WPA2-Enterprise Wi-Fi Authentication with NPS and Active Directory

🔄 Update October 27, 2026 — After installing the Windows 11 October 2026 cumulative update (KB5127648), laptops configured according to this article can no longer connect to the corporate Wi-Fi network. The cause and fix are detailed at the end of this article.

👉 Go directly to the update and fix

Are you tired of managing a shared Wi-Fi key that everyone knows, one you never dare to change for fear of having to reconfigure all the devices? The clean solution is WPA2-Enterprise—each user authenticates with their own Active Directory credentials, without ever having to enter a Wi-Fi password. A domain-joined laptop connects automatically and transparently as soon as the Ethernet cable is unplugged.

In this article, we’ll convert an existing SSID to WPA2-Enterprise using NPS (Network Policy Server) as the RADIUS server, Active Directory for user management, and a GPO to automate the connection on domain-joined laptops. We will use Cisco Aironet access points in standalone mode.

Target Architecture

Laptop (domain) → Cisco AP (WPA2-Enterprise) → NPS/RADIUS → Active Directory
                                                      ↓
                                          "Is the user in GG_WIFI_RADIUS?" 
                                                      ↓
                                              Access granted ✅

Prerequisites

• Windows Server with the NPS role installed
• A working Active Directory domain
• An internal PKI (Active Directory Certificate Services) to issue the server certificate
• Cisco Aironet access points in standalone mode (IOS 15.x)
• A firewall/router supporting VLAN segmentation
• The target SSID already exists in WPA2-PSK mode

Network Segmentation in Our Example

Step 1 — Network Prerequisites: Allow RADIUS Traffic

Before proceeding with any configuration, ensure that the Wi-Fi access points can communicate with the NPS server. The RADIUS protocol uses UDP/1812 (authentication) and UDP/1813 (accounting).

On your firewall, create a rule:

Source      : VLAN100 (Wi-Fi access points)
Destination: NPS server IP
Ports: UDP 1812, UDP 1813
Action: ACCEPT
NAT: OFF (never use NAT on internal traffic)

⚠️ Important : Since the firewall is stateful, the return rule (NPS → access points) is handled automatically. You do not need to create a rule in the opposite direction.

Step 2 — Server Certificate on NPS

The PEAP protocol requires a server certificate on NPS to encrypt the authentication tunnel. We will request this certificate from our internal PKI—laptops in the domain will automatically trust it via AD.

On the NPS server, open an MMC console:

File → Add Snap-in → Certificates → Computer Account → Local Computer

Navigate to Certificates → Personal → right-click → All Tasks → Request a New Certificate

Select the “RAS and IAS Server” template and click Enroll.

💡 If the template is unavailable: On the CA server, open certsrv.msc → Certificate Templates → Manage → find “RAS and IAS Server” → Properties → Security → add the NPS server’s machine account (SERVER-NPS$) with Read and Write permissions. Then return to certsrv.msc → Certificate Templates → New → Certificate Template to Issue → select “RAS and IAS Server”.

⚠️ Common error: If you attempt to configure PEAP without a certificate installed, NPS displays the error below. Do not proceed to the next step until the certificate is in place.

The certificate will renew automatically via AD auto-enrollment—no manual intervention required.

Step 3 — Active Directory Preparation

Create the security group

In Active Directory Users and Computers, create a group:

• Name: GG_WIFI_RADIUS
• Type: Global security group
• Members: users authorized to connect to the corporate Wi-Fi

💡 Use a Global group (not a domain-local group)—NPS can evaluate global groups in its network policies.

Create a Dedicated OU for Laptops

If your laptops and desktop computers are in the same OU, create a dedicated sub-OU:

STATIONS
└── LAPTOPS   ← new sub-OU

Move the computer accounts for the laptops to LAPTOPS. The Wi-Fi GPO will be applied only to this OU—there’s no need to push a Wi-Fi profile to desktop computers.

Step 4 — NPS Configuration

4.1 Register the Access Points as RADIUS Clients

In the NPS console, navigate to RADIUS Clients and Servers → RADIUS Clients → New and create an entry for each Wi-Fi access point:

⚠️ Cisco Note: Standalone Cisco Aironet access points do not accept certain special characters in the shared secret. Use only letters, numbers, dashes, and underscores. Limit the length to a maximum of 12 characters to avoid compatibility issues.

4.2 Create the Wi-Fi Network Policy

In NPS → Policies → Network Policies → New:

Overview tab:

• Name: WIFI-ENTREPRISE
• Network Access Server Type: Unspecified
• Access Permission: Grant Access

Conditions tab:

• Windows Groups → add GG_WIFI_RADIUS
• NAS Port Type → Wireless - IEEE 802.11

Constraints tab:

The Constraints tab allows you to configure timeouts, time restrictions, and the NAS port type. Leave the timeouts at their default values and configure only the NAS port type:

Next, under Authentication Methods:

• Add Microsoft: PEAP (Protected EAP)
• Click Edit → select the NPS server certificate
• EAP Method: Secure Password (EAP-MSCHAP version 2)

Once the certificate is properly installed, the Protected EAP properties will appear as shown below with the NPS server certificate selected:

Settings tab:

Before making changes, the RADIUS attributes contain VPN-oriented values that need to be corrected:

• Remove the Framed-Protocol attribute
• Change Service-Type from Framed to Login

4.3 Check the Policy Order

NPS evaluates policies from top to bottom and stops at the first one that matches. Verify that your Wi-Fi policy is not overshadowed by a more general policy:

⚠️ Common pitfall: If you already have an NPS policy for the VPN, make sure it has a NAS Port Type → Virtual (VPN) condition in its Conditions (not just in the Constraints). Without this condition, it will intercept all RADIUS requests before your Wi-Fi policy. Here is the correct configuration:

Step 5 — Configuring Cisco Aironet Access Points

5.1 Register the RADIUS Server

Log in to the access point’s web interface → Security → Server Manager

In the Corporate Servers section, enter the NPS server information:

Once confirmed, the server appears in the list:

Click Apply, then go to Default Server Priorities → EAP Authentication → Priority 1 → select your NPS server.

5.2 Configure the SSID for WPA2-Enterprise

Security → SSID Manager → [your SSID]

The SSID Manager allows you to view and configure all your SSIDs along with their associated VLANs and active radios:

In Client Authentication Settings → Methods Accepted, here is the initial state before modification:

Modify as follows:

• ✅ Open Authentication → dropdown: with EAP
• ✅ Network EAP → dropdown: < NO ADDITION >

💡 Cisco Behavior: On standalone Aironet devices, Open Authentication must remain checked along with Network EAP. This is counterintuitive, but it’s how Cisco implements 802.1X—Open Authentication handles the 802.11 association, while Network EAP handlesEAP/RADIUS authentication. Both together = WPA2-Enterprise.

Here is the correct final configuration:

In Client Authenticated Key Management:

• Key Management: Mandatory
• Enable WPA: WPA2 (without dot11r if your clients are having connection issues)
• WPA Pre-shared Key: leave this field blank

In the AP Authentication section, create an EAP profile using the PEAP method and assign it in Authentication Methods Profile:

Click Apply, then save the configuration:

write memory

5.3 Verify Connectivity Between the Access Point and NPS

Before testing authentication, verify the access point’s network configuration:

Next, test connectivity to the NPS server from the access point’s CLI. If a firewall rule is missing, the ping will fail:

After correcting the firewall rule, the ping should return 100% success:

To debug RADIUS authentication in real time:

debug radius authentication

To view associated clients:

show dot11 associations

A client undergoing 802.1X authentication appears with the status EAP-Assoc—this indicates that everything is working correctly.

Step 6 — GPO: Automatic Wi-Fi Profile on Laptops

The GPO will push the Wi-Fi profile to all laptops in the PC_PORTABLES OU. Result: automatic connection without entering a password.

6.1 Create the GPO

In the Group Policy Management Console:

• Right-click the PC_PORTABLES OU → Create a GPO object in this domain and link it here
• Name: WIFI_ENTREPRISE

In the GPO’s security filtering:

• Keep Authenticated users (required for the computer GPO to apply)
• Optionally add GG_WIFI_RADIUS for further restriction

⚠️ Caution: If you remove Authenticated Users and set only GG_WIFI_RADIUS, the GPO will not be inherited—computer GPOs apply based on the machine account, not the user account.

6.2 Configure the Wi-Fi Profile

Edit the GPO → Computer Configuration → Windows Settings → Security Settings → Wireless Networks (IEEE 802.11)

Right-click → Create a new Windows Vista or later policy

The created policy looks like this:

Click Add to create the SSID profile:

Connection tab:

• Profile name: the name of your SSID
• SSID: the exact name of your SSID (click Add)
• ✅ Connect automatically when this network is within range
• ✅ Connect to a priority favorite network if possible

Security tab:

• Authentication: WPA2-Enterprise
• Encryption: AES-CCMP
• Method: Microsoft: PEAP (Protected EAP)
• Authentication mode: User or computer authentication

Click Properties next to PEAP. A window opens displaying the list of trusted CAs:

Configure as follows:

• ✅ Verify the server’s identity by validating the certificate
• Connect to these servers: NPS-SERVER-NAME.domain.local
• Notifications: Do not prompt the user to authorize new servers
• EAP method: Secure Password (EAP-MSCHAP version 2)

In the list of CAs, locate and check your internal CAs (check both if you have a root CA and a subordinate CA):

6.3 Force Ethernet Preference Over Wi-Fi

In the same GPO → Computer Configuration → Administrative Templates → Network → Windows Connection Manager

Setting “Limit the number of simultaneous connections to the Internet or a Windows domain” → Enabled → option: 3 - Prevent Wi-Fi connection when an Ethernet connection is active

Result: cable plugged in = Wi-Fi disabled / cable unplugged = automatic Wi-Fi connection.

6.4 Disable NTLMv1 enforcement (as of October 2026)

Since the October 2026 Windows update, PEAP-MSCHAPv2 is blocked by default on Windows 11 without Credential Guard. Add this setting directly to the same GPO to ensure your laptops remain functional—details are in the October 2026 Update section.

Step 7 — Testing and Validation

Apply the GPO

On a laptop in the PC_PORTABLES OU:

gpupdate /force

Verify that the GPO has been applied:

gpresult /r

The WIFI_ENTREPRISE policy should appear under Applied Group Policy Objects.

Connection Test

1. Unplug the Ethernet cable
2. Restart the laptop
3. When logging in, verify that the Wi-Fi connection is established automatically

NPS Validation

In the Event Viewer on the NPS server → Windows Logs → Security:

Key fields to check in a successful 6272 event:

• NetworkPolicyName: should display the name of your Wi-Fi policy
• AuthenticationType: should display PEAP
• EAPType: should display EAP-MSCHAP version 2

Common Errors and Solutions

No More Corporate Wi-Fi After a Windows Update (October 2026)

Guest Wi-Fi (PSK) works, but corporate Wi-Fi no longer connects on several laptops since the latest cumulative update. See the October 2026 Update section.

ReasonCode 66 — Authentication method not enabled

The matched NPS policy does not correspond to the EAP method sent by the client. Check the order of the NPS policies and the NAS Port Type settings.

“No Authenticator” on the laptop

The Wi-Fi access point is not acting as an 802.1X authenticator. On Cisco Aironet, verify that Open Authentication with EAP AND Network EAP are checked, and that a PEAP EAP profile is assigned in AP Authentication. Here is the incorrect configuration that needs to be corrected—the AP Authentication section with no profile assigned:

Invalid Shared Secret (Cisco)

Cisco Aironet access points do not accept the characters ?, $, +, or [. The error appears as follows:

Use an alphanumeric secret of up to 12 characters—at least for my generation of Aironet access points, which I’ll admit are getting a bit outdated.

GPO Not Inherited

Verify that Authenticated Users is included in the GPO’s security filtering. Computer GPOs are applied using the machine account—if only GG_WIFI_RADIUS is present, the GPO will not be applied.

Laptop without an Ethernet port

A classic bootstrap issue: without Ethernet, it’s impossible to retrieve the Wi-Fi GPO. Solution: temporarily use a USB-to-Ethernet adapter to apply the GPO.

Access Point Not Connecting to the NPS Server

Check your inter-VLAN firewall rules (UDP 1812/1813) and test connectivity from the access point’s CLI with a ping. See the screenshots in section 5.3.

Special Cases

Laptops without a 5GHz Wi-Fi card

Some entry-level Wi-Fi cards (e.g., Realtek RTL8723DE) only support 2.4GHz and are limited to 72 Mbps in 802.11n. If the card is in an M.2 or mini-PCIe slot, replacing it with a dual-band card (Intel AC-7260/8260/9260) resolves the issue. If the card is soldered in place, a dual-band USB Wi-Fi adapter is the only option.

Coexistence with an Existing RADIUS VPN

If NPS already handles VPN authentication, make sure the VPN policy has a NAS Port Type → Virtual (VPN) condition in its Conditions (not just in the Constraints). Otherwise, it will intercept Wi-Fi requests before the dedicated policy does.

Update October 2026

KB5127648 and PEAP-MSCHAPv2

Why We’re Republishing This Article

On October 13, 2026, Microsoft released security update KB5127648 for Windows 11 (24H2, 25H2, 26H2), and KB5126646 for Windows Server 2025. The day after it was installed, none of the laptops in our personal infrastructure could connect to the corporate Wi-Fi:

• The guest SSID using WPA2-PSK worked normally → the access points were not the issue;
• the issue affected all laptops that had been updated with the cumulative update;
• 802.1X authentication would start but never complete.

The entire configuration described above (PEAP-MSCHAPv2 via NPS) was therefore broken by the update, without any changes on our end. This article needed to be updated.

The Cause: NTLMv1 Enforcement Enabled by Default

This is not a bug but a change announced by Microsoft in KB5066470 (August 2025), as part of the phased deprecation of NTLM.

A registry value, BlockNtlmv1SSO, controls whether NTLMv1-derived credentials used for Single Sign-On are blocked:

Until October 2026, a missing value was equivalent to Audit mode. Since KB5127648, a missing value is equivalent to Enforce mode, under two conditions:

• Credential Guard is disabled on the workstation;
• the BlockNtlmv1SSO value has never been set.

The update does not create the value in the registry: nothing visibly changes on the workstation, which makes diagnosis difficult. However, MS-CHAPv2 relies on this mechanism: PEAP-MSCHAPv2, EAP-MSCHAPv2, Wi-Fi, Ethernet 802.1X, and VPN—all are affected.

To verify on a computer: Event Viewer → Application and Service Logs → Microsoft → Windows → NTLM → Operational.

The immediate fix: switch back to Audit mode

On a computer, at an administrator command prompt:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v BlockNtlmv1SSO /t REG_DWORD /d 0 /f

No reboot is necessary. Disconnect the Ethernet cable: the laptop will reconnect to the corporate Wi-Fi.

Deployment via GPO

In the WIFI_ENTREPRISE GPO created in step 6:

Computer Configuration → Preferences → Windows Settings → Registry → New → Registry Key

⚠️ Bootstrap: A laptop that is already offline will not be able to retrieve the GPO over Wi-Fi. Connect it via Ethernet (or a USB-to-Ethernet adapter) long enough to run gpupdate /force, or apply the reg add command locally.

💡 Do not uninstall KB5127648. Uninstalling it works, but it also removes the other security updates for the month. Switching to Audit mode is targeted and reversible.

The real solution: abandon MS-CHAPv2

Switching back to Audit mode is a stopgap measure: you’re re-enabling a mechanism that Microsoft is in the process of phasing out. Microsoft’s recommendation is to migrate to certificate-based authentication, EAP-TLS, or PEAP-TLS.

Good news: if you’ve followed this article, the internal PKI is already in place for the NPS certificate. The migration involves:

1. deploying a computer certificate on laptops via auto-enrollment (GPO);
2. adding EAP-TLS as an authentication method in the NPS network policy;
3. switching the Wi-Fi profile in the GPO from PEAP-MSCHAPv2 to Smart Card or Other Certificate;
4. once validated, set BlockNtlmv1SSO back to 1 (Enforce).

This will be the subject of a future article.

Sources

• Microsoft — KB5066470: NTLMv1 changes in Windows 11 and Windows Server 2025
• Message Center MC1508562 — NTLMv1 hardening changes

There you go!

Your Wi-Fi infrastructure is now secured with WPA2-Enterprise. No more shared PSK keys to manage, and no more risk of a former-employee retains Wi-Fi access—each connection is individually authenticated using AD credentials. Access revocation is a one-click process from Active Directory, and NPS logs let you track who connected, when, and from which access point.

The same NPS infrastructure can be extended to secure Ethernet ports via 802.1X on your managed switches—but that might be the subject of a future article, or maybe not 😉