Authenticate as guest when user or computer information is unavail

hi,

we want to set up 802.1X using RADIUS (microsoft ias) EAP - PEAP - TLS
(smart card or other certificate) and cisco sw.
to enroll client authentication certificate we need to put user's computer
into dedicated VLAN.
I have created remote access rule for guest authentication.
policy conditions:
nas-port-type "ethernet" AND windows-group "DOMAIN\ias guest group" AND
authentication-type "EAP"


authentication:
eap method: protected eap (paep)/smart card or other certificate
allow clients to connect without negotiating an authentication method is
checked too.

i changed
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\RemoteAccess\Policy\"Default
User Identity" for guest account, this user is the only member of "DOMAIN\ias
guest group". user's computers are Windows XP SP2.

when user try to connect without client authentication certificate but "auth
as guest ..." checked, he allays get following warning and authentication
failed.


Event Type: Warning
Event Source: IAS
Event Category: None
Event ID: 2
Date: 2.4.2007
Time: 13:05:50
User: N/A
Computer: BBS-DC01
Description:
User was denied access.
Fully-Qualified-User-Name = intranet.corp.domain.sk/HQ/Resources/IAS/IAS
Guest Account
NAS-IP-Address = 10.x.x.x
NAS-Identifier = <not present>
Called-Station-Identifier = xx-xx-xx-xx-xx-xx
Calling-Station-Identifier = xx-xx-xx-xx-xx-xx
Client-Friendly-Name = SWITCH133
Client-IP-Address = 10.x.x.x
NAS-Port-Type = Ethernet
NAS-Port = 50440
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = Auth as Guest
Authentication-Type = PEAP
EAP-Type = <undetermined>
Reason-Code = 16
Reason = Authentication was not successful because an unknown user name or
incorrect password was used.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 4f 05 07 80 O..€

i am not able to find any solution, could someone help, pls. ?

thx for all responses )

RB