall is a factor. We had a
    domain GPO that disables the firewall when a computer is logged into our
    domain and when it powers up off the domain the firewall enables (domain
    profile and standard profile). We think that the firewall is preventing the
    initial connection with wireless and without a cached profile from a domain
    user the laptop will not come to the place where Windows boots up.
    Consequently, the users cannot ever get on. remember that these are newly
    imaged computers that were created and joined to the domain by WDS and they
    have the old policy.
    We found a very time consuming work around. First we disabled the standard
    profile which turns off the firewall for computers that are not on the
    domain. Of course, this now means that laptops which go home have no firewall
    turned on when they are away. This is not an acceptable situation either.
    Then we have to log into each and every laptop as the local admin. Then we
    must manually connect to the wireless network. Next, we have to log out (not
    restart because a restart and at this time we are able to log into the domain
    and the user is able to authenticate successfully. Additionally, the new
    unprotected gpo is pulled to the machine and therefore firewall is off no
    matter what. After we do this any user is able to connect to the domain and
    authenticate. We tried every conceivable combination of login, reboot, etc.
    and nothing worked consistently until the firewall was disabled for all
    scenarios. Now we have 450 laptops that we must sneaker net to, set up,
    boot, log in as Admin, log off, log in as user. restart, and test as
    different new user. This really sucks!!! If you can tell me how to enable
    the firewall and open it enough to allow the Zero Wireless Configuration
    service to start before authentication I would greatly appreciate it. I am
    really tired of systems breaking because MS send patches and "upgrades" that
    wreak more havoc on our world. In this case, something had to happen because
    this problem did not occur in June and the only difference is that we updated
    all the laptops to IE7 and applied all the approved updates that WSUS
    received.

    "Robert L [MVP - Networking]" wrote:

    > If all wireless computers have this issue, I don't think it is IE 7 issue. Do they receive IP addresses from DHCP? If you use WPA Enterprise, also check the IAS server. Or this link may help.
    >
    > Cisco: Wireless client can't ...Situation: The client tries to setup Cisco wireless 1310 bridge. The client can receive the signal but can't logon the domain. Ipconfig shows the client ...
    > http://www.chicagotech.net/netforums...7d707b0e6327bf
    >
    >
    > Bob Lin, MS-MVP, MCSE & CNE
    > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
    > How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
    > "k3v1nr055" wrote in message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    > We are suddenly not able to logon to our domain(s) via wireless. This was not
    > a problem until recently. This is a school where 1000 students share use of
    > about 500 laptops and tablet PCs so it is most common for a particular user
    > to grab a different laptops from different carts in a given day and use
    > several different laptops from the same cart throughout a school year. I
    > point this out so that you know that the common answer to our problem, which
    > is to logon via the ethernet line and cache the profile before trying to
    > connect via wireless is not acceptable nor practical. Additionally, we had
    > no problem with this last school year. Now, three months later we are
    > basically "dead in the water" with regard to technology for students and
    > wireless access for staff. The actual message that we get is:" The system
    > cannot log you on because the domain OURDOMAIN is not available." The same
    > user account will quickly authenticate via ethernet.
    >
    > More info: This is occurring with both a new Cisco server-managed wireless
    > network in one building and the old store bought access points in our other
    > buildings. This is also occurring with newly re-imaged laptops that were used
    > successfully last year, with newly re-imaged laptops that were purchased this
    > summer and never used by anyone (except the tech who loaded the computer) and
    > new out of box laptops that have not been customized for our environment. I
    > point this out because we were concerned that something in the imaging
    > process (RIS and WDS) might have caused this issue but since brand new Dell
    > and Gateway computers also exhibit the behavior it does not appear that the
    > imaging process caused this issue and therfore my job is safe since I am in
    > charge of images.
    >
    > I should also point out that the only major change to our computers was the
    > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    > hammered with between 150 and 200 windows updates over the summer. I suspect
    > that one or both of these events is at least partially related to our
    > problem.
    >
    > We really need help here. Any advice?
    >


  4. Re: Laptops and Tablets Cannot Logon to Domain

    A few more points: This is clearly not a Cisco issue. We have been in touch
    with Cisco (who has checked all the wireless infrastructure and we all agree
    that this is a Microsoft issue. This occurs with any access point that we
    test on. Also, the clients cannot get an IP addresss because all the
    adapters are disconnected since the wireless service does not connect to any
    network APs. The only way that works is to get on the domain by the lengthy
    process I described previously so that the computers can pull down the new
    policy with the firewall off. After this the wireless connectivity works
    properly and subsequent users can authenticate. If we knew that the Windows
    Firewall was such an issue we might have purchase a better solution for when
    users take laptops off campus (hence the term "mobile" computing). The cost
    would have been small compared to the loss of service and the time it will
    take to get our students up and running. We are like a lot of networks, I
    suspect, in that we have way too much to do even when things work correctly.
    and when issues like this occur, and this is more and more often, it really
    puts a hurt on us.

    "k3v1nr055" wrote:

    > Robert,
    >
    > It appears that the Windows Firewall is part of the problem. In the past
    > this did not seem to affect the initial logon. Now it appears that the
    > wireless signal is being processed after the cached credentials. It also
    > appears that the GPO that enables the Window Firewall is a factor. We had a
    > domain GPO that disables the firewall when a computer is logged into our
    > domain and when it powers up off the domain the firewall enables (domain
    > profile and standard profile). We think that the firewall is preventing the
    > initial connection with wireless and without a cached profile from a domain
    > user the laptop will not come to the place where Windows boots up.
    > Consequently, the users cannot ever get on. remember that these are newly
    > imaged computers that were created and joined to the domain by WDS and they
    > have the old policy.
    > We found a very time consuming work around. First we disabled the standard
    > profile which turns off the firewall for computers that are not on the
    > domain. Of course, this now means that laptops which go home have no firewall
    > turned on when they are away. This is not an acceptable situation either.
    > Then we have to log into each and every laptop as the local admin. Then we
    > must manually connect to the wireless network. Next, we have to log out (not
    > restart because a restart and at this time we are able to log into the domain
    > and the user is able to authenticate successfully. Additionally, the new
    > unprotected gpo is pulled to the machine and therefore firewall is off no
    > matter what. After we do this any user is able to connect to the domain and
    > authenticate. We tried every conceivable combination of login, reboot, etc.
    > and nothing worked consistently until the firewall was disabled for all
    > scenarios. Now we have 450 laptops that we must sneaker net to, set up,
    > boot, log in as Admin, log off, log in as user. restart, and test as
    > different new user. This really sucks!!! If you can tell me how to enable
    > the firewall and open it enough to allow the Zero Wireless Configuration
    > service to start before authentication I would greatly appreciate it. I am
    > really tired of systems breaking because MS send patches and "upgrades" that
    > wreak more havoc on our world. In this case, something had to happen because
    > this problem did not occur in June and the only difference is that we updated
    > all the laptops to IE7 and applied all the approved updates that WSUS
    > received.
    >
    > "Robert L [MVP - Networking]" wrote:
    >
    > > If all wireless computers have this issue, I don't think it is IE 7 issue. Do they receive IP addresses from DHCP? If you use WPA Enterprise, also check the IAS server. Or this link may help.
    > >
    > > Cisco: Wireless client can't ...Situation: The client tries to setup Cisco wireless 1310 bridge. The client can receive the signal but can't logon the domain. Ipconfig shows the client ...
    > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    > >
    > >
    > > Bob Lin, MS-MVP, MCSE & CNE
    > > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
    > > How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
    > > "k3v1nr055" wrote in message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    > > We are suddenly not able to logon to our domain(s) via wireless. This was not
    > > a problem until recently. This is a school where 1000 students share use of
    > > about 500 laptops and tablet PCs so it is most common for a particular user
    > > to grab a different laptops from different carts in a given day and use
    > > several different laptops from the same cart throughout a school year. I
    > > point this out so that you know that the common answer to our problem, which
    > > is to logon via the ethernet line and cache the profile before trying to
    > > connect via wireless is not acceptable nor practical. Additionally, we had
    > > no problem with this last school year. Now, three months later we are
    > > basically "dead in the water" with regard to technology for students and
    > > wireless access for staff. The actual message that we get is:" The system
    > > cannot log you on because the domain OURDOMAIN is not available." The same
    > > user account will quickly authenticate via ethernet.
    > >
    > > More info: This is occurring with both a new Cisco server-managed wireless
    > > network in one building and the old store bought access points in our other
    > > buildings. This is also occurring with newly re-imaged laptops that were used
    > > successfully last year, with newly re-imaged laptops that were purchased this
    > > summer and never used by anyone (except the tech who loaded the computer) and
    > > new out of box laptops that have not been customized for our environment. I
    > > point this out because we were concerned that something in the imaging
    > > process (RIS and WDS) might have caused this issue but since brand new Dell
    > > and Gateway computers also exhibit the behavior it does not appear that the
    > > imaging process caused this issue and therfore my job is safe since I am in
    > > charge of images.
    > >
    > > I should also point out that the only major change to our computers was the
    > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    > > hammered with between 150 and 200 windows updates over the summer. I suspect
    > > that one or both of these events is at least partially related to our
    > > problem.
    > >
    > > We really need help here. Any advice?
    > >


  5. Re: Laptops and Tablets Cannot Logon to Domain

    If you could watch the logon process with a wireless sniffer,
    it would be clear right away, which packets go to air when, and whether
    the firewall blocks something.

    --PA


    "k3v1nr055" wrote:
    > Robert,
    >
    > It appears that the Windows Firewall is part of the problem. In the past
    > this did not seem to affect the initial logon. Now it appears that the
    > wireless signal is being processed after the cached credentials. It also
    > appears that the GPO that enables the Window Firewall is a factor. We had a
    > domain GPO that disables the firewall when a computer is logged into our
    > domain and when it powers up off the domain the firewall enables (domain
    > profile and standard profile). We think that the firewall is preventing the
    > initial connection with wireless and without a cached profile from a domain
    > user the laptop will not come to the place where Windows boots up.
    > Consequently, the users cannot ever get on. remember that these are newly
    > imaged computers that were created and joined to the domain by WDS and they
    > have the old policy.
    > We found a very time consuming work around. First we disabled the standard
    > profile which turns off the firewall for computers that are not on the
    > domain. Of course, this now means that laptops which go home have no firewall
    > turned on when they are away. This is not an acceptable situation either.
    > Then we have to log into each and every laptop as the local admin. Then we
    > must manually connect to the wireless network. Next, we have to log out (not
    > restart because a restart and at this time we are able to log into the domain
    > and the user is able to authenticate successfully. Additionally, the new
    > unprotected gpo is pulled to the machine and therefore firewall is off no
    > matter what. After we do this any user is able to connect to the domain and
    > authenticate. We tried every conceivable combination of login, reboot, etc.
    > and nothing worked consistently until the firewall was disabled for all
    > scenarios. Now we have 450 laptops that we must sneaker net to, set up,
    > boot, log in as Admin, log off, log in as user. restart, and test as
    > different new user. This really sucks!!! If you can tell me how to enable
    > the firewall and open it enough to allow the Zero Wireless Configuration
    > service to start before authentication I would greatly appreciate it. I am
    > really tired of systems breaking because MS send patches and "upgrades" that
    > wreak more havoc on our world. In this case, something had to happen because
    > this problem did not occur in June and the only difference is that we updated
    > all the laptops to IE7 and applied all the approved updates that WSUS
    > received.
    >
    > "Robert L [MVP - Networking]" wrote:
    >
    > > If all wireless computers have this issue, I don't think it is IE 7 issue. Do they receive IP addresses from DHCP? If you use WPA Enterprise, also check the IAS server. Or this link may help.
    > >
    > > Cisco: Wireless client can't ...Situation: The client tries to setup Cisco wireless 1310 bridge. The client can receive the signal but can't logon the domain. Ipconfig shows the client ...
    > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    > >
    > >
    > > Bob Lin, MS-MVP, MCSE & CNE
    > > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
    > > How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
    > > "k3v1nr055" wrote in message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    > > We are suddenly not able to logon to our domain(s) via wireless. This was not
    > > a problem until recently. This is a school where 1000 students share use of
    > > about 500 laptops and tablet PCs so it is most common for a particular user
    > > to grab a different laptops from different carts in a given day and use
    > > several different laptops from the same cart throughout a school year. I
    > > point this out so that you know that the common answer to our problem, which
    > > is to logon via the ethernet line and cache the profile before trying to
    > > connect via wireless is not acceptable nor practical. Additionally, we had
    > > no problem with this last school year. Now, three months later we are
    > > basically "dead in the water" with regard to technology for students and
    > > wireless access for staff. The actual message that we get is:" The system
    > > cannot log you on because the domain OURDOMAIN is not available." The same
    > > user account will quickly authenticate via ethernet.
    > >
    > > More info: This is occurring with both a new Cisco server-managed wireless
    > > network in one building and the old store bought access points in our other
    > > buildings. This is also occurring with newly re-imaged laptops that were used
    > > successfully last year, with newly re-imaged laptops that were purchased this
    > > summer and never used by anyone (except the tech who loaded the computer) and
    > > new out of box laptops that have not been customized for our environment. I
    > > point this out because we were concerned that something in the imaging
    > > process (RIS and WDS) might have caused this issue but since brand new Dell
    > > and Gateway computers also exhibit the behavior it does not appear that the
    > > imaging process caused this issue and therfore my job is safe since I am in
    > > charge of images.
    > >
    > > I should also point out that the only major change to our computers was the
    > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    > > hammered with between 150 and 200 windows updates over the summer. I suspect
    > > that one or both of these events is at least partially related to our
    > > problem.
    > >
    > > We really need help here. Any advice?
    > >


  6. Re: Laptops and Tablets Cannot Logon to Domain

    I have not used a wireless sniffer but if I used something like airsnort
    would I be able to watch what occurs on one of the problematic machines from
    a computer that is already up and running? If that's possible could you point
    me to some info on doing that?

    "Pavel A." wrote:

    > If you could watch the logon process with a wireless sniffer,
    > it would be clear right away, which packets go to air when, and whether
    > the firewall blocks something.
    >
    > --PA
    >
    >
    > "k3v1nr055" wrote:
    > > Robert,
    > >
    > > It appears that the Windows Firewall is part of the problem. In the past
    > > this did not seem to affect the initial logon. Now it appears that the
    > > wireless signal is being processed after the cached credentials. It also
    > > appears that the GPO that enables the Window Firewall is a factor. We had a
    > > domain GPO that disables the firewall when a computer is logged into our
    > > domain and when it powers up off the domain the firewall enables (domain
    > > profile and standard profile). We think that the firewall is preventing the
    > > initial connection with wireless and without a cached profile from a domain
    > > user the laptop will not come to the place where Windows boots up.
    > > Consequently, the users cannot ever get on. remember that these are newly
    > > imaged computers that were created and joined to the domain by WDS and they
    > > have the old policy.
    > > We found a very time consuming work around. First we disabled the standard
    > > profile which turns off the firewall for computers that are not on the
    > > domain. Of course, this now means that laptops which go home have no firewall
    > > turned on when they are away. This is not an acceptable situation either.
    > > Then we have to log into each and every laptop as the local admin. Then we
    > > must manually connect to the wireless network. Next, we have to log out (not
    > > restart because a restart and at this time we are able to log into the domain
    > > and the user is able to authenticate successfully. Additionally, the new
    > > unprotected gpo is pulled to the machine and therefore firewall is off no
    > > matter what. After we do this any user is able to connect to the domain and
    > > authenticate. We tried every conceivable combination of login, reboot, etc.
    > > and nothing worked consistently until the firewall was disabled for all
    > > scenarios. Now we have 450 laptops that we must sneaker net to, set up,
    > > boot, log in as Admin, log off, log in as user. restart, and test as
    > > different new user. This really sucks!!! If you can tell me how to enable
    > > the firewall and open it enough to allow the Zero Wireless Configuration
    > > service to start before authentication I would greatly appreciate it. I am
    > > really tired of systems breaking because MS send patches and "upgrades" that
    > > wreak more havoc on our world. In this case, something had to happen because
    > > this problem did not occur in June and the only difference is that we updated
    > > all the laptops to IE7 and applied all the approved updates that WSUS
    > > received.
    > >
    > > "Robert L [MVP - Networking]" wrote:
    > >
    > > > If all wireless computers have this issue, I don't think it is IE 7 issue. Do they receive IP addresses from DHCP? If you use WPA Enterprise, also check the IAS server. Or this link may help.
    > > >
    > > > Cisco: Wireless client can't ...Situation: The client tries to setup Cisco wireless 1310 bridge. The client can receive the signal but can't logon the domain. Ipconfig shows the client ...
    > > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    > > >
    > > >
    > > > Bob Lin, MS-MVP, MCSE & CNE
    > > > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
    > > > How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
    > > > "k3v1nr055" wrote in message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    > > > We are suddenly not able to logon to our domain(s) via wireless. This was not
    > > > a problem until recently. This is a school where 1000 students share use of
    > > > about 500 laptops and tablet PCs so it is most common for a particular user
    > > > to grab a different laptops from different carts in a given day and use
    > > > several different laptops from the same cart throughout a school year. I
    > > > point this out so that you know that the common answer to our problem, which
    > > > is to logon via the ethernet line and cache the profile before trying to
    > > > connect via wireless is not acceptable nor practical. Additionally, we had
    > > > no problem with this last school year. Now, three months later we are
    > > > basically "dead in the water" with regard to technology for students and
    > > > wireless access for staff. The actual message that we get is:" The system
    > > > cannot log you on because the domain OURDOMAIN is not available." The same
    > > > user account will quickly authenticate via ethernet.
    > > >
    > > > More info: This is occurring with both a new Cisco server-managed wireless
    > > > network in one building and the old store bought access points in our other
    > > > buildings. This is also occurring with newly re-imaged laptops that were used
    > > > successfully last year, with newly re-imaged laptops that were purchased this
    > > > summer and never used by anyone (except the tech who loaded the computer) and
    > > > new out of box laptops that have not been customized for our environment. I
    > > > point this out because we were concerned that something in the imaging
    > > > process (RIS and WDS) might have caused this issue but since brand new Dell
    > > > and Gateway computers also exhibit the behavior it does not appear that the
    > > > imaging process caused this issue and therfore my job is safe since I am in
    > > > charge of images.
    > > >
    > > > I should also point out that the only major change to our computers was the
    > > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    > > > hammered with between 150 and 200 windows updates over the summer. I suspect
    > > > that one or both of these events is at least partially related to our
    > > > problem.
    > > >
    > > > We really need help here. Any advice?
    > > >


  7. Re: Laptops and Tablets Cannot Logon to Domain

    am certain that the Windows Firewall is most responsible for this issue. In
    order to get our 400 laptops to be able to see a domain controller we had to
    turn off the standard profile firewall GPO (which exposes all laptops when
    they are outside of our perimeter....bad news). Then we had to start and log
    into each computer as the local admin and manually connect to the wireless
    signal. Next without we logged off the computer (we did not restart) and were
    able to log on with a domain account. This also pulled down the policy change
    which disabled the firewall. Then and only then were we able to connect to
    the wireless signal after a restart. This did not work until the firewall
    was turned off in Group Policy. Again I must state that this behavior was
    not exhibited last spring so something changed or was force to change for
    some unknown reason. I still believe that IE7 (urgh!!!) and it's so called
    "improvements" are the reason. If I could have my way I would uninstall this
    monster and put Firefox on every PC on our campus.

    "k3v1nr055" wrote:

    > I have not used a wireless sniffer but if I used something like airsnort
    > would I be able to watch what occurs on one of the problematic machines from
    > a computer that is already up and running? If that's possible could you point
    > me to some info on doing that?
    >
    > "Pavel A." wrote:
    >
    > > If you could watch the logon process with a wireless sniffer,
    > > it would be clear right away, which packets go to air when, and whether
    > > the firewall blocks something.
    > >
    > > --PA
    > >
    > >
    > > "k3v1nr055" wrote:
    > > > Robert,
    > > >
    > > > It appears that the Windows Firewall is part of the problem. In the past
    > > > this did not seem to affect the initial logon. Now it appears that the
    > > > wireless signal is being processed after the cached credentials. It also
    > > > appears that the GPO that enables the Window Firewall is a factor. We had a
    > > > domain GPO that disables the firewall when a computer is logged into our
    > > > domain and when it powers up off the domain the firewall enables (domain
    > > > profile and standard profile). We think that the firewall is preventing the
    > > > initial connection with wireless and without a cached profile from a domain
    > > > user the laptop will not come to the place where Windows boots up.
    > > > Consequently, the users cannot ever get on. remember that these are newly
    > > > imaged computers that were created and joined to the domain by WDS and they
    > > > have the old policy.
    > > > We found a very time consuming work around. First we disabled the standard
    > > > profile which turns off the firewall for computers that are not on the
    > > > domain. Of course, this now means that laptops which go home have no firewall
    > > > turned on when they are away. This is not an acceptable situation either.
    > > > Then we have to log into each and every laptop as the local admin. Then we
    > > > must manually connect to the wireless network. Next, we have to log out (not
    > > > restart because a restart and at this time we are able to log into the domain
    > > > and the user is able to authenticate successfully. Additionally, the new
    > > > unprotected gpo is pulled to the machine and therefore firewall is off no
    > > > matter what. After we do this any user is able to connect to the domain and
    > > > authenticate. We tried every conceivable combination of login, reboot, etc.
    > > > and nothing worked consistently until the firewall was disabled for all
    > > > scenarios. Now we have 450 laptops that we must sneaker net to, set up,
    > > > boot, log in as Admin, log off, log in as user. restart, and test as
    > > > different new user. This really sucks!!! If you can tell me how to enable
    > > > the firewall and open it enough to allow the Zero Wireless Configuration
    > > > service to start before authentication I would greatly appreciate it. I am
    > > > really tired of systems breaking because MS send patches and "upgrades" that
    > > > wreak more havoc on our world. In this case, something had to happen because
    > > > this problem did not occur in June and the only difference is that we updated
    > > > all the laptops to IE7 and applied all the approved updates that WSUS
    > > > received.
    > > >
    > > > "Robert L [MVP - Networking]" wrote:
    > > >
    > > > > If all wireless computers have this issue, I don't think it is IE 7 issue. Do they receive IP addresses from DHCP? If you use WPA Enterprise, also check the IAS server. Or this link may help.
    > > > >
    > > > > Cisco: Wireless client can't ...Situation: The client tries to setup Cisco wireless 1310 bridge. The client can receive the signal but can't logon the domain. Ipconfig shows the client ...
    > > > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    > > > >
    > > > >
    > > > > Bob Lin, MS-MVP, MCSE & CNE
    > > > > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
    > > > > How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
    > > > > "k3v1nr055" wrote in message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    > > > > We are suddenly not able to logon to our domain(s) via wireless. This was not
    > > > > a problem until recently. This is a school where 1000 students share use of
    > > > > about 500 laptops and tablet PCs so it is most common for a particular user
    > > > > to grab a different laptops from different carts in a given day and use
    > > > > several different laptops from the same cart throughout a school year. I
    > > > > point this out so that you know that the common answer to our problem, which
    > > > > is to logon via the ethernet line and cache the profile before trying to
    > > > > connect via wireless is not acceptable nor practical. Additionally, we had
    > > > > no problem with this last school year. Now, three months later we are
    > > > > basically "dead in the water" with regard to technology for students and
    > > > > wireless access for staff. The actual message that we get is:" The system
    > > > > cannot log you on because the domain OURDOMAIN is not available." The same
    > > > > user account will quickly authenticate via ethernet.
    > > > >
    > > > > More info: This is occurring with both a new Cisco server-managed wireless
    > > > > network in one building and the old store bought access points in our other
    > > > > buildings. This is also occurring with newly re-imaged laptops that were used
    > > > > successfully last year, with newly re-imaged laptops that were purchased this
    > > > > summer and never used by anyone (except the tech who loaded the computer) and
    > > > > new out of box laptops that have not been customized for our environment. I
    > > > > point this out because we were concerned that something in the imaging
    > > > > process (RIS and WDS) might have caused this issue but since brand new Dell
    > > > > and Gateway computers also exhibit the behavior it does not appear that the
    > > > > imaging process caused this issue and therfore my job is safe since I am in
    > > > > charge of images.
    > > > >
    > > > > I should also point out that the only major change to our computers was the
    > > > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    > > > > hammered with between 150 and 200 windows updates over the summer. I suspect
    > > > > that one or both of these events is at least partially related to our
    > > > > problem.
    > > > >
    > > > > We really need help here. Any advice?
    > > > >


  8. Re: Laptops and Tablets Cannot Logon to Domain

    Hi,

    The fact that this happened on hundreds of laptops at about the same time
    makes me suspect a PKI issue, possibly related to certificate expiration.
    What wireless authentication method are you using?

    --
    Greg Lindsay [MSFT]

    Disclaimer: This posting is provided "AS IS" with no warranties, and confers
    no rights.

    "k3v1nr055" wrote in message
    news:2736CCAE-AC4B-40B9-951C-CA8336A8C50A@microsoft.com...
    > am certain that the Windows Firewall is most responsible for this issue.
    > In
    > order to get our 400 laptops to be able to see a domain controller we had
    > to
    > turn off the standard profile firewall GPO (which exposes all laptops when
    > they are outside of our perimeter....bad news). Then we had to start and
    > log
    > into each computer as the local admin and manually connect to the wireless
    > signal. Next without we logged off the computer (we did not restart) and
    > were
    > able to log on with a domain account. This also pulled down the policy
    > change
    > which disabled the firewall. Then and only then were we able to connect to
    > the wireless signal after a restart. This did not work until the
    > firewall
    > was turned off in Group Policy. Again I must state that this behavior was
    > not exhibited last spring so something changed or was force to change for
    > some unknown reason. I still believe that IE7 (urgh!!!) and it's so
    > called
    > "improvements" are the reason. If I could have my way I would uninstall
    > this
    > monster and put Firefox on every PC on our campus.
    >
    > "k3v1nr055" wrote:
    >
    >> I have not used a wireless sniffer but if I used something like airsnort
    >> would I be able to watch what occurs on one of the problematic machines
    >> from
    >> a computer that is already up and running? If that's possible could you
    >> point
    >> me to some info on doing that?
    >>
    >> "Pavel A." wrote:
    >>
    >> > If you could watch the logon process with a wireless sniffer,
    >> > it would be clear right away, which packets go to air when, and whether
    >> > the firewall blocks something.
    >> >
    >> > --PA
    >> >
    >> >
    >> > "k3v1nr055" wrote:
    >> > > Robert,
    >> > >
    >> > > It appears that the Windows Firewall is part of the problem. In the
    >> > > past
    >> > > this did not seem to affect the initial logon. Now it appears that
    >> > > the
    >> > > wireless signal is being processed after the cached credentials. It
    >> > > also
    >> > > appears that the GPO that enables the Window Firewall is a factor. We
    >> > > had a
    >> > > domain GPO that disables the firewall when a computer is logged into
    >> > > our
    >> > > domain and when it powers up off the domain the firewall enables
    >> > > (domain
    >> > > profile and standard profile). We think that the firewall is
    >> > > preventing the
    >> > > initial connection with wireless and without a cached profile from a
    >> > > domain
    >> > > user the laptop will not come to the place where Windows boots up.
    >> > > Consequently, the users cannot ever get on. remember that these are
    >> > > newly
    >> > > imaged computers that were created and joined to the domain by WDS
    >> > > and they
    >> > > have the old policy.
    >> > > We found a very time consuming work around. First we disabled the
    >> > > standard
    >> > > profile which turns off the firewall for computers that are not on
    >> > > the
    >> > > domain. Of course, this now means that laptops which go home have no
    >> > > firewall
    >> > > turned on when they are away. This is not an acceptable situation
    >> > > either.
    >> > > Then we have to log into each and every laptop as the local admin.
    >> > > Then we
    >> > > must manually connect to the wireless network. Next, we have to log
    >> > > out (not
    >> > > restart because a restart and at this time we are able to log into
    >> > > the domain
    >> > > and the user is able to authenticate successfully. Additionally, the
    >> > > new
    >> > > unprotected gpo is pulled to the machine and therefore firewall is
    >> > > off no
    >> > > matter what. After we do this any user is able to connect to the
    >> > > domain and
    >> > > authenticate. We tried every conceivable combination of login,
    >> > > reboot, etc.
    >> > > and nothing worked consistently until the firewall was disabled for
    >> > > all
    >> > > scenarios. Now we have 450 laptops that we must sneaker net to, set
    >> > > up,
    >> > > boot, log in as Admin, log off, log in as user. restart, and test as
    >> > > different new user. This really sucks!!! If you can tell me how to
    >> > > enable
    >> > > the firewall and open it enough to allow the Zero Wireless
    >> > > Configuration
    >> > > service to start before authentication I would greatly appreciate it.
    >> > > I am
    >> > > really tired of systems breaking because MS send patches and
    >> > > "upgrades" that
    >> > > wreak more havoc on our world. In this case, something had to happen
    >> > > because
    >> > > this problem did not occur in June and the only difference is that we
    >> > > updated
    >> > > all the laptops to IE7 and applied all the approved updates that WSUS
    >> > > received.
    >> > >
    >> > > "Robert L [MVP - Networking]" wrote:
    >> > >
    >> > > > If all wireless computers have this issue, I don't think it is IE 7
    >> > > > issue. Do they receive IP addresses from DHCP? If you use WPA
    >> > > > Enterprise, also check the IAS server. Or this link may help.
    >> > > >
    >> > > > Cisco: Wireless client can't ...Situation: The client tries to
    >> > > > setup Cisco wireless 1310 bridge. The client can receive the signal
    >> > > > but can't logon the domain. Ipconfig shows the client ...
    >> > > >
    >> > > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    >> > > >
    >> > > >
    >> > > > Bob Lin, MS-MVP, MCSE & CNE
    >> > > > Networking, Internet, Routing, VPN Troubleshooting on
    >> > > > http://www.ChicagoTech.net
    >> > > > How to Setup Windows, Network, VPN & Remote Access on
    >> > > > http://www.HowToNetworking.com
    >> > > > "k3v1nr055" wrote in
    >> > > > message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    >> > > > We are suddenly not able to logon to our domain(s) via wireless.
    >> > > > This was not
    >> > > > a problem until recently. This is a school where 1000 students
    >> > > > share use of
    >> > > > about 500 laptops and tablet PCs so it is most common for a
    >> > > > particular user
    >> > > > to grab a different laptops from different carts in a given day
    >> > > > and use
    >> > > > several different laptops from the same cart throughout a school
    >> > > > year. I
    >> > > > point this out so that you know that the common answer to our
    >> > > > problem, which
    >> > > > is to logon via the ethernet line and cache the profile before
    >> > > > trying to
    >> > > > connect via wireless is not acceptable nor practical.
    >> > > > Additionally, we had
    >> > > > no problem with this last school year. Now, three months later we
    >> > > > are
    >> > > > basically "dead in the water" with regard to technology for
    >> > > > students and
    >> > > > wireless access for staff. The actual message that we get is:"
    >> > > > The system
    >> > > > cannot log you on because the domain OURDOMAIN is not available."
    >> > > > The same
    >> > > > user account will quickly authenticate via ethernet.
    >> > > >
    >> > > > More info: This is occurring with both a new Cisco server-managed
    >> > > > wireless
    >> > > > network in one building and the old store bought access points in
    >> > > > our other
    >> > > > buildings. This is also occurring with newly re-imaged laptops
    >> > > > that were used
    >> > > > successfully last year, with newly re-imaged laptops that were
    >> > > > purchased this
    >> > > > summer and never used by anyone (except the tech who loaded the
    >> > > > computer) and
    >> > > > new out of box laptops that have not been customized for our
    >> > > > environment. I
    >> > > > point this out because we were concerned that something in the
    >> > > > imaging
    >> > > > process (RIS and WDS) might have caused this issue but since
    >> > > > brand new Dell
    >> > > > and Gateway computers also exhibit the behavior it does not
    >> > > > appear that the
    >> > > > imaging process caused this issue and therfore my job is safe
    >> > > > since I am in
    >> > > > charge of images.
    >> > > >
    >> > > > I should also point out that the only major change to our
    >> > > > computers was the
    >> > > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and
    >> > > > we also were
    >> > > > hammered with between 150 and 200 windows updates over the
    >> > > > summer. I suspect
    >> > > > that one or both of these events is at least partially related to
    >> > > > our
    >> > > > problem.
    >> > > >
    >> > > > We really need help here. Any advice?
    >> > > >




  9. Re: Laptops and Tablets Cannot Logon to Domain

    Right now the wireless is wide open and has been for some time. Later this
    week we are having a managed Cisco system installed and we will push down
    keys and then turn on one or more security implementations. However, it
    still seems strange that computers that have an existing domain profile for
    the user that is logging on would eventually connect to the network via
    wireless but if the user was logging on for the first time and the GPO that
    disabled the firewall had not replicated to the box then that user could not
    "find a domain controller". What also puzzles me is why this began to occur
    since last June when school ended. We made no changes to our setup. The only
    things that changed were the result of MS updates that we push out via WSUS.
    We don't have time to hunt down every anomaly that occurs and these kinds of
    things seem to occur more and more often. It's very frustrating.
    "Greg Lindsay [MSFT]" wrote:

    > Hi,
    >
    > The fact that this happened on hundreds of laptops at about the same time
    > makes me suspect a PKI issue, possibly related to certificate expiration.
    > What wireless authentication method are you using?
    >
    > --
    > Greg Lindsay [MSFT]
    >
    > Disclaimer: This posting is provided "AS IS" with no warranties, and confers
    > no rights.
    >
    > "k3v1nr055" wrote in message
    > news:2736CCAE-AC4B-40B9-951C-CA8336A8C50A@microsoft.com...
    > > am certain that the Windows Firewall is most responsible for this issue.
    > > In
    > > order to get our 400 laptops to be able to see a domain controller we had
    > > to
    > > turn off the standard profile firewall GPO (which exposes all laptops when
    > > they are outside of our perimeter....bad news). Then we had to start and
    > > log
    > > into each computer as the local admin and manually connect to the wireless
    > > signal. Next without we logged off the computer (we did not restart) and
    > > were
    > > able to log on with a domain account. This also pulled down the policy
    > > change
    > > which disabled the firewall. Then and only then were we able to connect to
    > > the wireless signal after a restart. This did not work until the
    > > firewall
    > > was turned off in Group Policy. Again I must state that this behavior was
    > > not exhibited last spring so something changed or was force to change for
    > > some unknown reason. I still believe that IE7 (urgh!!!) and it's so
    > > called
    > > "improvements" are the reason. If I could have my way I would uninstall
    > > this
    > > monster and put Firefox on every PC on our campus.
    > >
    > > "k3v1nr055" wrote:
    > >
    > >> I have not used a wireless sniffer but if I used something like airsnort
    > >> would I be able to watch what occurs on one of the problematic machines
    > >> from
    > >> a computer that is already up and running? If that's possible could you
    > >> point
    > >> me to some info on doing that?
    > >>
    > >> "Pavel A." wrote:
    > >>
    > >> > If you could watch the logon process with a wireless sniffer,
    > >> > it would be clear right away, which packets go to air when, and whether
    > >> > the firewall blocks something.
    > >> >
    > >> > --PA
    > >> >
    > >> >
    > >> > "k3v1nr055" wrote:
    > >> > > Robert,
    > >> > >
    > >> > > It appears that the Windows Firewall is part of the problem. In the
    > >> > > past
    > >> > > this did not seem to affect the initial logon. Now it appears that
    > >> > > the
    > >> > > wireless signal is being processed after the cached credentials. It
    > >> > > also
    > >> > > appears that the GPO that enables the Window Firewall is a factor. We
    > >> > > had a
    > >> > > domain GPO that disables the firewall when a computer is logged into
    > >> > > our
    > >> > > domain and when it powers up off the domain the firewall enables
    > >> > > (domain
    > >> > > profile and standard profile). We think that the firewall is
    > >> > > preventing the
    > >> > > initial connection with wireless and without a cached profile from a
    > >> > > domain
    > >> > > user the laptop will not come to the place where Windows boots up.
    > >> > > Consequently, the users cannot ever get on. remember that these are
    > >> > > newly
    > >> > > imaged computers that were created and joined to the domain by WDS
    > >> > > and they
    > >> > > have the old policy.
    > >> > > We found a very time consuming work around. First we disabled the
    > >> > > standard
    > >> > > profile which turns off the firewall for computers that are not on
    > >> > > the
    > >> > > domain. Of course, this now means that laptops which go home have no
    > >> > > firewall
    > >> > > turned on when they are away. This is not an acceptable situation
    > >> > > either.
    > >> > > Then we have to log into each and every laptop as the local admin.
    > >> > > Then we
    > >> > > must manually connect to the wireless network. Next, we have to log
    > >> > > out (not
    > >> > > restart because a restart and at this time we are able to log into
    > >> > > the domain
    > >> > > and the user is able to authenticate successfully. Additionally, the
    > >> > > new
    > >> > > unprotected gpo is pulled to the machine and therefore firewall is
    > >> > > off no
    > >> > > matter what. After we do this any user is able to connect to the
    > >> > > domain and
    > >> > > authenticate. We tried every conceivable combination of login,
    > >> > > reboot, etc.
    > >> > > and nothing worked consistently until the firewall was disabled for
    > >> > > all
    > >> > > scenarios. Now we have 450 laptops that we must sneaker net to, set
    > >> > > up,
    > >> > > boot, log in as Admin, log off, log in as user. restart, and test as
    > >> > > different new user. This really sucks!!! If you can tell me how to
    > >> > > enable
    > >> > > the firewall and open it enough to allow the Zero Wireless
    > >> > > Configuration
    > >> > > service to start before authentication I would greatly appreciate it.
    > >> > > I am
    > >> > > really tired of systems breaking because MS send patches and
    > >> > > "upgrades" that
    > >> > > wreak more havoc on our world. In this case, something had to happen
    > >> > > because
    > >> > > this problem did not occur in June and the only difference is that we
    > >> > > updated
    > >> > > all the laptops to IE7 and applied all the approved updates that WSUS
    > >> > > received.
    > >> > >
    > >> > > "Robert L [MVP - Networking]" wrote:
    > >> > >
    > >> > > > If all wireless computers have this issue, I don't think it is IE 7
    > >> > > > issue. Do they receive IP addresses from DHCP? If you use WPA
    > >> > > > Enterprise, also check the IAS server. Or this link may help.
    > >> > > >
    > >> > > > Cisco: Wireless client can't ...Situation: The client tries to
    > >> > > > setup Cisco wireless 1310 bridge. The client can receive the signal
    > >> > > > but can't logon the domain. Ipconfig shows the client ...
    > >> > > >
    > >> > > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    > >> > > >
    > >> > > >
    > >> > > > Bob Lin, MS-MVP, MCSE & CNE
    > >> > > > Networking, Internet, Routing, VPN Troubleshooting on
    > >> > > > http://www.ChicagoTech.net
    > >> > > > How to Setup Windows, Network, VPN & Remote Access on
    > >> > > > http://www.HowToNetworking.com
    > >> > > > "k3v1nr055" wrote in
    > >> > > > message news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    > >> > > > We are suddenly not able to logon to our domain(s) via wireless.
    > >> > > > This was not
    > >> > > > a problem until recently. This is a school where 1000 students
    > >> > > > share use of
    > >> > > > about 500 laptops and tablet PCs so it is most common for a
    > >> > > > particular user
    > >> > > > to grab a different laptops from different carts in a given day
    > >> > > > and use
    > >> > > > several different laptops from the same cart throughout a school
    > >> > > > year. I
    > >> > > > point this out so that you know that the common answer to our
    > >> > > > problem, which
    > >> > > > is to logon via the ethernet line and cache the profile before
    > >> > > > trying to
    > >> > > > connect via wireless is not acceptable nor practical.
    > >> > > > Additionally, we had
    > >> > > > no problem with this last school year. Now, three months later we
    > >> > > > are
    > >> > > > basically "dead in the water" with regard to technology for
    > >> > > > students and
    > >> > > > wireless access for staff. The actual message that we get is:"
    > >> > > > The system
    > >> > > > cannot log you on because the domain OURDOMAIN is not available."
    > >> > > > The same
    > >> > > > user account will quickly authenticate via ethernet.
    > >> > > >
    > >> > > > More info: This is occurring with both a new Cisco server-managed
    > >> > > > wireless
    > >> > > > network in one building and the old store bought access points in
    > >> > > > our other
    > >> > > > buildings. This is also occurring with newly re-imaged laptops
    > >> > > > that were used
    > >> > > > successfully last year, with newly re-imaged laptops that were
    > >> > > > purchased this
    > >> > > > summer and never used by anyone (except the tech who loaded the
    > >> > > > computer) and
    > >> > > > new out of box laptops that have not been customized for our
    > >> > > > environment. I
    > >> > > > point this out because we were concerned that something in the
    > >> > > > imaging
    > >> > > > process (RIS and WDS) might have caused this issue but since
    > >> > > > brand new Dell
    > >> > > > and Gateway computers also exhibit the behavior it does not
    > >> > > > appear that the
    > >> > > > imaging process caused this issue and therfore my job is safe
    > >> > > > since I am in
    > >> > > > charge of images.
    > >> > > >
    > >> > > > I should also point out that the only major change to our
    > >> > > > computers was the
    > >> > > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and
    > >> > > > we also were
    > >> > > > hammered with between 150 and 200 windows updates over the
    > >> > > > summer. I suspect
    > >> > > > that one or both of these events is at least partially related to
    > >> > > > our
    > >> > > > problem.
    > >> > > >
    > >> > > > We really need help here. Any advice?
    > >> > > >

    >
    >
    >


  10. Re: Laptops and Tablets Cannot Logon to Domain

    I am sorry for all the frustration, it does sound like an extremely bad
    situation. I hope that I can help, either directly or by getting some other
    experts involved.

    I'd just like to double-check that you aren't using 802.1X at all. If you
    view the properties of your wireless network, and check the authentication
    tab, is the Enable IEEE 802.1x..." check box selected? If so, what is in the
    dropdown next to EAP type?

    I'm still thinking about why the firewall affects this. It might help to set
    the firewall to start as automatic(delayed) or make it dependent on the zero
    wireless configuration service, but that is not getting to the root cause of
    the problem.

    --
    Greg Lindsay [MSFT]

    Disclaimer: This posting is provided "AS IS" with no warranties, and confers
    no rights.

    "k3v1nr055" wrote in message
    news:4FC857F0-3CB5-4AFE-82A4-F22F9D4B557A@microsoft.com...
    > Right now the wireless is wide open and has been for some time. Later
    > this
    > week we are having a managed Cisco system installed and we will push down
    > keys and then turn on one or more security implementations. However, it
    > still seems strange that computers that have an existing domain profile
    > for
    > the user that is logging on would eventually connect to the network via
    > wireless but if the user was logging on for the first time and the GPO
    > that
    > disabled the firewall had not replicated to the box then that user could
    > not
    > "find a domain controller". What also puzzles me is why this began to
    > occur
    > since last June when school ended. We made no changes to our setup. The
    > only
    > things that changed were the result of MS updates that we push out via
    > WSUS.
    > We don't have time to hunt down every anomaly that occurs and these kinds
    > of
    > things seem to occur more and more often. It's very frustrating.
    > "Greg Lindsay [MSFT]" wrote:
    >
    >> Hi,
    >>
    >> The fact that this happened on hundreds of laptops at about the same time
    >> makes me suspect a PKI issue, possibly related to certificate expiration.
    >> What wireless authentication method are you using?
    >>
    >> --
    >> Greg Lindsay [MSFT]
    >>
    >> Disclaimer: This posting is provided "AS IS" with no warranties, and
    >> confers
    >> no rights.
    >>
    >> "k3v1nr055" wrote in message
    >> news:2736CCAE-AC4B-40B9-951C-CA8336A8C50A@microsoft.com...
    >> > am certain that the Windows Firewall is most responsible for this
    >> > issue.
    >> > In
    >> > order to get our 400 laptops to be able to see a domain controller we
    >> > had
    >> > to
    >> > turn off the standard profile firewall GPO (which exposes all laptops
    >> > when
    >> > they are outside of our perimeter....bad news). Then we had to start
    >> > and
    >> > log
    >> > into each computer as the local admin and manually connect to the
    >> > wireless
    >> > signal. Next without we logged off the computer (we did not restart)
    >> > and
    >> > were
    >> > able to log on with a domain account. This also pulled down the policy
    >> > change
    >> > which disabled the firewall. Then and only then were we able to connect
    >> > to
    >> > the wireless signal after a restart. This did not work until the
    >> > firewall
    >> > was turned off in Group Policy. Again I must state that this behavior
    >> > was
    >> > not exhibited last spring so something changed or was force to change
    >> > for
    >> > some unknown reason. I still believe that IE7 (urgh!!!) and it's so
    >> > called
    >> > "improvements" are the reason. If I could have my way I would
    >> > uninstall
    >> > this
    >> > monster and put Firefox on every PC on our campus.
    >> >
    >> > "k3v1nr055" wrote:
    >> >
    >> >> I have not used a wireless sniffer but if I used something like
    >> >> airsnort
    >> >> would I be able to watch what occurs on one of the problematic
    >> >> machines
    >> >> from
    >> >> a computer that is already up and running? If that's possible could
    >> >> you
    >> >> point
    >> >> me to some info on doing that?
    >> >>
    >> >> "Pavel A." wrote:
    >> >>
    >> >> > If you could watch the logon process with a wireless sniffer,
    >> >> > it would be clear right away, which packets go to air when, and
    >> >> > whether
    >> >> > the firewall blocks something.
    >> >> >
    >> >> > --PA
    >> >> >
    >> >> >
    >> >> > "k3v1nr055" wrote:
    >> >> > > Robert,
    >> >> > >
    >> >> > > It appears that the Windows Firewall is part of the problem. In
    >> >> > > the
    >> >> > > past
    >> >> > > this did not seem to affect the initial logon. Now it appears
    >> >> > > that
    >> >> > > the
    >> >> > > wireless signal is being processed after the cached credentials.
    >> >> > > It
    >> >> > > also
    >> >> > > appears that the GPO that enables the Window Firewall is a factor.
    >> >> > > We
    >> >> > > had a
    >> >> > > domain GPO that disables the firewall when a computer is logged
    >> >> > > into
    >> >> > > our
    >> >> > > domain and when it powers up off the domain the firewall enables
    >> >> > > (domain
    >> >> > > profile and standard profile). We think that the firewall is
    >> >> > > preventing the
    >> >> > > initial connection with wireless and without a cached profile from
    >> >> > > a
    >> >> > > domain
    >> >> > > user the laptop will not come to the place where Windows boots up.
    >> >> > > Consequently, the users cannot ever get on. remember that these
    >> >> > > are
    >> >> > > newly
    >> >> > > imaged computers that were created and joined to the domain by WDS
    >> >> > > and they
    >> >> > > have the old policy.
    >> >> > > We found a very time consuming work around. First we disabled the
    >> >> > > standard
    >> >> > > profile which turns off the firewall for computers that are not on
    >> >> > > the
    >> >> > > domain. Of course, this now means that laptops which go home have
    >> >> > > no
    >> >> > > firewall
    >> >> > > turned on when they are away. This is not an acceptable situation
    >> >> > > either.
    >> >> > > Then we have to log into each and every laptop as the local admin.
    >> >> > > Then we
    >> >> > > must manually connect to the wireless network. Next, we have to
    >> >> > > log
    >> >> > > out (not
    >> >> > > restart because a restart and at this time we are able to log into
    >> >> > > the domain
    >> >> > > and the user is able to authenticate successfully. Additionally,
    >> >> > > the
    >> >> > > new
    >> >> > > unprotected gpo is pulled to the machine and therefore firewall is
    >> >> > > off no
    >> >> > > matter what. After we do this any user is able to connect to the
    >> >> > > domain and
    >> >> > > authenticate. We tried every conceivable combination of login,
    >> >> > > reboot, etc.
    >> >> > > and nothing worked consistently until the firewall was disabled
    >> >> > > for
    >> >> > > all
    >> >> > > scenarios. Now we have 450 laptops that we must sneaker net to,
    >> >> > > set
    >> >> > > up,
    >> >> > > boot, log in as Admin, log off, log in as user. restart, and test
    >> >> > > as
    >> >> > > different new user. This really sucks!!! If you can tell me how
    >> >> > > to
    >> >> > > enable
    >> >> > > the firewall and open it enough to allow the Zero Wireless
    >> >> > > Configuration
    >> >> > > service to start before authentication I would greatly appreciate
    >> >> > > it.
    >> >> > > I am
    >> >> > > really tired of systems breaking because MS send patches and
    >> >> > > "upgrades" that
    >> >> > > wreak more havoc on our world. In this case, something had to
    >> >> > > happen
    >> >> > > because
    >> >> > > this problem did not occur in June and the only difference is that
    >> >> > > we
    >> >> > > updated
    >> >> > > all the laptops to IE7 and applied all the approved updates that
    >> >> > > WSUS
    >> >> > > received.
    >> >> > >
    >> >> > > "Robert L [MVP - Networking]" wrote:
    >> >> > >
    >> >> > > > If all wireless computers have this issue, I don't think it is
    >> >> > > > IE 7
    >> >> > > > issue. Do they receive IP addresses from DHCP? If you use WPA
    >> >> > > > Enterprise, also check the IAS server. Or this link may help.
    >> >> > > >
    >> >> > > > Cisco: Wireless client can't ...Situation: The client tries to
    >> >> > > > setup Cisco wireless 1310 bridge. The client can receive the
    >> >> > > > signal
    >> >> > > > but can't logon the domain. Ipconfig shows the client ...
    >> >> > > >
    >> >> > > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    >> >> > > >
    >> >> > > >
    >> >> > > > Bob Lin, MS-MVP, MCSE & CNE
    >> >> > > > Networking, Internet, Routing, VPN Troubleshooting on
    >> >> > > > http://www.ChicagoTech.net
    >> >> > > > How to Setup Windows, Network, VPN & Remote Access on
    >> >> > > > http://www.HowToNetworking.com
    >> >> > > > "k3v1nr055" wrote in
    >> >> > > > message
    >> >> > > > news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    >> >> > > > We are suddenly not able to logon to our domain(s) via
    >> >> > > > wireless.
    >> >> > > > This was not
    >> >> > > > a problem until recently. This is a school where 1000
    >> >> > > > students
    >> >> > > > share use of
    >> >> > > > about 500 laptops and tablet PCs so it is most common for a
    >> >> > > > particular user
    >> >> > > > to grab a different laptops from different carts in a given
    >> >> > > > day
    >> >> > > > and use
    >> >> > > > several different laptops from the same cart throughout a
    >> >> > > > school
    >> >> > > > year. I
    >> >> > > > point this out so that you know that the common answer to our
    >> >> > > > problem, which
    >> >> > > > is to logon via the ethernet line and cache the profile before
    >> >> > > > trying to
    >> >> > > > connect via wireless is not acceptable nor practical.
    >> >> > > > Additionally, we had
    >> >> > > > no problem with this last school year. Now, three months later
    >> >> > > > we
    >> >> > > > are
    >> >> > > > basically "dead in the water" with regard to technology for
    >> >> > > > students and
    >> >> > > > wireless access for staff. The actual message that we get is:"
    >> >> > > > The system
    >> >> > > > cannot log you on because the domain OURDOMAIN is not
    >> >> > > > available."
    >> >> > > > The same
    >> >> > > > user account will quickly authenticate via ethernet.
    >> >> > > >
    >> >> > > > More info: This is occurring with both a new Cisco
    >> >> > > > server-managed
    >> >> > > > wireless
    >> >> > > > network in one building and the old store bought access points
    >> >> > > > in
    >> >> > > > our other
    >> >> > > > buildings. This is also occurring with newly re-imaged laptops
    >> >> > > > that were used
    >> >> > > > successfully last year, with newly re-imaged laptops that were
    >> >> > > > purchased this
    >> >> > > > summer and never used by anyone (except the tech who loaded
    >> >> > > > the
    >> >> > > > computer) and
    >> >> > > > new out of box laptops that have not been customized for our
    >> >> > > > environment. I
    >> >> > > > point this out because we were concerned that something in the
    >> >> > > > imaging
    >> >> > > > process (RIS and WDS) might have caused this issue but since
    >> >> > > > brand new Dell
    >> >> > > > and Gateway computers also exhibit the behavior it does not
    >> >> > > > appear that the
    >> >> > > > imaging process caused this issue and therfore my job is safe
    >> >> > > > since I am in
    >> >> > > > charge of images.
    >> >> > > >
    >> >> > > > I should also point out that the only major change to our
    >> >> > > > computers was the
    >> >> > > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me)
    >> >> > > > and
    >> >> > > > we also were
    >> >> > > > hammered with between 150 and 200 windows updates over the
    >> >> > > > summer. I suspect
    >> >> > > > that one or both of these events is at least partially related
    >> >> > > > to
    >> >> > > > our
    >> >> > > > problem.
    >> >> > > >
    >> >> > > > We really need help here. Any advice?
    >> >> > > >

    >>
    >>
    >>




  11. Re: Laptops and Tablets Cannot Logon to Domain

    Greg,
    No, that box is NOT selected (since there is no encryption established at
    this time). The bottom line is that the only way any user can attach to the
    wireless network is after they have a profile. So either they must log on via
    the wire (not practical in a school where each user may use a different
    laptop in each class and on each day) or I must log on as local admin,
    establish a connection with wireless manually, log off, log on as a domain
    admin and verify the wireless connectivity. Then I have to test again with a
    student account. Really, this is the only way we are getting by. Having said
    this, we want to find out the root cause since we will acquire new computers
    later and/or re-image existing computers and I don't want to go through this
    again.
    Thanks,

    "Greg Lindsay [MSFT]" wrote:

    > I am sorry for all the frustration, it does sound like an extremely bad
    > situation. I hope that I can help, either directly or by getting some other
    > experts involved.
    >
    > I'd just like to double-check that you aren't using 802.1X at all. If you
    > view the properties of your wireless network, and check the authentication
    > tab, is the Enable IEEE 802.1x..." check box selected? If so, what is in the
    > dropdown next to EAP type?
    >
    > I'm still thinking about why the firewall affects this. It might help to set
    > the firewall to start as automatic(delayed) or make it dependent on the zero
    > wireless configuration service, but that is not getting to the root cause of
    > the problem.
    >
    > --
    > Greg Lindsay [MSFT]
    >
    > Disclaimer: This posting is provided "AS IS" with no warranties, and confers
    > no rights.
    >
    > "k3v1nr055" wrote in message
    > news:4FC857F0-3CB5-4AFE-82A4-F22F9D4B557A@microsoft.com...
    > > Right now the wireless is wide open and has been for some time. Later
    > > this
    > > week we are having a managed Cisco system installed and we will push down
    > > keys and then turn on one or more security implementations. However, it
    > > still seems strange that computers that have an existing domain profile
    > > for
    > > the user that is logging on would eventually connect to the network via
    > > wireless but if the user was logging on for the first time and the GPO
    > > that
    > > disabled the firewall had not replicated to the box then that user could
    > > not
    > > "find a domain controller". What also puzzles me is why this began to
    > > occur
    > > since last June when school ended. We made no changes to our setup. The
    > > only
    > > things that changed were the result of MS updates that we push out via
    > > WSUS.
    > > We don't have time to hunt down every anomaly that occurs and these kinds
    > > of
    > > things seem to occur more and more often. It's very frustrating.
    > > "Greg Lindsay [MSFT]" wrote:
    > >
    > >> Hi,
    > >>
    > >> The fact that this happened on hundreds of laptops at about the same time
    > >> makes me suspect a PKI issue, possibly related to certificate expiration.
    > >> What wireless authentication method are you using?
    > >>
    > >> --
    > >> Greg Lindsay [MSFT]
    > >>
    > >> Disclaimer: This posting is provided "AS IS" with no warranties, and
    > >> confers
    > >> no rights.
    > >>
    > >> "k3v1nr055" wrote in message
    > >> news:2736CCAE-AC4B-40B9-951C-CA8336A8C50A@microsoft.com...
    > >> > am certain that the Windows Firewall is most responsible for this
    > >> > issue.
    > >> > In
    > >> > order to get our 400 laptops to be able to see a domain controller we
    > >> > had
    > >> > to
    > >> > turn off the standard profile firewall GPO (which exposes all laptops
    > >> > when
    > >> > they are outside of our perimeter....bad news). Then we had to start
    > >> > and
    > >> > log
    > >> > into each computer as the local admin and manually connect to the
    > >> > wireless
    > >> > signal. Next without we logged off the computer (we did not restart)
    > >> > and
    > >> > were
    > >> > able to log on with a domain account. This also pulled down the policy
    > >> > change
    > >> > which disabled the firewall. Then and only then were we able to connect
    > >> > to
    > >> > the wireless signal after a restart. This did not work until the
    > >> > firewall
    > >> > was turned off in Group Policy. Again I must state that this behavior
    > >> > was
    > >> > not exhibited last spring so something changed or was force to change
    > >> > for
    > >> > some unknown reason. I still believe that IE7 (urgh!!!) and it's so
    > >> > called
    > >> > "improvements" are the reason. If I could have my way I would
    > >> > uninstall
    > >> > this
    > >> > monster and put Firefox on every PC on our campus.
    > >> >
    > >> > "k3v1nr055" wrote:
    > >> >
    > >> >> I have not used a wireless sniffer but if I used something like
    > >> >> airsnort
    > >> >> would I be able to watch what occurs on one of the problematic
    > >> >> machines
    > >> >> from
    > >> >> a computer that is already up and running? If that's possible could
    > >> >> you
    > >> >> point
    > >> >> me to some info on doing that?
    > >> >>
    > >> >> "Pavel A." wrote:
    > >> >>
    > >> >> > If you could watch the logon process with a wireless sniffer,
    > >> >> > it would be clear right away, which packets go to air when, and
    > >> >> > whether
    > >> >> > the firewall blocks something.
    > >> >> >
    > >> >> > --PA
    > >> >> >
    > >> >> >
    > >> >> > "k3v1nr055" wrote:
    > >> >> > > Robert,
    > >> >> > >
    > >> >> > > It appears that the Windows Firewall is part of the problem. In
    > >> >> > > the
    > >> >> > > past
    > >> >> > > this did not seem to affect the initial logon. Now it appears
    > >> >> > > that
    > >> >> > > the
    > >> >> > > wireless signal is being processed after the cached credentials.
    > >> >> > > It
    > >> >> > > also
    > >> >> > > appears that the GPO that enables the Window Firewall is a factor.
    > >> >> > > We
    > >> >> > > had a
    > >> >> > > domain GPO that disables the firewall when a computer is logged
    > >> >> > > into
    > >> >> > > our
    > >> >> > > domain and when it powers up off the domain the firewall enables
    > >> >> > > (domain
    > >> >> > > profile and standard profile). We think that the firewall is
    > >> >> > > preventing the
    > >> >> > > initial connection with wireless and without a cached profile from
    > >> >> > > a
    > >> >> > > domain
    > >> >> > > user the laptop will not come to the place where Windows boots up.
    > >> >> > > Consequently, the users cannot ever get on. remember that these
    > >> >> > > are
    > >> >> > > newly
    > >> >> > > imaged computers that were created and joined to the domain by WDS
    > >> >> > > and they
    > >> >> > > have the old policy.
    > >> >> > > We found a very time consuming work around. First we disabled the
    > >> >> > > standard
    > >> >> > > profile which turns off the firewall for computers that are not on
    > >> >> > > the
    > >> >> > > domain. Of course, this now means that laptops which go home have
    > >> >> > > no
    > >> >> > > firewall
    > >> >> > > turned on when they are away. This is not an acceptable situation
    > >> >> > > either.
    > >> >> > > Then we have to log into each and every laptop as the local admin.
    > >> >> > > Then we
    > >> >> > > must manually connect to the wireless network. Next, we have to
    > >> >> > > log
    > >> >> > > out (not
    > >> >> > > restart because a restart and at this time we are able to log into
    > >> >> > > the domain
    > >> >> > > and the user is able to authenticate successfully. Additionally,
    > >> >> > > the
    > >> >> > > new
    > >> >> > > unprotected gpo is pulled to the machine and therefore firewall is
    > >> >> > > off no
    > >> >> > > matter what. After we do this any user is able to connect to the
    > >> >> > > domain and
    > >> >> > > authenticate. We tried every conceivable combination of login,
    > >> >> > > reboot, etc.
    > >> >> > > and nothing worked consistently until the firewall was disabled
    > >> >> > > for
    > >> >> > > all
    > >> >> > > scenarios. Now we have 450 laptops that we must sneaker net to,
    > >> >> > > set
    > >> >> > > up,
    > >> >> > > boot, log in as Admin, log off, log in as user. restart, and test
    > >> >> > > as
    > >> >> > > different new user. This really sucks!!! If you can tell me how
    > >> >> > > to
    > >> >> > > enable
    > >> >> > > the firewall and open it enough to allow the Zero Wireless
    > >> >> > > Configuration
    > >> >> > > service to start before authentication I would greatly appreciate
    > >> >> > > it.
    > >> >> > > I am
    > >> >> > > really tired of systems breaking because MS send patches and
    > >> >> > > "upgrades" that
    > >> >> > > wreak more havoc on our world. In this case, something had to
    > >> >> > > happen
    > >> >> > > because
    > >> >> > > this problem did not occur in June and the only difference is that
    > >> >> > > we
    > >> >> > > updated
    > >> >> > > all the laptops to IE7 and applied all the approved updates that
    > >> >> > > WSUS
    > >> >> > > received.
    > >> >> > >
    > >> >> > > "Robert L [MVP - Networking]" wrote:
    > >> >> > >
    > >> >> > > > If all wireless computers have this issue, I don't think it is
    > >> >> > > > IE 7
    > >> >> > > > issue. Do they receive IP addresses from DHCP? If you use WPA
    > >> >> > > > Enterprise, also check the IAS server. Or this link may help.
    > >> >> > > >
    > >> >> > > > Cisco: Wireless client can't ...Situation: The client tries to
    > >> >> > > > setup Cisco wireless 1310 bridge. The client can receive the
    > >> >> > > > signal
    > >> >> > > > but can't logon the domain. Ipconfig shows the client ...
    > >> >> > > >
    > >> >> > > > http://www.chicagotech.net/netforums...7d707b0e6327bf
    > >> >> > > >
    > >> >> > > >
    > >> >> > > > Bob Lin, MS-MVP, MCSE & CNE
    > >> >> > > > Networking, Internet, Routing, VPN Troubleshooting on
    > >> >> > > > http://www.ChicagoTech.net
    > >> >> > > > How to Setup Windows, Network, VPN & Remote Access on
    > >> >> > > > http://www.HowToNetworking.com
    > >> >> > > > "k3v1nr055" wrote in
    > >> >> > > > message
    > >> >> > > > news:29B68C0F-8DF6-41A4-A620-99D879EE94A4@microsoft.com...
    > >> >> > > > We are suddenly not able to logon to our domain(s) via
    > >> >> > > > wireless.
    > >> >> > > > This was not
    > >> >> > > > a problem until recently. This is a school where 1000
    > >> >> > > > students
    > >> >> > > > share use of
    > >> >> > > > about 500 laptops and tablet PCs so it is most common for a
    > >> >> > > > particular user
    > >> >> > > > to grab a different laptops from different carts in a given
    > >> >> > > > day
    > >> >> > > > and use
    > >> >> > > > several different laptops from the same cart throughout a
    > >> >> > > > school
    > >> >> > > > year. I
    > >> >> > > > point this out so that you know that the common answer to our
    > >> >> > > > problem, which
    > >> >> > > > is to logon via the ethernet line and cache the profile before
    > >> >> > > > trying to
    > >> >> > > > connect via wireless is not acceptable nor practical.
    > >> >> > > > Additionally, we had
    > >> >> > > > no problem with this last school year. Now, three months later
    > >> >> > > > we
    > >> >> > > > are
    > >> >> > > > basically "dead in the water" with regard to technology for
    > >> >> > > > students and
    > >> >> > > > wireless access for staff. The actual message that we get is:"
    > >> >> > > > The system
    > >> >> > > > cannot log you on because the domain OURDOMAIN is not
    > >> >> > > > available."
    > >> >> > > > The same
    > >> >> > > > user account will quickly authenticate via ethernet.
    > >> >> > > >
    > >> >> > > > More info: This is occurring with both a new Cisco
    > >> >> > > > server-managed
    > >> >> > > > wireless
    > >> >> > > > network in one building and the old store bought access points
    > >> >> > > > in
    > >> >> > > > our other
    > >> >> > > > buildings. This is also occurring with newly re-imaged laptops
    > >> >> > > > that were used
    > >> >> > > > successfully last year, with newly re-imaged laptops that were
    > >> >> > > > purchased this
    > >> >> > > > summer and never used by anyone (except the tech who loaded
    > >> >> > > > the
    > >> >> > > > computer) and
    > >> >> > > > new out of box laptops that have not been customized for our
    > >> >> > > > environment. I
    > >> >> > > > point this out because we were concerned that something in the
    > >> >> > > > imaging
    > >> >> > > > process (RIS and WDS) might have caused this issue but since
    > >> >> > > > brand new Dell
    > >> >> > > > and Gateway computers also exhibit the behavior it does not
    > >> >> > > > appear that the
    > >> >> > > > imaging process caused this issue and therfore my job is safe
    > >> >> > > > since I am in
    > >> >> > > > charge of images.
    > >> >> > > >
    > >> >> > > > I should also point out that the only major change to our
    > >> >> > > > computers was the
    > >> >> > > > "upgrade" to IE7 (ouch...actually a downgrade if you ask me)
    > >> >> > > > and
    > >> >> > > > we also were
    > >> >> > > > hammered with between 150 and 200 windows updates over the
    > >> >> > > > summer. I suspect
    > >> >> > > > that one or both of these events is at least partially related
    > >> >> > > > to
    > >> >> > > > our
    > >> >> > > > problem.
    > >> >> > > >
    > >> >> > > > We really need help here. Any advice?
    > >> >> > > >
    > >>
    > >>
    > >>

    >
    >
    >


  12. Re: Laptops and Tablets Cannot Logon to Domain

    "k3v1nr055" wrote in message
    news:A48D6828-F853-49DB-B9DC-392C0C622F93@microsoft.com...
    > Greg,
    > No, that box is NOT selected (since there is no encryption established at
    > this time). The bottom line is that the only way any user can attach to
    > the
    > wireless network is after they have a profile.


    I do not think there is a solution. The wireless nic drivers and the
    connection management are not active until you get "logged on to the
    desktop". Therefore you have no connection until you are already logged on,
    thereforethere is no way for someone without a previously cached profile to
    log on with out first doing it over a wired connection.

    I would love for the nic manufactures to come up with a way for their
    products to work without the user first logging in (like the wired nics do),
    however keep in mind that a wireless nic can connect to anything that is
    within range while a wired nic will only connect to what it is physically
    connected to,...and I believe that is the crux of the wireless
    problem,...there is no way to control what the wireless nic does until you
    have already logged in.

    IMO wireless in a school or business should never be the primary means of
    connection. The primary means should always be wired. Every desk should
    have a wired jack available. The Wireless will be perfectly fine when they
    move from their normal desk and "roam" about the building or travel,...but
    it should always be the secondary means of connection.

    --
    Phillip Windell
    www.wandtv.com

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    -----------------------------------------------------



  13. Re: Laptops and Tablets Cannot Logon to Domain

    As I stated earlier, this was not a problem when the last school year ended
    in June. It is a new problem that must be solved. Also, it is obvious that
    you do not work in or around schools. That seems to be part of the problem in
    all the posted solutions on Technet. In a typical business setting one does
    not find the same scenario and the problem does not impact the use as much.
    This would not be a big deal if each user used only one computer all day,
    every day. In a school it is not practical to connect via wire. We have 1300
    students who share about 650 computers. About 500 of these are laptops which
    are assigned to approximately 25 carts and the rest are desktops in labs. In
    order for this to be practical in an educational environment wireless is the
    only option. We cannot mount a 24 port switch and run 24 CAT 5 cables to each
    desk. In many schools each student gets his or her own dedicated laptop and
    there are even fewer desktops. You see, it is possible for a high school
    student to use a math laptop, a science laptop, a language arts laptop, and a
    foreign language laptop in consecutive classes since that is the way we have
    assigned and configured those laptop carts. In the 5th -8th grades carts are
    assigned to the grade so that each subject area shares the same cart. In this
    situation each period of the day could have a different combination of
    students so again it's a problem that is not easily overcome.
    Really though, I would just like to know what happened that has made the
    relationship of wireless NIC, to laptop, to Domain Controller change when the
    only differences on our network are that we moved to IE7 and allowed WSUS to
    push down several hundred updates over the past three months. (Of course WSUS
    was in place a long time before this issue arose.) I really don't believe
    that we can blame NIC manufacturers when the same equipment worked perfectly
    on the first logon last spring. That's my opinion.

    "Phillip Windell" wrote:

    > "k3v1nr055" wrote in message
    > news:A48D6828-F853-49DB-B9DC-392C0C622F93@microsoft.com...
    > > Greg,
    > > No, that box is NOT selected (since there is no encryption established at
    > > this time). The bottom line is that the only way any user can attach to
    > > the
    > > wireless network is after they have a profile.

    >
    > I do not think there is a solution. The wireless nic drivers and the
    > connection management are not active until you get "logged on to the
    > desktop". Therefore you have no connection until you are already logged on,
    > thereforethere is no way for someone without a previously cached profile to
    > log on with out first doing it over a wired connection.
    >
    > I would love for the nic manufactures to come up with a way for their
    > products to work without the user first logging in (like the wired nics do),
    > however keep in mind that a wireless nic can connect to anything that is
    > within range while a wired nic will only connect to what it is physically
    > connected to,...and I believe that is the crux of the wireless
    > problem,...there is no way to control what the wireless nic does until you
    > have already logged in.
    >
    > IMO wireless in a school or business should never be the primary means of
    > connection. The primary means should always be wired. Every desk should
    > have a wired jack available. The Wireless will be perfectly fine when they
    > move from their normal desk and "roam" about the building or travel,...but
    > it should always be the secondary means of connection.
    >
    > --
    > Phillip Windell
    > www.wandtv.com
    >
    > The views expressed, are my own and not those of my employer, or Microsoft,
    > or anyone else associated with me, including my cats.
    > -----------------------------------------------------
    >
    >
    >


  14. Re: Laptops and Tablets Cannot Logon to Domain


    "k3v1nr055" wrote in message
    news:9CFA765F-C788-47A1-9113-54A22B0C20E8@microsoft.com...

    > Also, it is obvious that you do not work in or around schools.


    No,...I work in a much much more complex, stressfull, and more technical
    environment,...while supporting the schools with my tax dollars whether I
    want to or not, while listening to them complain about not having enough
    money as they spend millions on building projects.

    > That seems to be part of the problem in
    > all the posted solutions on Technet.


    ....and it is free. You want something for nothing,..you got something for
    nothing. More than that it was on "my dime", on my time, at work, while
    taking care of the much much more complex, stressfull, and more technical
    environment at the same time.

    Call MS Support Services for help. Pay the $245 like the rest of us.
    Here's the number,...it is even toll free.
    1-800-936-4900

    --
    Phillip Windell
    www.wandtv.com



  15. Re: Laptops and Tablets Cannot Logon to Domain

    "k3v1nr055" wrote in message
    news:18230540-71C6-4538-84F6-45FC0009345B@microsoft.com...
    > Lighten up. I thought the reason that these news groups were created for
    > the


    Sorry, I shouldn't have got so excited. But the "...it is obvious that you
    do not work in or around schools..." didn't sit well with me.

    If you have Intel Wireless Nics in the laptops, I saw this morning when
    loading up one of our Dells they have a component for the Driver that they
    refered to as "Pre Logon Connection (PLC)". I tried to add it with my
    driver on one this morning and it said that the component wasn't found,..so
    I guess my variation of the driver didn't come with it. But maybe it is
    something that can be downloaded from Intel. I know it is not a direct and
    specific solution to your problem, but it may be worth looking into. Since
    it doesn't seem anyone else has given a specific solution I don't feel I
    have failed any worse than the rest,...and you still haven't had to pay me
    anything.

    --
    Phillip Windell
    www.wandtv.com

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    -----------------------------------------------------



  16. Re: Laptops and Tablets Cannot Logon to Domain

    That's OK. I did want to point out that schools such as ours work under a
    completely different paradigm than businesses do. That greatly adds to our
    work load and our STRESS. For instance, in the name of academic enrichment
    and freedom, we have to create different images for each grade, department,
    subject area, etc. We have more than 40 different images to maintain. This
    current problem means that all the base images will possibly need to be
    re-created because the originals have the old, firewall on, GPO. I will have
    to test to know for sure. Users also get away with more misuse than they
    would in a business. We work in a very "forgiving" environment, and that's
    good, but things that would get you fired in a bank, or similar corporation
    are not considered a big deal here (up to a certain point) and THAT means we
    have a lot of crap troubleshooting to deal with. I don't agree with this
    necessarily but I have to live with it. If it were up to me I would have
    planned for a whole lot of wired desktops in monitored labs instead of
    laptops on carts. However, the board of trustees felt differently and we have
    about 24 laptop carts and all the obvious issues that come with them. And so
    we cannot hook everyone up via ethernet and I am sneekernetting to each and
    every laptop in my building. It's killing my other projects.
    Later,

    "Phillip Windell" wrote:

    > "k3v1nr055" wrote in message
    > news:18230540-71C6-4538-84F6-45FC0009345B@microsoft.com...
    > > Lighten up. I thought the reason that these news groups were created for
    > > the

    >
    > Sorry, I shouldn't have got so excited. But the "...it is obvious that you
    > do not work in or around schools..." didn't sit well with me.
    >
    > If you have Intel Wireless Nics in the laptops, I saw this morning when
    > loading up one of our Dells they have a component for the Driver that they
    > refered to as "Pre Logon Connection (PLC)". I tried to add it with my
    > driver on one this morning and it said that the component wasn't found,..so
    > I guess my variation of the driver didn't come with it. But maybe it is
    > something that can be downloaded from Intel. I know it is not a direct and
    > specific solution to your problem, but it may be worth looking into. Since
    > it doesn't seem anyone else has given a specific solution I don't feel I
    > have failed any worse than the rest,...and you still haven't had to pay me
    > anything.
    >
    > --
    > Phillip Windell
    > www.wandtv.com
    >
    > The views expressed, are my own and not those of my employer, or Microsoft,
    > or anyone else associated with me, including my cats.
    > -----------------------------------------------------
    >
    >
    >


  17. Re: Laptops and Tablets Cannot Logon to Domain

    "k3v1nr055" wrote in message
    news:5AFCB0AA-3768-40BB-8353-122D6F405C08@microsoft.com...
    > Well, now our firewall settings are off for standard and for domain also.
    > That is the only combination that works. What I had to do was get those
    > settings to each laptop. Eventually, I might set up OUs for laptops that
    > leave campus (faculty) and those that do not (student) then I could apply
    > the
    > standard profile to add a little protection while those users are out of
    > our
    > perimeter. Still, that's extra work and I still don't know why this just
    > started happening when it did not occur last June.


    I'll try to find out more about the "Pre Logon Connection" thing that I saw
    for the Intel Nic drivers on the Laptop I was working with this moring. If
    it is something that can be downloaded and if other brands have something
    similar ten it may help with the "real" profile -vs- the cached profile
    situation. But at the moment I don't know much about it, this was the first
    time I have seen the name.

    --
    Phillip Windell
    www.wandtv.com

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    -----------------------------------------------------



  18. RE: Laptops and Tablets Cannot Logon to Domain

    Could there was a Group Policy setting to allow the firewall to ignore the
    preferred wireless network? I haven't found anything like that, but if
    something of the sort or perhaps a range of ports, that we could configure
    that allow that initial contact between laptop and domain controller to
    succeed, could be determined then we might be able to avoid this issue down
    the road. For now I have worked around the problem by forcing gpupdate to
    run after logging in to my pre-cached account on each laptop.

    "k3v1nr055" wrote:

    > We are suddenly not able to logon to our domain(s) via wireless. This was not
    > a problem until recently. This is a school where 1000 students share use of
    > about 500 laptops and tablet PCs so it is most common for a particular user
    > to grab a different laptops from different carts in a given day and use
    > several different laptops from the same cart throughout a school year. I
    > point this out so that you know that the common answer to our problem, which
    > is to logon via the ethernet line and cache the profile before trying to
    > connect via wireless is not acceptable nor practical. Additionally, we had
    > no problem with this last school year. Now, three months later we are
    > basically "dead in the water" with regard to technology for students and
    > wireless access for staff. The actual message that we get is:" The system
    > cannot log you on because the domain OURDOMAIN is not available." The same
    > user account will quickly authenticate via ethernet.
    >
    > More info: This is occurring with both a new Cisco server-managed wireless
    > network in one building and the old store bought access points in our other
    > buildings. This is also occurring with newly re-imaged laptops that were used
    > successfully last year, with newly re-imaged laptops that were purchased this
    > summer and never used by anyone (except the tech who loaded the computer) and
    > new out of box laptops that have not been customized for our environment. I
    > point this out because we were concerned that something in the imaging
    > process (RIS and WDS) might have caused this issue but since brand new Dell
    > and Gateway computers also exhibit the behavior it does not appear that the
    > imaging process caused this issue and therfore my job is safe since I am in
    > charge of images.
    >
    > I should also point out that the only major change to our computers was the
    > "upgrade" to IE7 (ouch...actually a downgrade if you ask me) and we also were
    > hammered with between 150 and 200 windows updates over the summer. I suspect
    > that one or both of these events is at least partially related to our
    > problem.
    >
    > We really need help here. Any advice?
    >


  19. Re: Laptops and Tablets Cannot Logon to Domain

    "k3v1nr055" wrote in message
    news:7276BFD4-1C38-4C44-9D8B-3E895CC715C4@microsoft.com...
    > the road. For now I have worked around the problem by forcing gpupdate to
    > run after logging in to my pre-cached account on each laptop.


    That's not a bad idea. You can do that with a batch file that has a shortcut
    to the batch file in the "Startup" node of the Start Menu in the "All Users"
    Profile. Then it will run for everyone after they have logged in.

    --
    Phillip Windell
    www.wandtv.com

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    -----------------------------------------------------



  20. Re: Laptops and Tablets Cannot Logon to Domain

    Here's an interesting link.

    http://forums.techguy.org/networking...pre-logon.html

    Maybe just letting the Windows Zero Configuration Tool is all that is
    needed.

    --
    Phillip Windell
    www.wandtv.com

    The views expressed, are my own and not those of my employer, or Microsoft,
    or anyone else associated with me, including my cats.
    -----------------------------------------------------



+ Reply to Thread