One government laptop is rejected as soon as it tries the WLAN. Every other laptop on that WLAN works. The controller shows the failing laptop on the client exclusion list. What explains the rejection?
Select an answer to reveal the explanation.
Short Explanation
Everyone else is on the WLAN, so the WLAN is up. This laptop is on the exclusion list, and the controller is refusing it on purpose until you clear it or the timer ends. Hiding the beacon does not build that list.
Full Explanation
Client exclusion is a controller timer that rejects a client after repeated authentication failures or similar strikes. The laptop is on that list, other clients on the same WLAN work, and the rejection is immediate. The explanation is the exclusion entry, not a WLAN-wide outage. A down WLAN would reject every laptop, not one. The others associating is the evidence the WLAN is up. A missing country code disables radios for the site. It does not pick a single MAC address to exclude while everyone else connects. A hidden beacon omits the SSID name from broadcasts. It does not add one laptop to an exclusion list, and other laptops would have the same hidden SSID. Exam caveat: clearing the entry without finding the bad password or certificate just starts the counter again. Fix the credential, then clear the exclusion. Operational check: confirm the MAC on the exclusion list, clear it after the credential is fixed, and watch that laptop associate while a deliberately wrong password does not get a second chance forever.