Event 8002 in Applications and Services Logs > Microsoft > Windows > WLAN-AutoConfig > Operational reports a failed connection with Failure Reason: Explicit Eap failure received. The client associated with the access point, started 802.1X, and the RADIUS server sent an EAP-Failure — an explicit "no". This tells you the conversation reached the server and the server rejected it; it does not tell you why. The reason is in the RADIUS server's own log (NPS event 6273 with a reason code) at the same timestamp. Failures before this point — no certificate found, association timeouts, no response from the server — are client-side or network-side and do not produce this text.
Explicit EAP failure received
WLAN-AutoConfig 8002: Explicit EAP failure received
What it means
Common causes
NPS did not trust the client certificate's issuing CA (reason 265), or could not check its revocation status — see the related entries.
No network policy matched (reason 48), or the matched policy does not allow the EAP method the client used (reason 66 / 22).
The account is denied network access on its Dial-in tab (reason 65), or the user or computer does not exist in the directory NPS checks (reason 8).
The client sent a certificate the server could process but that maps to nothing — wrong SAN, expired, or issued for a different purpose.
How to fix it
Find the server-side verdict: on the NPS server open Security log > event 6273 (Network Policy Server denied access) at the same time, filter on the client MAC or Calling-Station-ID, and follow the reason code to its entry here.
No 6273 at that timestamp? Then the reject came from somewhere else — a second RADIUS server in the NAS's server list, a RADIUS proxy, or a controller that answered locally. Check every server the NAS is configured to use.
On the client,
netsh wlan show wlanreportbuilds an HTML report that correlates the 8002 event with the EAP steps; the CAPI2 operational log shows whether the client itself rejected the server certificate before giving up.For fleet-wide onsets after a change, check what changed on the server: renewed NPS certificate, new client CA, edited network policy or a new CRL location.
Frequently asked
Is 'Explicit EAP failure received' a client problem or a server problem?
A server decision. The client only reports that the RADIUS server sent EAP-Failure. Diagnose on the server (NPS 6273 reason code, or the equivalent reject log of your RADIUS product); the client log cannot tell you more than that the answer was no.