Technical Tip: FortiNAC Dot1x EAP-PEAP-MSCHAPv2 Authentication fail with error 'Credentials Invalid (MSCHAP2)'

(11564) mschap-WININD: Creating challenge hash with username: hawada1
(11564) mschap-WININD: Client is using MS-CHAPv2
(11564) mschap-WININD: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{mschap-WININD:User-Name} --domain= --challenge=%{%{mschap-WININD:Challenge}:-00} --nt-response=%{%{mschap-WININD:NT-Response}:-00}:
(11564) mschap-WININD: EXPAND --username=%{mschap-WININD:User-Name}
(11564) mschap-WININD: --> --username=hawada1
(11564) mschap-WININD: Creating challenge hash with username: hawada1
(11564) mschap-WININD: EXPAND --challenge=%{%{mschap-WININD:Challenge}:-00}
(11564) mschap-WININD: --> --challenge=1537579dbb93c147
(11564) mschap-WININD: EXPAND --nt-response=%{%{mschap-WININD:NT-Response}:-00}
(11564) mschap-WININD: --> --nt-response=45777148c1afb00271d905beeb31765729f88fe0df16bb80
(11564) mschap-WININD: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)'
(11564) mschap-WININD: External script failed
(11564) mschap-WININD: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)
(11564) mschap-WININD: ERROR: MS-CHAP2-Response is incorrect

rlm_rest (rest_reject): Connecting to "http://127.0.0.1:8081/api/v2/radius"
(11564) [rest_reject] = updated
(11564) update outer.session-state {
(11564) &Module-Failure-Message !* ANY
(11564) &Module-Failure-Message := &reply:Module-Failure-Message ->'Credentials Invalid (MSCHAP2)'

To overcome this behavior, Disable Credential Guard on the Windows 11 machine or switch to EAP-TLS.

Add/modify the below registries:

Key path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Key name: LsaCfgFlags
Type: REG_DWORD
Value: 0

Key path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard
Key name: RequirePlatformSecurityFeatures
Type: REG_DWORD
Value: 0

Key path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
Key name: LsaCfgFlags
Type: REG_DWORD
Value: 0

Alternatively:

1. Administratively open Windows Command Prompt: 

2. Restart the device. Before the OS boots, a prompt appears notifying that UEFI was modified, and asking for confirmation. The prompt must be confirmed for the changes to persist.