Forum Discussion

PaulvDam's avatar
PaulvDam
Copper Contributor
Oct 08, 2021

Windows 11 clients cannot authenticate to NPS server using computer authentication

We have a Windows server 2019 datacenter server running NPS. Our WiFi Office clients authenticate to this server for access to the corporate WiFi network. We use computer authentication, so members o...
computer authentication
nps
windows 11
Wireless
Nick_A's avatar
Nick_A
Iron Contributor
Oct 22, 2022

For our environment it was due to credential guard.  This will break anything using PEAP w/MS-CHAPv2, including machine authentication.  It's also extremely tricky to debug because this requires Windows Enterprise version and since we are using E3 licenses (included in there is the OS Enterprise license) this problem only surfaces eventually when the OS is upgraded to enterprise in the background (enabled by default with Enterprise, does not get enabled with only Pro).

 

Fix: Group Policy->Administrative Templates->System->Device Guard->Turn On Virtualization Based Security (set to DISABLED).

  • wally14's avatar
    wally14
    Copper Contributor
    Dec 08, 2022
    Nick_A - I registered just to say that this was the fix for me! Credential guard is enabled by default for any device that can handle it in Windows 11 22H2 (in Windows 11 Enterprise and Education).

    Wally
  • rajeev_vlal's avatar
    rajeev_vlal
    Copper Contributor
    Dec 14, 2022
    This is the solution for me as well.
  • MikkelLundKnudsen's avatar
    MikkelLundKnudsen
    Iron Contributor
    Jan 13, 2023
    But seriously - to Disable Device Guard - is that even an option you want?
    • Darren Burke's avatar
      Darren Burke
      Copper Contributor
      Feb 02, 2023

      Our fix is to rename the NPS server so its name is lowercase.  Since our NPS's are also a a DCs the steps are

       

      1. uninstall Certificate Authority

      2. rename the server to lowercase using the following

       

      netdom computername DC1.domain.local /add:dc1.domain.local

      netdom computername DC1.domain.local /makeprimary:dc1.domain.local

      shutdown /r

       

      3. Install Certificate Authority again

       

      I have a lot of servers to change so if there is a less disruptive workaround I love to hear what it is.

       

       

      • Alban1998's avatar
        Alban1998
        Iron Contributor
        Feb 06, 2023
        Hello,
        Please keep in mind having a CA on a domain controller is not supported (and will block you from upgrading to another OS). Having NPS role on domain controllers is also not recommended.

        MikkelLundKnudsen Device Guard offers a critical protection against numerous ransomwares as it counters Mimikatz-based attacks, so that's a big no in my book.
  • rrostech's avatar
    rrostech
    Copper Contributor
    Nov 13, 2023

    Nick_A 

    instead of disabling a critical security feature (credential guard) you should fix your NPS to not use ms-chap, as this is documented very well to not work with credential guard.

Resources