Event 8002, WLAN-AutoConfig

[Bankesy]

Good afternoon,

 

I'm working on our upgrade to Windows 11 and in testing have found an issue with connecting to our normally automatic wireless profile.

 

The error received is that in the title along with "Failure reason: Explicit Eap failure received"

 

Has anybody else experienced this\found a fix when upgrading from Windows 10 to Windows 11?

 

Thanks

[Steve21]

I'd assume that's the credential guard issue, by default Win11 turns it on now which breaks the older CHAP style Radius auth - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues#wi-fi-and-vpn-considerations

 

Wi-fi and VPN considerations

When Credential Guard is enabled, you can no longer use NTLM classic authentication (NTLMv1) for single-sign-on (SSO). You'll be forced to enter your credentials to use these protocols and can't save the credentials for future use.

 

If you're using WiFi and VPN endpoints that are based on MS-CHAPv2, they're subject to similar attacks as for NTLMv1.

 

For WiFi and VPN connections, it's recommended to move from MSCHAPv2-based connections (such as PEAP-MSCHAPv2 and EAP-MSCHAPv2), to certificate-based authentication (such as PEAP-TLS or EAP-TLS).

 

There's a GPO you can enable to disable Credential Guard which after a reboot should then show if it is that issue as if it works as soon as it's disabled you either need to decide whether you want to leave it disabled, or change your authentication type on RADIUS to the newer methods.

 

Steve

[mbedford]

+1 Steve on this. We faced the same issue, disabled cred guard and it works again. Medium term, we are going to change the RADIUS method, but for the moment...

 

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure?tabs=gpo#configure-credential-guard-with-group-policy

 

The above article doesnt mention that there are actually three options, the two in the article, and just "Disabled", go for disabled.

 

 

I'd assume that's the credential guard issue, by default Win11 turns it on now which breaks the older CHAP style Radius auth - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues#wi-fi-and-vpn-considerations

 

 

 

There's a GPO you can enable to disable Credential Guard which after a reboot should then show if it is that issue as if it works as soon as it's disabled you either need to decide whether you want to leave it disabled, or change your authentication type on RADIUS to the newer methods.

 

Steve

Edited November 29, 2024 by mbedford

[Bankesy]

@Steve21 @mbedford

 

If changes are made to the RADIUS method does that then affect any devices that might remain on Windows 10?

 

Thanks

[mbedford]

We only apply this GPO to Win11, so I cant really say either way. Sorry

[Bankesy]

@mbedford that's fine, thanks for your help

 

I'm still trying to figure out how to do this without that GPO so I'll let you know if I get anywhere with that.

[k-strider]

you can use both auth methods and just push the certificates above the PEAP we found this. the other thing in GPO if you specifiy Radius servers make sure the case is the same as the certificate name we had server.domain.lan but the cert was SERVER.domain.lan and whilst win 10 didn't complain windows 11 complained and you had to manually say yes to connect once we change the GPO it resolved its self. that was way back when win 11 was 21H2 it could have been fixed now..

[Bankesy]

Thanks @k-strider I will give this a look