PEAP certificate check

Question

Authentication anomaly!!
I have been testing 802.1x authentication on wired networks. When deploying machine certificate (Windows 7), machine gets certificate, then turned on PEAP-MS-chapv2, everything works OK. Machine checks NPS servers certificate, creates tunnel for encrypted
password and authentication works OK.
On Windows Server 2008R2 if you delete machine certificate on client, authentication fails, but on Server 2012 R2 if I delete all certificates (machine and root CA), machine gets authenticated? On both Windows versions everything else works as it should
(EAP-TLS and PEAP-TLS).
Any comments? Bug?
Matjaz

Answer 1

On 2008 NPS denies access on PEAP-MSCHAPv2. Also log displays access denied. There is also no EAP-TLS enforcement with 2008R2. In 2012R2 logs you see computer as authenticated. As I said two servers different OS, same infrastructure, same switch,same policies
on both servers, same clients,I just switch who is authenticating clients.When i authenticate without client certificates against 2008R2 NPS I get denied, I change server to 2012R2 NPS, reboot client and I get authenticated. Then again check for certificates
and they are not there?
The strangest thing is that one of our costumers were having problems with EAP session timeouts (in NPS log).
That was the reason I started testing why these timeouts appear , which led to this anomaly. If I configured PEAP-MSCHAPv2 there were no timeouts (in my test environment and also at costumer's infrastructure). As soon I selected authentication that involves
EAP (EAP-TLS or PEAP-EAP-TLS) session timeouts are there. I also tried different MTU size, but timeouts are still there.
The costumer's network authentication was configured by them, we were just called to debug the problem. So I saw this strange things in my lab and also at costumer's network.(EAP session timeout and strange authentication)
The first thing was to enforce 802.1x authentication in advanced settings in GPO for wired networks, the second was to update Intel LAN drivers to latest version (I already had problems with these drivers which were randomly crashing Win7 clients).
Matjaz