Troubleshooting Tip: Windows 11 version 22H2 devices failed to connect to SSIDs with WPA2-PEAP authentication

[mradhika22]

Description	This article describes a scenario where Windows 11 22H2 client devices fail to connect to SSIDs with MSCHAPv2-based authentication (like PEAP-MSCHAPv2 and EAP-MSCHAPv2).
Scope	FortiAP (all versions), Windows 11 22H2.
Solution	Description: As Windows 10 is approaching the End of Life, more client devices are upgraded or migrated to Windows 11. Credential Guard is On/enabled by default in Windows 11 22H2 models and breaks PEAP authentication on enterprise WiFi SSID. New 22H2 uses TLS 1.3 for EAP authentication, whereas this was TLS 1.2 in previous versions. More details on Credential Guard are in the link below: How Credential Guard works  Resolution :  For the Windows 11 22H2 client devices to connect to the WPA2-PEAP SSID, the Credential Guard needs to be disabled. If Credential Guard needs to be enabled for security reasons, then certificate authentication (like PEAP-TLS or EAP-TLS) needs to be implemented. Related document: Known issues