Credential Guard / MSCHAPv2 - is it really enabled?

[arciere]

I joined my new school a few months ago and our network manager recently left without having a proper 'handover', so apologies if this sounds a bit confusing.

 

I am trying to implement a new WiFi SSID to allow domain-joined devices (Windows) to automatically connect to a new SSID using 802.1x and computer authentication.

 

We are already using PEAP/MSCHAPv2 on a different SSID with user authentication, which works as expected, and for now I am planning to keep this, before we can move to a certificate-based authentication.

 

The problem I'm running into is that Credential Guard prevents computer authentication from working. This is kind of expected, however what is not expected is the behaviour of the other SSID, which allows the same exact device to connect using username/password (and the same authentication etc). I was under the impression that MSCHAPv2 does now work with Credential Guard, but why does it seem to work if I use user authentication?

 

I am asking this because I can see that we have at least one GPO that explicitly enables Credential Guard, so I'm wondering if there's something else that I should be looking at, before I decide to simply disable Credential Guard altogether.

 

TL;DR: why does Credential Guard seem to break computer authentication but not user authentication, with PEAP/MSCHAPv2

[free780]

If you have ADCS setup move to certificate authentication. Issue certificates to each computer via GPO and certificate templates. There are guides online to do this.

 

Credential Guard may break other things.

[kevin_lane]

The only thing I can think of and it’s a long shot and not sure how you can verify it, weather you would have to capture the packets or look at the ad attributes in Ad

 

And that is to look at what’s happening when the pc computer starts to talk to the domain controller

 

 

https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication

[CHiLL]

Credential Guard does break PEAP/MSCHAPv2 machine authentication. If you want to use machine authentication, your only two options are disable Credential Guard via GPO or create a new RADIUS policy that uses EAP-TLS instead.

 

Check out this thread: https://www.edugeek.net/forums/windows-11/238344-windows-11-wifi-nps-radius.html