Windows 11 - WiFi, NPS, Radius

[craigcamacho]

Hi All,

 

I am hoping some clever person on here can help with an issue I am having with my Windows 11 migration project and point out where I am going wrong with my Wireless, NPS and GPO settings. I know about the update that broke NPS/Radius a while back that I believe was down to Credential Guard now being on by default. Is disabling Credential Guard the typical thing to do or should I be looking to reconfigure NPS to make it work with Credential Guard? (I would have thought the second option but want to know what everybody else does). Everything else such as Radius Clients are already setup and my current polices that are live are working with Windows 10.

 

For testing I have created new Connection Request, Network Policies and GPO that points to my test devices

 

1. Connection Request Policy

 

 

2.0 Network Policy (Overview)

 

 

2.1 Network Policy (Conditions)

 

My test devices are in the group WIN11_Devices

 

 

2.2 Network Policy (Constraints)

 

Have set this to Smart Card or Cert and selected valid cert thats in date

 

 

2.3 Network Policy (Settings)

 

 

3.0 GPO (Connection)

 

 

3.1 GPO (Security)

 

 

3.2 GPO (Security Certificate)

 

Cert selected matches the one set in 2.2

 

Edited June 6, 2024 by craigcamacho

[Sheridan]

I had to disable CG for W11 whilst testing moving to cert based authentication - so that would work but probably not a long term fix. Are your client PCs getting a cert from your PKI/CA ok?

[craigcamacho]

Yeah i think so. I just looked under Certlm and can see the cert and the expiration date matches up with what I have set. In Event Viewer under WLAN-AutoConfig on the client trying to connect to wifi I am getting an error messages about The authenticator is no longer present. Does this mean anything? I will be honest certs aren't my strong point.

[craigcamacho]

Actually it doesnt look like it is getting the certificate. I have just logged and opened certs via mmc and requested a new cert and picked the one from my CA for wireless and as soon as I did it started working. Like I say im far from an expert in certs so i need to figure this out now. GPOs for Auto Enrol perhaps?

[Sheridan]

That might be, our clients all have a cert issued by SCCM for the domain, so they already have a cert

[Julian]

Have you updated the certificate templates to the new Microsoft standard (and issued new certifficates)? You now need a Kerberos Domain contoller template, for domain contollers, and a update template for member servers.

 

Windows 11 Clients will not accept the older standard, so they fail.

 

Here are some hopefully useful links.

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/requirements-domain-controller

 

https://dirteam.com/sander/2022/09/14/todo-upgrade-the-certificates-for-your-windows-server-2016-based-domain-controllers-and-up-to-enable-windows-hello-for-business-hybrid-scenarios/

Edited June 6, 2024 by Julian

[craigcamacho]

No i hadn't updated the templates but have now so much appreciated for making me aware of that. It still didn't work even after I did this but you certainly got me in the right direction and I managed to figure it out. I had removed my Windows 11 test devices from the "Domain Computers" group and put them in their own temp "WIN11_Devices" group to isolate them from the main production policies in NPS. In my CA under the security tab of my wireless cert template it was only setup to auto enrol "Domain Computers". I have added in Win11_Devices" and ticked auto enrol and I think its fixed it. I am going to reimage both my test devices now and see if it still works. Edited June 7, 2024 by craigcamacho

[CHiLL]

I am currently looking into this at the moment. The options are either disable Credential Guard via GPO for the devices or amend the Network Policy in NPS to use "Microsoft: Smart Card or other certificate" and select a certificate issued by your CA. I believe the latter requires you to have PKI set up in your environment, which we already do. Ideally, I don't want to disable Credential Guard if I don't have to. We split out our staff and student laptops into different VLANs via our network policies, based on security group membership. All devices are members of "Domain Computers". All student devices are also members of "Dot1xStudents" group. All staff devices are also members of both "Dot1xStudents" and "Dot1xStaff". The network policies run in processing order, so a staff device will be processed by the staff WIFI policy first and be placed into the staff laptop VLAN. Then student laptops do the same thing.

 

I've duplicated my Wi-Fi network policy and set it to disabled for the time being. In this new policy, I've removed the PEAP authentication and added in smart card, selecting a certificate from our CA. I am yet to test this though, as I would need to set this as a precedent/disable the existing one in order to test. While that won't affect currently authenticated devices, if the policy doesn't work, any devices that attempt to authenticate will fail. So I'll have to be quick with my testing.

 

Edit:

According to this Microsoft article, EAP-TLS on Windows 11 uses TLS 1.3 and NPS does not currently support TLS 1.3. This would suggest the only viable option for using Windows 11 with a RADIUS server would be to disable Credential Guard.

Edited June 7, 2024 by CHiLL

[CHiLL]

It appears I've had success following this YouTube guide: https://www.youtube.com/watch?v=SgAjEuCAFzE. I already had most of the configuration in place, but for our testing I created a security group called "Win11-Testing" and I'm manually adding the Windows 11 machines into the group for the time being. Since we already have a GPO that contains our wireless settings with PEAP authentication, I duplicated the policy and amended a few settings. The main ones I've edited are:

 

"Computer Configuration > Policies > Security Settings > Wireless Network (802.11) Policies" configured. We already have an existing policy defined here that uses PEAP authentication, though this new GPO is defined using "Smartcard or certificate" authentication.
"Computer Configuration > Policies > Security Settings > Public Key Policies > Certificate Services Client - Auto-Enrollment Settings" set to "Automatic enrollment"
"Computer Configuration > Policies > Security Settings > Public Key Policies > Public Key Policies > Automatic Certificate Request Settings" set to "Automatic Certificate Request: Computer"
"Computer Configuration > Policies > Security Settings > Public Key Policies > Public Key Policies > Public Key Policies > Trusted Root Certification Authorities" set with our imported CA certificate
"Computer Configuration > Policies > Security Settings > Public Key Policies > Public Key Policies > Public Key Policies > Intermediate Certification Authorities" set with our imported CA certificate
"Computer Configuration > Administrative Templates > System > Device Guard" set with credential guard enabled

The GPO was also configured with a WMI filter for only Windows 11 devices and the old/existing policy configured with a WMI filter for Windows 10.

 

I also created a new NPS Network Policy, following the YouTube guide, added an extra condition for "Machine Groups = Domain\Win11-Testing" and made sure it was above/higher processing order than the existing NPS policy. This means that only machines in the security group I specified will be processed by it.

 

I have successfully tested the Windows 11 GPO and NPS policy on Windows 10 by removing the OU GPO link, removing the Windows 11 GPO WMI filter and removing the machine group condition in NPS - and it did work...but only after a gpupdate/restart with an existing network connection.

 

For the duration of my testing, I'm leaving it so that I'll have to manually add machines into the machine security group. Once I'm happy with Windows 11 and push it to all machines, I can then remove those restrictions.

[ITGuyNW]

I followed the guide above but now I get "Can't connect because the sign-in requirements for your device and the network aren't compatible"

 

Getting a bit frustrated with this and Windows 11.

 

Windows 10 works fine but obviously that's on the non-cert authentication.

[Steve21]

Did you disable Device Guard? Depending on how yours is setup we found that broke Win11 Radius on older kit

 

Steve

[ITGuyNW]

Yeah that's the first thing I did. I just don't get a consistent experience though.

[ITGuyNW]

If in doubt, gpupdate /force and restart 3 or 4 times. Seemed to have cracked it.