A device won't join. Where do I look first?

Check the client's authentication log. Every attempt is there with the reason, the access point or switch it came through, and the device. A refusal tells you what was wrong.

The three most common causes are a certificate that was never installed, a disabled account, and a device that doesn't trust our certificate yet.

If the log shows nothing for that device, nothing reached Passbeam, so the device never answered the network. On a wired Windows PC, check the Wired AutoConfig service first. On Wi-Fi, check the profile reached the device.

A "Refused" row with a bare MAC address on a wired site usually isn't a fault. The switch asked us about a MAC address that isn't registered, and we refused it. What happens next, usually the guest VLAN, is up to the switch. On a site set up as in “How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?”, that's working as intended.