If I have understood correctly, you want the windows devices AD logon scripts to be executed.
For this to work, windows devices must establish the WiFi connection before the user logs on. You cannot control this behavior in WiFi Controller and not in ClearPass. It depends on the windows devices and the authentication mode used.
You write that WPA2-Enterprise is used. Furthermore, the WiFi connection is disconnected when the windows users log off. From this I conclude that the windows devices use user-authentication-mode. This means that the WiFi connection is only established after the user logs on to the windows device. This is the reason why the logon scripts are not running.
Change the authentication mode to computer authentication. Then the windows device will use a computer certificate for authentication and establish the WiFi connection before the user logs on.
------------------------------
Regards,
Waldemar
ACCX # 1377, ACEP, ACX - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------
Original Message:
Sent: May 13, 2024 02:46 AM
From: hilmi.azim
Subject: Aruba Wireless Controller - AD Logon Script
Hi Chulcher seems like it has something to do with ClearPass as we are using it for authentication. where to check next?
as below
Original Message:
Sent: May 13, 2024 12:53 AM
From: chulcher
Subject: Aruba Wireless Controller - AD Logon Script
First, check what user role is being assigned to the session when a user isn't logged in, and then after the user has logged in. That is available on the UI dashboard or through CLI show clients.
Once you know what the user roles in play are, check the configuration of those user roles either under the Security configuration in the UI or through CLI.
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: May 12, 2024 09:27 PM
From: hilmi.azim
Subject: Aruba Wireless Controller - AD Logon Script
Are you assigning a user-role post network login that allows access to the AD DCs?
-Not sure about this, can provide path to check?
What EAP method? Are you using computer and/or user authentication?
-We using EAP-TLS and EAP (PEAP) both are accepted
- We using computer and user authentication.
Original Message:
Sent: May 10, 2024 01:47 PM
From: chulcher
Subject: Aruba Wireless Controller - AD Logon Script
Are you assigning a user-role post network login that allows access to the AD DCs?
What EAP method? Are you using computer and/or user authentication?
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: May 10, 2024 03:04 AM
From: hilmi.azim
Subject: Aruba Wireless Controller - AD Logon Script
Hi all,
need help with settings / workaround as when we implement this ARUBA AP (previously using Cisco), we notice that our AD user profile logon script no longer/unable to run. This really inconvenient as we can't use script to push when user login to windows.
below is the current setting
have notice few things when troubleshooting:
-I tried to create new SSID with less secure the logon script able to push.
-when user log out = WIFI connection unlink need user credential to connect to WIFI again.