Credential guard on lenovo m73z

[ADMaster]

I'm planning to roll out credential guard this summer and found a hardware readiness script from Microsoft. It reports that secure boot is not enabled.

 

I am testing on a Lenovo M73z All in one.

CSM is disabled and it is UEFI only, this should be secure boot right?

When I boot up, I get the lenovo logo instead of the windows logo.

I also disabled quick boot as a last try before posting.

I updated the bios today to 1.51 as well.

 

Also just a general question about the deployment.

I know it can be enabled via GPO, If I apply the GPO to a machine that is not supported what happens?

 

I think I read somewhere about a reboot loop but not finding it now.

If that is the case what is the best way to filter the GPO or just deploy via script to known compatible devices?

 

Thanks,

[ADMaster]

I was overlooking a separate option in bios specifically called secure boot. I thought UEFI by its nature was secure boot.

 

I'd still be interested to know how others are deploying this. It looks like the hardware readiness tool will be most flexible, unless I add a ton of wmi queries to a GPO.

[ADMaster]

The wider roll out for this may need to wait until next summer, I just found out it breaks wifi authentication, I'll have to setup certificate auth for this to work.

[RobFuller]

The wider roll out for this may need to wait until next summer, I just found out it breaks wifi authentication, I'll have to setup certificate auth for this to work.

 

Why happens exactly?

[Arthur]

I've deployed Credential Guard on a few PCs running Windows 10 1703 and haven't noticed any issues so far. These are the settings I am using in my GPO...

 

 

What does yours look like?

 

I just found out it breaks Wi-Fi authentication

What sort of Wi-Fi authentication?

[ADMaster]

OK sorry about that, let me add all the details.

I decided to deploy with the hardware readiness tool using options -cg -enable -autoreboot.

I chose the tool because it will allow me to target a few test machines at a time, can be pushed with PDQ and writes reg keys that PDQ can read for status information.

 

After I pushed the script with PDQ and the machines rebooted PDQ did not see them as online.

I went to the machine and noticed wifi was not connected, I plugged it into a cable and ran gpupdate but no joy.

I did a quick google search for credential guard breaks wifi and found this.

The blog details event ids, but in short peap / mschap v2 are not supported and you must use certificate based authentication.

This fact is a little one liner in the system requirements easily overlooked.

 

I deploy our wireless settings via GPO it is set to use wpa2 enterprise aes+ccmp, peap (mschap-v2) and use computer authentication.

I have ruckus pointing to NPS running on server 2012 r2.

 

I have no PKI setup atm, so I need to set that up then figure out how to do certificate based authentication before I think of this for all staff.

I did enable it on my PC and will enable it on a suite of the M73z's as they are wired in.

 

I copied the script to USB and ran it with -cg -disable -autoreboot and the wifi connected as it should with no issues.

 

Also to answer one of my own question for anyone else's curiosity. I configured both a 1511 and 1703 machine to use CG via local GPO when they were on legacy bios. It did not crash I just got errors in the event log, that must have been something else I read about.