What you’re seeing
- Laptops connect to Wi-Fi or a wired port but end up on the guest or quarantine network instead of the corporate one.
- Windows reports that it cannot connect to the network or that authentication failed.
- NPS or RADIUS logs show rejected requests, often with reason codes about certificates or policies.
- Only some devices are affected, such as newly imaged laptops or machines that were offline for a long time.
- Wired ports work for a while and then stop authenticating after a switch reboot or firmware update.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The RADIUS server's certificate expired or was renewed, and clients no longer trust it or are pinned to the old one.
- Machine or user certificates on client devices expired or were never issued by auto-enrollment.
- NPS network policies or conditions no longer match the group memberships, device types or authentication methods in use.
- Switch or access point RADIUS settings, shared secrets or timeouts no longer match the server configuration.
- Windows updates or credential protection features disabled older authentication methods the network still relies on.
- The computer account's secure channel with the domain is broken, so machine authentication fails.
Why it matters
802.1X is the gatekeeper that keeps unknown devices off your business network, so when it fails, legitimate staff are locked out of file servers, printers and line-of-business systems. People often fall back to guest Wi-Fi or personal hotspots, moving company data over networks that were never meant to carry it. The pressure to temporarily switch authentication off can open the network to anyone with a cable. Because certificate expiry is a common trigger, failures often hit many devices at once.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Why did this start for everyone on the same day?
Simultaneous failures usually point to an expired certificate or a policy change on the server side. We confirm the cause before changing anything.
Should we turn off 802.1X until it's sorted?
We'd advise against it. Disabling it lets any device onto the network; most issues can be fixed with protection kept in place.
Can it be fixed remotely if people can't get on the network?
Usually, yes. An engineer can work on the RADIUS server and network equipment remotely, and affected devices can often reconnect once the server side is corrected.