Windows 11 24H2 802.1X Authentication not working

[tayyab12]

Hi Guys

back with another issue with the lovely 24h2 update. We use radius to authenticate our wireless which has been working fine with 23h2. however when ive imaged a machine to 24h2 just stops working. says cant connect to network. checked NPS logs and event viewer nothing is appearing, checked my aruba logs nothing there either. ive had a google and seen something about changing the order of ECC Curve which i have done but not fixed anything. Everything is working fine rn with 23h2 no issues in general but 24h2 is just something special. i literally waited for a while so all the bugs could get sorted but guess ms have done it again. any help would be appreciated guys

[psydii]

PEAP or EAP? PEAP (account/password based auth) isn't supported by Win11 anymore, is it possible you had a work-around in place that has  stopped working with the upgrade?

 

We had to (finally, nearly 20 years after I first flirted with the idea) move to EAP-TLS  (client/user certificate based auth) just last year to support Win 11 without forcing it to rollback the security settings that are the whole point of the Win10/11 demarcation.

[mbl]

I think I had the same issue but I think I had to set a GPO to Disable Turn On Virtualization Based Security and this resolved it

 

Computer Configuration\Administrative Template\System/Device Guard

[DrCheese]

As the posters above say, this will be VBS doing it. You'll need to move away from PEAP and swap to PKI/certificate based authentication.

 

You can turn off VBS to get you going now, but I wouldn't do that long term as it defeats the point in moving to Windows 11.

[tayyab12]

Right we do use computer based authentication anyway. is it the case of changing the gpo? nps is set to use eap-tls the certificates there. do i need to change gpo peap setting? what would i change it too.

[tayyab12]

Yep turning VBS off fixed it however with EAP-TLS ready to go. am i to just turn on certificate based authentication on the gpo and technically should just work?

[psydii]

The work-around I refereed to is indeed disabling VBS. You should move Heaven and Earth to avoid turning off VBS - its a pretty fundamental part of Win11 security and its absence will hold you back with regard to modern security best practice - and could conceivably put you out of compliance with your Cyber Insurance policy.

 

If your computers each have a valid certificate from your Enterprise CA, then that should work.

 

FWIW we found out the hard way that  a load of our computers for some reason* didn't have a valid certificate, and the only way to get them back on the network was to hard-wire them to pick up a recovery GPO! So do check before pushing over the authentication method!

 

I'd recommend doing small batches of machines and checking the CA has a record of them having a valid certificate. Also until you are confident things are going well, might be worth checking a sample of each batch before applying the change to confirm they also believe they have a valid certificate.

 

* probably due to some bad practice (aka "received wisdom" on how to do windows admin) by a tech several years ago that broke Windows on those machines just enough to cause it to stop working - on closer inspection, lots of little things were also broken with the same root cause, so after a wipe-reload of the affected machines, we're in a better place.

 

 

 

Edited June 2, 2025 by psydii

[tayyab12]

Yes i have the certificates within the trusted root certification authorities pushed out via gpo however they need to be in the personal store on the devices. i know there isnt a gpo to import certificates into the personal store but most likely a script. How did you do it? 

[DrCheese]

You want to be looking at autoenrollment policies on your PKI, rather than any script

 

https://www.windows-noob.com/forums/topic/16283-how-can-i-configure-pki-in-a-lab-on-windows-server-2016-part-8/

 

(The whole 8 page guide is really useful for PKI stuff/pushing certs out)

[tayyab12]

https://www.youtube.com/watch?v=SgAjEuCAFzE&ab_channel=OsborneProTV

 

Fixed. Works like a charm now. Guy in the video straight to the point and was only missing a few things. 

[CHiLL]

That's the guide I followed when I implemented EAP-TLS last year. What did you find he was missing?