Mac Sierra 802.1x wireless before login

Did you enable "Use Directory Authentication"? That way the machine connects at the machine level and at the login window.

@sys_tech In addition to what @boberito mentions for "Use Directory Authentication", you will need your Macs to be bound to AD for them to authenticate at the machine level.

Our macbooks are bound to the AD. While using WPA-Personal, the Macbooks would have network at login. When we test 802.1x, there is no network at login.

Where is "Use Directory Authentication"? I see "Use as a Login Window configuration" in the Network Payload.

Many thanks for the help... my keyboard has an imprint of my head where I have beat it against it so much :-)

It depends on your infrastructure, but we have this working in Sierra with the following settings using Cisco wireless:

In the Network WiFi Payload we use these settings:

-AutoJoin – Yes
-Hidden Network – Yes
-Security Type – WPA2 Enterprise
-Use as a Login Window Configuration – Yes
-Use Directory Authentication - Yes

Then we create an AD "User" that this profile connects to (with a PW that never changes). We isolate these down to rooms, but you could set these accounts up in a way that works for you. Macs don't support genuine AD 802.1x "computer" accounts in the same way that Windows does, creating this hurdle when you're first setting it up.

There could be a way to set this up with certificate-based authentication that doesn't use the method above, but I haven't tested that approach yet. Mine likely isn't very scalable.

Found it! The issue was in the Network Payload. We are using 802.1x TTL and did not have the "Identity Certificate" dropdown set to a value. Changed that to our AD certificate and "Robert is your moms brother"!

Thank you all for your input.