[22h2] PEAP/MSCHAPv2 and 22H2 Credential Guard

[mitchell1981]

Installed 22H2 on a test laptop and immediately ran into the Radius / Credential Guard issue.

 

Can anyone advise what is the best way to go if we are no longer supposed to use PEAP/MSCHAPv2. Is it EAP-TLS we should be using now? Anyone know of a good guide to get this set up?

 

Sorry if these are silly questions. It's an area I've not fiddled with much recently.

[mitchell1981]

Just for anyone facing this problem. A quick non-fix is to disable the Credential Guard feature until you are ready for it:

 

Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Secuirty > Credential Guard Configuration Disabled

 

I've set this policy with a WMI filter to just Windows 11 22H2 until I can modernise the WiFi setup.

[free780]

It depends if you offer wi-Fi for guest devices which may include Windows 11 22H2. You may need to to have a capture site where a certificate can be generated upon successful authentication.

 

If its for organisational owned devices you can disable cred guard so you can test.

[k-strider]

Because our Domain Joined devices were already auto enroled to our CA and issued a certificate it was realitivley straight forward to change the NPS and GPO to use Microsoft Smart Card or other Certificate.. not sure howim going to deal with BYOD either yet.

[mitchell1981]

Because our Domain Joined devices were already auto enroled to our CA and issued a certificate it was realitivley straight forward to change the NPS and GPO to use Microsoft Smart Card or other Certificate..

 

Thanks for this. I was being stupid when I tried this. I changed the settings on NPS, and completely forgot to tweak the GPO! Got it working now.

[craigcamacho]

I have just come up against this. Thankfully it was only on the 3 XPS13 laptops the IT Support just got and imaged to Windows 11 22H2 and it didn't hit our production environment. When i set the above NPS and GPOs and then login to a laptop and the wifi tries to kick in I get a prompt saying action needed. Any ideas?

[Chris_Cook]

I'm struggling with this as well this week.

 

Do these work arounds work with a radius server on 2012r2?

[ITGuyNW]

I've just faceplanted into this.

 

Is the above still the way to go?