Wireless Access

 View Only
Back to discussions
Expand all | Collapse all

User account repeatedly locked due to continuous EAP authentication requests from unknown MAC (possible persistent client or MAC randomization issue)

This thread has been viewed 5 times

  • 1.  User account repeatedly locked due to continuous EAP authentication requests from unknown MAC (possible persistent client or MAC randomization issue)

    Posted Jun 26, 2026 06:00 PM
    We are experiencing an issue with a wireless user in SSID "AIRLOCK". The user can authenticate successfully from the corporate laptop, however, the account is being repeatedly locked in Active Directory due to continuous authentication failures coming from a different MAC address. The behavior is the following: - Successful authentication occurs from MAC: FC-B3-AA-AA-14-8C (Windows 10 device) - Continuous failed authentication attempts occur from MAC: 42-E0-36-74-EE-35 - These failed attempts happen approximately every minute - The account gets locked automatically due to AD lockout policy We have already: - Reset and validated user credentials - Removed and reconfigured WiFi profiles - Verified no MAC randomization is enabled on the known devices - Confirmed correct device connects successfully Despite this, the issue persists.


  • 2.  RE: User account repeatedly locked due to continuous EAP authentication requests from unknown MAC (possible persistent client or MAC randomization issue)

    Posted 6 days ago

    Both of those MACs are randomized. 42:E0:36 and the 52:76:8D one from your earlier thread are locally administered, second bit set in the first octet, so you're not looking for an unknown rogue device. You're looking at a device using a private address, almost certainly a phone or a personal machine that has the user's credentials saved.

    With PEAP-MSCHAPv2 that's the classic lockout pattern: the user changes their password, some other device keeps retrying the old one every minute, and AD locks the account. Resetting credentials and rebuilding the laptop profile never fixes it because the laptop was never the culprit.

    Search the endpoints repository for that MAC and see what ClearPass profiled it as, then check the AD lockout events for the caller MAC and the source NAS. That gets you the AP and radio it's on, and you can walk it down. Long term this is the argument for moving that SSID to EAP-TLS, since a certificate can't be stashed on somebody's phone the way a password can.



    ------------------------------
    Dustin Burns

    @Worldcom Exchange, Inc.


    If my post was useful accept solution and/or give kudos
    ------------------------------



Related Content