We have had a similar experience with Windows 10 laptops and services. The solution that we found was to not allow wifi-sense to automatically log users in.
Here are the steps and the FAQ I pulled them from.
Yes, you can still connect to a Wi‑Fi network on your own.
If you don't want to use Wi‑Fi Sense, you can go to Settings > Network & Internet > Wi‑Fi > Manage Wi‑Fi settings, and then turn off Connect to suggested open hotspots and Connect to networks shared by my contacts.
There is also an option to configure the ssid name with _optout but we would prefer to not have to either add and ssid or offer one with a confusing term that could worry our users.
We have a ticket in to look at this issue with adtran.
Thanks for your response ms.m!
Unfortunately turning off these wi-fi sense options does not resolve our issue. We still are only able to login to the captive portal after turning off the "time broker service".
After working with Adtran support we have determined that the issue is related to the fact that Surface Pro 3's will not renew their DHCP lease halfway through the 10 second lease time when in the unregistered role. This causes them to flop between a NAC assigned IP address (10.252.x.x) and a self assigned IP address (169.254.x.x). My research hasn't turned up much on why this would occur especially only on this particular hardware/software configuration. Any ideas out there?
I can confirm that we also expirienced problems with Windows 10 tablets.
The only solution for us now - move to scheme where captive portal working on other equipment - and no use of Bluesocket APs.
Waiting for Adtran to change IP transition process to direct scheme with permanent IP across 802.11 session
As Charles Thompson helpfully posted, ADTRAN Support has identified an issue in the Microsoft Surface Pro that causes it to release its IP address before the lease is up. BlueSocket devices use a NAC IP transition system within the Captive Portal to allow customers the unique freedom to effectively quarantine their devices when they have not logged in within a network that only exists inside the BlueSocket APs (The Un-registered Role and NAC Location).
Unfortunately the transition of IP is difficult for many new devices because of a lack of strict standards on DHCP functionality. In the Surface Pro case, it releases the IP address at exactly half the lease time instead of when the lease is up. If the user is successful at logging in before this happens, the transition happens normally. This is why the issue may be sporadic to some users. Other vendors do not experience the issue because their effective role placement occurs before authentication. (This sacrifices a large amount of Role Based Access Control functionality that BlueSocket provides, but resolves the use-ability issues with some devices.)
In version 2.9.0 which will be available shortly (you can sign up for Software Notifications here) we have added an option for a Relaxed NAC Lease which when used with the Surface Pro is successful at mitigating this issue in our internal testing.
In the near future, we are planning on adding an option for a Walled Garden Captive Portal approach which will resolve this issue fully. This will be an option along with the original NAC method so that configurations are maintained and users have the ability to use either scenario.
ADTRAN BlueSocket Product Support Manager