Solved

RODC with EAP and Radius

Posted on 2011-09-22
3
2,054 Views
Last Modified: 2012-05-12
I have a domain, let’s call it Domain.local.  On this domain I have a domain controller called DC-Prime, and a read-only domain controller called RODC-Zeta.

I have 2 cisco wireless APs, using RADIUS to authenticate users to the domain.  When they are pointed to Prime, they authenticate, and everything is sunshine and unicorns.  When I point them to Zeta, the server reports the following from Event Viewer:

Negotiation failed. Requested EAP methods not available

I have exported the EAP settings from Prime and imported them to Zeta, but I still get the same results.  I think it has to do with Zeta being a Read Only DC, but google and various searches have come up empty.
0
Comment
Question by:UnityPG
  • 2
3 Comments
 
LVL 13

Expert Comment

by:khairil
ID: 36582310
Hi,

RODC have special handling with user account and password, you can get more idea here, http://blogs.technet.com/b/askds/archive/2008/01/18/understanding-read-only-domain-controller-authentication.aspx

You might want to change the Password Replication Policy of RODC and give another try to authenticate user. More on password replication policy, http://technet.microsoft.com/en-us/library/cc730883(WS.10).aspx

BTW, what radius are you using? If you are using NPS for radius authentication then it will be no problem.
0
 

Accepted Solution

by:
UnityPG earned 0 total points
ID: 36586790
The issue was that the RODC server had no certificate for authentication.   Installing a CA on Prime and exporting the cert to Zeta fixed it.

Thanks,
0
 

Author Closing Comment

by:UnityPG
ID: 36715231
Fixed it, sorry guys.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

To effectively work with Diskpart on a Server Core, it is necessary to write some small batch script's, because you can't execute diskpart in a remote powershell session. To get startet, place the Diskpart batch script's into a share on your loca…
If you migrate a Terminal Server licenses server inside the 2008 server family, you can takte advantage of the build-in migration tool. If you like to migrate an older 2003 Server (and the installed client CALs) to a 2008 R2 server for example, you …
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question