KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

[smarties11]

8 minutes ago, KK20 said:

It has yes.  My NPS has the mindset of "any update is a security update, sort issues later, better than a zero day exploit" (or veeam rollback if I really need help!)

Awesome thanks for confirming 🙂
That's one less headache to worry about...

[Davit2005]

On 15/10/2026 at 14:38, smarties11 said:

🤣 don't want to go down the PSK route as need to be able to track and log activity against individual users as per DfE guidance

We were using captive portal before on Ruckus but sadly this doesn't work properly on our new Cambium (ahem) Wi-Fi system - we made the choice to go full 802.1X on the basis of it being more secure 🤣

MPSK where there is a key per user and therefore some trackability. Of course the users could potentially share the key but then they will be facing questions if anything happened same as a staff member who lets a student use their credentials or device with the staff member logged in. But would still recommend 802.1x for managed devices and where feasible BYOD.

Edited Monday at 08:46 by Davit2005

[Sheridan]

Yup this has broken our wifi as well - fortunately I was 90% of the way there for cert based authentication so I'm in the process of switching over - but I've rolled out the reg fix to give me more time!

[broadld]

If they are managed devices you can use PSK and issue device based certificates.

What are people's plans for BYOD devices? We like to use RADIUS so that when a user joins the wireless with username and password they are put on the correct VLAN based on their year group. This authentication is also passed to our web filter to filter the device appropriately.

Is there any like for like replacement for this?

If we had one SSID for students that they connected to using a wpa key this would be quite large. We would then have to have say a captive portal that students then had to log into for authenticating them on the filter side.

[smarties11]

9 minutes ago, broadld said:

If they are managed devices you can use PSK and issue device based certificates.

What are people's plans for BYOD devices? We like to use RADIUS so that when a user joins the wireless with username and password they are put on the correct VLAN based on their year group. This authentication is also passed to our web filter to filter the device appropriately.

Is there any like for like replacement for this?

If we had one SSID for students that they connected to using a wpa key this would be quite large. We would then have to have say a captive portal that students then had to log into for authenticating them on the filter side.

The way we used to achieve this with Ruckus was to use an open OWE SSID, with captive portal page which sent accounting packets to SmoothWall to apply correct filter policy.

 

Sadly, this doesn't work correctly with our new Cambium Wi-Fi, which is why we transitioned to full 802.1X 😣

[broadld]

4 minutes ago, smarties11 said:

The way we used to achieve this with Ruckus was to use an open OWE SSID, with captive portal page which sent accounting packets to SmoothWall to apply correct filter policy.

 

Sadly, this doesn't work correctly with our new Cambium Wi-Fi, which is why we transitioned to full 802.1X 😣

 

When you say you transitioned to full 802.1X what exactly do you mean? How does this work for BYOD devices? Do users have to enrol for a certificate then use this certificate to then authenticate?

What RADIUS server are you using?

[chris11256]

21 minutes ago, broadld said:

If they are managed devices you can use PSK and issue device based certificates.

What are people's plans for BYOD devices? We like to use RADIUS so that when a user joins the wireless with username and password they are put on the correct VLAN based on their year group. This authentication is also passed to our web filter to filter the device appropriately.

Is there any like for like replacement for this?

If we had one SSID for students that they connected to using a wpa key this would be quite large. We would then have to have say a captive portal that students then had to log into for authenticating them on the filter side.

As far as we can tell BYOD isn't affected. It only affects devices where SSO is used for the device login & wifi access, where windows uses the same credentials for both. So in a BYDO scenario with a student/member of staff logging into their own laptop, then separately connect to wifi, there's no problem.

[smarties11]

Just now, broadld said:

 

When you say you transitioned to full 802.1X what exactly do you mean? How does this work for BYOD devices? Do users have to enrol for a certificate then use this certificate to then authenticate?

What RADIUS server are you using?

 

By full 802.1X I mean that we are using a WPA3 enterprise SSID, using RADIUS for authentication. We use NPS for the RADIUS server (configured to only allow sixth form students) and then send accounting packets to SmoothWall for filtering policy. Obviously the issue with this now is that this method uses mschapv2 for the password so we'll have issues with Windows devices joining. 

[broadld]

26 minutes ago, smarties11 said:

 

By full 802.1X I mean that we are using a WPA3 enterprise SSID, using RADIUS for authentication. We use NPS for the RADIUS server (configured to only allow sixth form students) and then send accounting packets to SmoothWall for filtering policy. Obviously the issue with this now is that this method uses mschapv2 for the password so we'll have issues with Windows devices joining. 

We are in exactly the same position. For managed devices it isn't a problem but for BYOD it looks like a real pain. You have to get users to enrol for user certificates and then they use the certificate to authenticate to the wireless. Currently students struggle to install the HTTPS filtering certificate onto their devices.

The other route we are looking at is using Intune Cloud PKI but all devices need to be managed by intune for this. So all BYOD devices would need to be enrolled. But then user certificates should then auto enrol for users.

All early days yet but if anyone finds anything out about this and has any further ideas I would be glad to hear them.

[broadld]

33 minutes ago, chris11256 said:

As far as we can tell BYOD isn't affected. It only affects devices where SSO is used for the device login & wifi access, where windows uses the same credentials for both. So in a BYDO scenario with a student/member of staff logging into their own laptop, then separately connect to wifi, there's no problem.

I presume if they have done this for some devices then BYOD might be affected next on Microsoft's quest for zero trust everywhere. It potentially might be a server side update that blocks this rather than a client side one.