I have allow_retry = yes in /etc/raddb/modules/mschap and send_error = yes in the mschapv2 section of /etc/raddb/eap.conf I am not seeing any change in behavior from the mac, it doesn't even prompt for a new username/password so I must be missing something else Jonathan

...

...

alan buxey 07/30/12 5:14 PM >>> Hi,

Allow EAP-MSCHAPv2 to send error message to client. This change allows some clients to prompt the user for a new password. See raddb/eap.conf, mschapv2 section, "send_error".

you need to enable the function in the mschap module AND in the eap.conf I'm not sure whether there was another little bugette in that code that slipped by which recently got fixed in the 3.0 pre-release? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html