What's in the "Network Access Protection" event log? Have you enabled the DHCP-NAP-Enforcement-Client/Operational event log?
Cheers Ken From: [email protected] [mailto:[email protected]] On Behalf Of Melvin Backus Sent: Wednesday, 4 March 2015 5:36 AM To: [email protected] Subject: [NTSysADM] VPN client issue - restricted connection in RRAS console Hi folks, I've been chasing my tail for a couple of days trying to track down why a user's Surface Pro tablet isn't connecting to the VPN correctly. We've loaded the CMAK profile we use for client machines and it appears to load and install correctly. I'm able to connect with no problem, but I always get a restricted connection because the machine shows up as non-NAP capable. The CMAK profile installation is configured to enable the EAP quarantine agent, start the NAP agent, etc., and all that seems to happen, but for some reason when I check the status of things (netsh nap client show state) I'm seeing that while both the EAP agent (79623) and WSHA (79744) are enable, both show as not being initialized. I'm finding lots of stuff on how to check the status, but pretty much nothing on how to figure out why things aren't initializing. What I've found so far seems to indicate the WSHA should initialize as long as Security Center is running, which it is. The only recommended fix for it is to restart that service. I'm not seeing anything in the event logs that appears abnormal, so I'm scratching my head and it's getting a bit raw. :) Can anyone point me to something that might guide me down a more productive path? Thanks -------------------- Melvin Backus | Sr. Systems Engineer | Byers Engineering Company | 404.497.1565 Service Desk | 404-497-1599 | http://servicedesk.byers.com -- There are 10 kinds of people in the world... those who understand binary and those who don't.
