I joined my new school a few months ago and our network manager recently left without having a proper 'handover', so apologies if this sounds a bit confusing.
I am trying to implement a new WiFi SSID to allow domain-joined devices (Windows) to automatically connect to a new SSID using 802.1x and computer authentication.
We are already using PEAP/MSCHAPv2 on a different SSID with user authentication, which works as expected, and for now I am planning to keep this, before we can move to a certificate-based authentication.
The problem I'm running into is that Credential Guard prevents computer authentication from working. This is kind of expected, however what is not expected is the behaviour of the other SSID, which allows the same exact device to connect using username/password (and the same authentication etc). I was under the impression that MSCHAPv2 does now work with Credential Guard, but why does it seem to work if I use user authentication?
I am asking this because I can see that we have at least one GPO that explicitly enables Credential Guard, so I'm wondering if there's something else that I should be looking at, before I decide to simply disable Credential Guard altogether.
TL;DR: why does Credential Guard seem to break computer authentication but not user authentication, with PEAP/MSCHAPv2
