IAS event id 2, Reason-Code = 262

[Andrius Mazeika]

Server: Windows Server 2003 x64 SP1 or R2
Client: Windows XP Pro SP2
From time to time some of my XP SP2 clients fail to authenticate with IAS
and thus end up working without WLAN. This is what I get in System log:

Event Type: Warning
Event Source: IAS
Event Category: None
Event ID: 2
Date: 2007.02.09
Time: 13:49:46
User: N/A
Computer: server
Description:
User host/pc1.firm.com was denied access.
Fully-Qualified-User-Name = firm.com/computers/pc1
NAS-IP-Address = 10.19.247.234
NAS-Identifier = FIRM
Called-Station-Identifier = 00-18-FE-D0-B0-39
Calling-Station-Identifier = 00-90-4B-B9-D3-A8
Client-Friendly-Name = FIRM
Client-IP-Address = 10.19.247.234
NAS-Port-Type = Wireless - IEEE 802.11
NAS-Port = 0
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = WLAN
Authentication-Type = PEAP
EAP-Type = <undetermined>
Reason-Code = 262
Reason = The supplied message is incomplete. The signature was not
verified.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 03 09 80 ...€

[Sean Cai [MSFT]]

Hello,

Thank you for posting in the Microsoft newsgroup!

From your post, my understanding on this issue is: you have clients that
failed to authenticate with IAS. If I'm off base, please feel free to let
me know.

The error code and the symptom of the issue match the description in the
following KB, please try to fix it with the steps mentioned in it:
802.1x client authentication fails when you connect to a Windows Server
2003-based computer that is running IAS
http://support.microsoft.com/kb/838502

Please let me know if you have any other concerns, or need anything else.

Have a great day!

Sean Cai, MCSE2000
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[Andrius Mazeika]

Sean, thank you for the information. I will try it as soon as I can and will let you know.

[Sean Cai [MSFT]]

Hi Andrius,

It's fine. If you have any problem after you tried steps in the KB, please let me know. Have a great day!

[Sean Cai [MSFT]]

Hi Andrius,How are things going? I have not heard back from you in a few days andwanted to check on the status of the problem. Please let me know how the troubleshooting steps turned out.

[Sean Cai [MSFT]]

R: The cu got IAS error event 2
A: N/A
C: Known issue
R: Provided KB to the cu.

not resolved

[Matt-Smith]

Sean,
Why does the PEAP process even begin if the client does not have the root CA cert for the IAS servers cert installed? Wouldnt this prevent the client from even attempting to authenticate? I am seeing the same error on an MS2003 server running IAS and as a standalone CA. I have XP clients configured for PEAP MS-CHAP-V2 and installed the cert from the CA as described in the KB but I stil get this authentication error. I suspect that the cert is not installed properly for some reason because I have another XP client that I was testing EAP-TLS with that works. I think this client works becuase the client CA I installed automatically installed the Root CA. Thanks Matt Smith

[FC123]

Hi, last week i am import new server cert (old one had expire) and also new root cert (Which will expire on next week), after i manually import new root cert and run the authentication, my IAS server's event viewer show :

Authentication-Server = <undetermined>
Authentication-Type = PEAP
EAP-Type = <undetermined>
Reason-Code = 262
Reason = The supplied message is incomplete. The signature was not verified

***************************************
i follow the microsoft solution : http://support.microsoft.com/kb/838502#top ,
uncheck the "certificate validation" on the client computer.

Now i got few question ,

(1) i am using the same root cer , manually import into IAS server and client server (using MMC - Snap in method) , but why i will get this reason-code?

(2) if i uncheck "certificate validation" on the client computer., do the security level will decrease?

hope someone can guide me, Thank you very much

p/s: my IAS server is using Windows Server 2003 R2 Standard