SSO with pre-logon fails during user logon after a restart

Applies to: Windows 8Windows 8.1Windows Server 2012 Standard


Wireless and Wired 802.1x Authentication fails on the first logon attempt after a system restart if the client system is configured to use a Single Sign On (SSO) profile with pre-logon. In this situation, the user receives the following error message:

There are currently no logon servers available to service the logon request.
The message window resembles the following screen shot.

logon error message


This problem is caused by a race-condition that occurs during the boot sequence between the Pre-Logon Authentication Provider (PLAP) logon filter and either the Wired Autoconfig service (for wired connections) or the WLAN Autoconfig service (for wireless connections). The logon filter queries for SSO profiles. However, if the respective Autoconfig service is not fully initialized by the time of the query, the client will not be SSO-configured. Therefore, users cannot log on by using SSO.


To work around this problem, connect users through a non-802.1x-protected network to cache their credentials during the first logon.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

This problem does not usually occur. However, if you do encounter this problem, we recommend that you open a support case and collect the relevant log information. To do this, follow these steps:
  1. Open an elevated command prompt.
  2. Run the following command:

    netsh trace start persistent=yes overwrite=yes maxsize=4096 tracefile=c:\net_plap.etl provider={2CF38663-F760-46AC-AAFA-2DDE7F9DB417} keywords=0xffffffffffffffff level=0xff provider="Microsoft-Windows-L2NACP" keywords=0xffffffffffffffff level=0xff 
  3. Restart the computer.
  4. Reproduce the logon issue.
  5. Connect to an unprotected network to successfully log on and stop the trace. To do this, run the following command:

    netsh trace stop 
    This generates the following trace file: