The pre-shared key on a WLAN was rotated. Phones that still have the old key saved fail. A phone that is given the new key joins. What do the failing phones still have?
Select an answer to reveal the explanation.
Short Explanation
Your controller has moved on, while the failing phones still have the old key saved. Forget the saved WLAN on those phones or replace the saved key with the new one; the rotation did not reject the new key.
Full Explanation
A rotated pre-shared key matches clients that present the new value. The failing phones still have the old key saved, so they fail; a phone given the new key joins. The old key saved on those phones is the cause—not the new key being rejected in favor of the old one. A hidden SSID does not restore the old key after a rotation, and a short beacon does not delay which key is valid for an interval. Exam caveat: if you have multiple access points and only one controller was updated, a phone roaming to an access point still using the old controller may look like a bad phone; confirm every controller serving the WLAN has the new key. As a practical check, update one failing phone, confirm it joins on the next attempt, and compare the result with what you expected before changing anything else. Leave the rest of the floor alone until that check succeeds; then push the new key to the remaining phones.