A device won't join. Where do I look first?

The authentication log for that client. Every attempt is recorded with the reason attached, the access point or switch it came through and the device it came from — so a refusal tells you what was wrong rather than leaving you comparing configurations.

The three most common answers are a certificate that was never installed, a device whose account is disabled, and equipment that has not finished trusting our certificate.

If the log shows nothing at all for that device, that is a different fault and a useful one: nothing reached us, so the device never answered the network's question. On a wired port and a Windows PC, check the Wired AutoConfig service first. On wireless, check that the profile reached the device at all.

A row saying "No certificate" on a wired site is usually not a fault. It means the switch asked us about a MAC address rather than presenting a certificate, we refused, and what happens next — normally the guest VLAN — is the switch's own decision. On a site set up the way the VLAN walkthrough describes, that refusal is the system working.