Network authentication failure means the client and the network could not agree on your identity or the security handshake. Fix it by verifying credentials, removing the stored Wi-Fi profile, matching the security type (WPA2/WPA3), and confirming the authentication server (RADIUS, AD, or the router itself) is reachable and accepting your account.
Symptoms
- "Can't connect to this network" or "Authentication failed" appears after entering the correct password.
- Wi-Fi status cycles between "Authenticating" and "Disconnected" without ever obtaining an IP address.
- VPN client returns error codes like 691, 812, or "Access denied" during login.
- Corporate laptop connects on Ethernet but 802.1X Wi-Fi silently rejects the same domain credentials.
- Other devices join the same SSID without issue, but one specific device is refused.
Common Causes
Wrong or outdated password
The most common trigger. Someone rotated the Wi-Fi key, the domain password expired, or auto-fill saved an old string that no longer matches the access point.
Security protocol mismatch
The client is set to WPA2-Personal while the SSID now runs WPA3 or WPA2-Enterprise. Older adapters and some IoT devices cannot negotiate the newer handshake and drop out silently.
Corrupt stored network profile
Windows and macOS cache SSID settings including EAP method, certificate, and PSK. If any field drifts out of sync with the AP, the OS keeps retrying the broken profile instead of prompting again.
Authentication server unreachable
On corporate networks a RADIUS or NPS server validates 802.1X logins. If the server is down, the certificate expired, or the AP lost its shared secret, every client gets rejected regardless of password.
MAC filtering or account lockout
Access points with MAC allow-lists block new devices even with the right key. Domain accounts also lock after repeated failed retries triggered by a stale saved password.
Step-by-Step Fix
- Confirm the credentials against a second device
Try the same username and password on a phone or tablet you know works. If that device also fails, the problem is the account or the network, not your machine. If it succeeds, focus troubleshooting on the failing client. - Reset the password through the correct channel
For a home router, sign in at 192.168.1.1 or the address printed on the label and set a new WPA2/WPA3 key under Wireless Security. For a work account, use the self-service portal or open a ticket with the IT helpdesk. Never guess admin credentials repeatedly, since many APs lock out after five attempts. - Delete the saved network profile and rejoin
On Windows, open Settings, Network & Internet, Wi-Fi, Manage known networks, then Forget the SSID. On macOS, go to System Settings, Wi-Fi, Advanced, and remove the entry. Reconnect from scratch so the OS negotiates a fresh handshake with current parameters. - Match the security type on client and access point
Log in to the router or ask the network admin which mode is active: WPA2-Personal, WPA3-Personal, or WPA2/3-Enterprise. On the client, edit the profile so the security type, encryption (AES/CCMP), and EAP method line up exactly. A WPA3-only SSID will reject any client stuck on WPA2. - Power-cycle the router and renew the IP lease
Unplug the router and modem for 30 seconds, then power them back on and wait two minutes for services to fully load. On the client, run ipconfig /release and ipconfig /renew (Windows) or toggle Wi-Fi off and on (macOS) to force a clean DHCP request. - Update the wireless driver and OS
Outdated Intel, Realtek, or Broadcom drivers frequently fail WPA3 and 802.1X handshakes. Open Device Manager, expand Network adapters, right-click your Wi-Fi card and choose Update driver, or download the current package from the laptop vendor. Reboot after installing. - Check the authentication server and certificate
On enterprise networks, confirm the RADIUS or NPS service is running, the server certificate is valid, and the AP still holds the correct shared secret. Review the server's event log for "Access-Reject" entries; the reason code (bad password, expired cert, unknown MAC) tells you exactly what to fix. - Rule out MAC filtering and account lockout
In the router's admin panel, check whether MAC filtering is enabled and add your adapter's address if so. For domain accounts, ask IT to confirm the account is not locked, then remove any stale credentials from Windows Credential Manager or macOS Keychain before signing in again.
Common authentication errors and the fix that resolves them
| Error message | Likely cause | First action |
|---|---|---|
| "Incorrect password for network" | Cached PSK no longer matches the AP | Forget the SSID and rejoin with the current key |
| "Can't connect to this network" (Windows) | Security type or EAP method mismatch | Edit profile to match AP's WPA2/WPA3 and encryption |
| VPN error 691 | Wrong username, password, or expired domain account | Verify credentials and check account status in AD |
| "Authentication failed" on 802.1X | RADIUS server down or certificate expired | Check NPS/RADIUS service and server certificate validity |
| Connects then drops after 30 seconds | MAC filter block or DHCP failure | Add MAC to allow-list; confirm DHCP scope has free leases |
| "Account locked out" | Repeated retries with old saved password | Unlock account, clear Credential Manager, sign in once |
Prevention
- Store the current Wi-Fi key and admin password in a team password manager so rotations do not strand devices.
- Standardise on WPA2/WPA3-Enterprise with 802.1X for offices; avoid mixing PSK modes on the same SSID.
- Set calendar reminders for RADIUS server certificate renewal at least 30 days before expiry.
- After changing a domain password, immediately update it on phones, laptops, and printers to avoid lockouts.
FAQ
Why does my Wi-Fi say authentication failed even with the right password?
The password field is only half of the handshake. If the security type, encryption, or EAP method stored in your device profile no longer matches the access point, the AP will reject you before checking the key. Forgetting the SSID and rejoining forces the client to renegotiate every parameter and usually clears the error.
Can a router firmware update cause authentication failure?
Yes. Firmware updates sometimes enable WPA3 by default, tighten PMF (Protected Management Frames) settings, or reset the admin password. Older laptops and IoT gadgets that only support WPA2 will suddenly fail to authenticate. Log in to the router, confirm the security mode, and either revert to a WPA2/WPA3 mixed setting or update the client drivers.
When should I escalate to IT instead of troubleshooting myself?
Escalate when multiple users on the same SSID fail at the same time, when you see "Access-Reject" or certificate errors, or when the network uses 802.1X with a RADIUS server. These point to server-side or infrastructure faults that cannot be fixed from the client. Also escalate immediately if an account keeps locking after each retry.
Need hands-on help fixing persistent network authentication failures? Contact our IT support team to open a ticket.