Support Tip: The ConfigMgr 2012 Out Of Band management console fails to connect to a machine on an 802.1X network


When using System Center 2012 Configuration Manager, you may find that the Out Of Band (OOB) Management console fails to connect to a client on an 802.1X network if that machine is not switched on or is not booted into a full, running operating system.

When a machine is provisioned in System Center 2012 Configuration Manager, it is issued an 802.1X client authentication certificate based on the settings configured in the 802.1X Wired Network Access Control dialog box. The value in Subject Alternative Name (SAN) of this certificate is used to authenticate to RADIUS server.


As per TechNet documentation here, the SAN should have the Unique Principal Name (UPN) of the provisioned AMT-based computer. The value in SAN is used for 802.1X client authentication.

If your Enterprise Certificate Authority is Windows Server 2003 based, client certificates that are issued using the 802.1X client authentication template may have incorrect alternative subject names. In these cases, the alternative subject name will have the Domain Name System (DNS) name instead of the UPN, thus causing authentication to fail.

For example, here is a correct value:


Here is an incorrect value:


To resolve this issue, install the hotfix documented in KB article 943089 ( and then re-provision the machine.

Karan Rustagi | Support Escalation Engineer | Management and Security Division

Get the latest System Center news on Facebook and Twitter:

clip_image001 clip_image002

App-V Team blog:
ConfigMgr Support Team blog:
DPM Team blog:
MED-V Team blog:
Orchestrator Support Team blog:
Operations Manager Team blog:
SCVMM Team blog:
Server App-V Team blog:
Service Manager Team blog:
System Center Essentials Team blog:
WSUS Support Team blog:

The Forefront Server Protection blog:
The Forefront Endpoint Security blog :
The Forefront Identity Manager blog :
The Forefront TMG blog:
The Forefront UAG blog:

Skip to main content