802.1X authentication fails after restricting AD user logon to specific computers

williamszen666 — Mon, 20 Jul 2026 16:19:01 GMT

Hi everyone,

I would like to ask if anyone has experienced a similar issue while working with ExtremeControl.

Our customer has the following environment:

2 × ExtremeControl Engines
1 × ExtremeCloud IQ Site Engine
2 × Wireless LAN Controllers (WLCs)
Active Directory used as the authentication source
802.1X authentication (PEAP/MSCHAPv2)
Dynamic VLAN assignment after successful authentication

The authentication workflow is the following:

Client
│
│ Connects to SSID (802.1X)
▼
Wireless AP
│
▼
WLC
│
▼
ExtremeControl (ACE)
│
│ RADIUS Authentication
▼
Active Directory
│
│ User authenticated
▼
ExtremeControl returns VLAN
│
▼
Endpoint receives VLAN and network access

The issue

At the customer's request, they modified the user's Active Directory account.

In:

Active Directory Users and Computers
→ User Properties
→ Account
→ Log On To...

Instead of allowing the user to log on to all computers, they restricted the account to only one specific computer.

After applying this change, the user is no longer able to authenticate through the 802.1X wireless SSID.

My questions

Has anyone encountered this behavior before?
Does ExtremeControl (or Windows NPS/LDAP authentication) validate the Log On To restriction during 802.1X authentication?
Is this expected behavior from Active Directory?
Is there any recommended approach if the customer wants to restrict interactive Windows logons without affecting wireless 802.1X authentication?

Any insights or best practices would be greatly appreciated.

Re: 802.1X authentication fails after restricting AD user logon to specific computers

jerica63figaro — Tue, 21 Jul 2026 08:57:48 GMT

I appreciate the detailed troubleshooting steps. Problems involving AD policies and 802.1X can be difficult to diagnose, so it's great to have a clear explanation of what was happening. Paylocity

topic Re: 802.1X authentication fails after restricting AD user logon to specific computers in ExtremeControl

802.1X authentication fails after restricting AD user logon to specific computers

The issue

My questions

Re: 802.1X authentication fails after restricting AD user logon to specific computers