FAC Windows Authentication Fails for Domain-Joined PCs Using MSCHAPv2 (Wrong username or password)

[Jalal-ali99]

Hello everyone,

I'm experiencing an issue with MSCHAPv2 authentication on FortiAuthenticator (FAC) when using Windows AD domain authentication.

My FAC is joined to Active Directory, shows as fully connected to the domain controllers, and I have a RADIUS policy configured with “Windows AD domain authentication” enabled.

Problem Description

When domain-joined Windows PCs attempt 802.1X authentication, they automatically send the logged-in user’s credentials.
However, FAC rejects these attempts with the following log message: "Windows AD user authentication from (null) (mschap) with no token failed: AD auth error: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)"

interestingly, this issue does not occur on non-domain (workgroup) PCs.
When a user manually enters the same domain username and password, authentication succeeds without any problem.

I have also tested different username formats, including: realm\username and username@realm

But the authentication still fails when the credentials are automatically supplied by domain-joined PCs.

 

Thanks in advance for any help.

[Jalal-ali99]

this is the debug log from a workgroup PC that puts the username and password of user of "test.hr" which works fine :

2025-12-16T16:23:00.628915+03:30 TEK-HQ-FAC radiusd[28610]: (205) eap: Previous EAP request found for state 0xb7cb9e57b1c38735, released from the list
2025-12-16T16:23:00.628974+03:30 TEK-HQ-FAC radiusd[28610]: (205) Virtual server inner-tunnel received request
2025-12-16T16:23:00.628985+03:30 TEK-HQ-FAC radiusd[28610]: (205) EAP-Message = 0x020800421a0208003d31b3267416d88535fc552c182ef41461db0000000000000000415044789d5d4c712b17a25caaf577d89e50dbbfaebc6ef600746573742e6872
2025-12-16T16:23:00.628992+03:30 TEK-HQ-FAC radiusd[28610]: (205) FreeRADIUS-Proxied-To = 127.0.0.1
2025-12-16T16:23:00.628999+03:30 TEK-HQ-FAC radiusd[28610]: (205) User-Name = "test.hr"
2025-12-16T16:23:00.629005+03:30 TEK-HQ-FAC radiusd[28610]: (205) State = 0x4cb0e1de4cb8fb55e6d1e33ee284a020
2025-12-16T16:23:00.629012+03:30 TEK-HQ-FAC radiusd[28610]: (205) Service-Type = Framed-User
2025-12-16T16:23:00.629020+03:30 TEK-HQ-FAC radiusd[28610]: (205) Cisco-AVPair = "service-type=Framed"
2025-12-16T16:23:00.629027+03:30 TEK-HQ-FAC radiusd[28610]: (205) Cisco-AVPair = "audit-session-id=AC1B90070000004F2737D9C7"
2025-12-16T16:23:00.629034+03:30 TEK-HQ-FAC radiusd[28610]: (205) Cisco-AVPair = "method=dot1x"
2025-12-16T16:23:00.629040+03:30 TEK-HQ-FAC radiusd[28610]: (205) Cisco-AVPair = "client-iif-id=381282968"
2025-12-16T16:23:00.629047+03:30 TEK-HQ-FAC radiusd[28610]: (205) Framed-MTU = 1468
2025-12-16T16:23:00.629055+03:30 TEK-HQ-FAC radiusd[28610]: (205) NAS-IP-Address = ***
2025-12-16T16:23:00.629061+03:30 TEK-HQ-FAC radiusd[28610]: (205) NAS-Port-Id = "GigabitEthernet1/0/2"
2025-12-16T16:23:00.629068+03:30 TEK-HQ-FAC radiusd[28610]: (205) NAS-Port-Type = Ethernet
2025-12-16T16:23:00.629075+03:30 TEK-HQ-FAC radiusd[28610]: (205) NAS-Port = 50102
2025-12-16T16:23:00.629082+03:30 TEK-HQ-FAC radiusd[28610]: (205) Calling-Station-Id = "00-E0-4C-95-6C-B1"
2025-12-16T16:23:00.629088+03:30 TEK-HQ-FAC radiusd[28610]: (205) NAS-Identifier = "God"
2025-12-16T16:23:00.629096+03:30 TEK-HQ-FAC radiusd[28610]: (205) Called-Station-Id = "5C-A4-8A-0D-AF-02"
2025-12-16T16:23:00.629103+03:30 TEK-HQ-FAC radiusd[28610]: (205) Event-Timestamp = "Dec 16 2025 16:23:00 +0330"
2025-12-16T16:23:00.629111+03:30 TEK-HQ-FAC radiusd[28610]: (205) WARNING: Outer and inner identities are the same. User privacy is compromised.
2025-12-16T16:23:00.629117+03:30 TEK-HQ-FAC radiusd[28610]: (205) server inner-tunnel {
2025-12-16T16:23:00.629130+03:30 TEK-HQ-FAC radiusd[28610]: (205) # Executing section authorize from file /usr/etc/raddb/sites-enabled/inner-tunnel
2025-12-16T16:23:00.629145+03:30 TEK-HQ-FAC radiusd[28610]: (205) &Proxy-To-Realm := LOCAL
2025-12-16T16:23:00.629167+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: ===>NAS IP:***
2025-12-16T16:23:00.629175+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: ===>Username:test.hr
2025-12-16T16:23:00.629184+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: WARNING: client ***, id=205, cannot get request arrival time.
2025-12-16T16:23:00.629195+03:30 TEK-HQ-FAC radiusd[28610]: (205) # Executing group from file /usr/etc/raddb/sites-enabled/inner-tunnel
2025-12-16T16:23:00.629206+03:30 TEK-HQ-FAC radiusd[28610]: (205) eap: Removing EAP session with state 0x4cb0e1de4cb8fb55
2025-12-16T16:23:00.629214+03:30 TEK-HQ-FAC radiusd[28610]: (205) eap: Previous EAP request found for state 0x4cb0e1de4cb8fb55, released from the list
2025-12-16T16:23:00.629230+03:30 TEK-HQ-FAC radiusd[28610]: (205) eap_mschapv2: PEAP: Setting 'Auth-Type := FACAUTH'
2025-12-16T16:23:00.629239+03:30 TEK-HQ-FAC radiusd[28610]: (205) eap_mschapv2: # Executing group from file /usr/etc/raddb/sites-enabled/inner-tunnel
2025-12-16T16:23:00.629270+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Found authclient from preloaded authclients list for ***: TEST (***)
2025-12-16T16:23:00.632740+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Found authpolicy 'Test' for client '***'
2025-12-16T16:23:00.632769+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Client type: external (subtype: radius)
2025-12-16T16:23:00.632778+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Input raw_username: test.hr Realm: (null) username: test.hr
2025-12-16T16:23:00.632785+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Searching default realm as well
2025-12-16T16:23:00.632794+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Realm not specified, default goes to Windows AD, id: 2
2025-12-16T16:23:00.633848+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: LDAP user found: test.hr
2025-12-16T16:23:00.633867+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: User [enable fido: false, token count: 0, revoked_token_count: 0]
2025-12-16T16:23:00.633876+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Policy [fido_auth_opt: disabled, twofactor: password only, no_fido: two factor, revoked: reject]
2025-12-16T16:23:00.633886+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Decided on [is_fido: false, two_factor: password only, token_type: none]
2025-12-16T16:23:00.633900+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Added Stripped-User-Name with value test.hr
2025-12-16T16:23:00.634110+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: # Executing group from file /usr/etc/raddb/sites-enabled/inner-tunnel
2025-12-16T16:23:00.896829+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Remote Windows AD user authenticated
2025-12-16T16:23:00.960756+03:30 TEK-HQ-FAC radiusd[28610]: Waking up in 0.4 seconds.
2025-12-16T16:23:01.187402+03:30 TEK-HQ-FAC radiusd[28610]: (205) facauth: Authentication OK

[AEK]

What about the second one?