TEAP GPO on Windows 10

Question

Hello everyone,

Let me explain my issue.

I configured a GPO to apply 802.3x "settings" (Computer Configuration, Policies, Windows Settings, Security Settings, Wired Network (IEEE 802.3) Policies with "Microsoft: EAP-TEAP" as a Network Authentication method:

Long story short: Windows 11 applies the GPO but Windows 10 fails.

Long story short: Windows 11 applies the GPO but Windows 10 fails.

I also created a LAB: same results.

I tried with both 20H1 (first windows 10 version to support TEAP) and 22H2 versions and I get the same behavior.

Basically on a W11 client everything works and by looking at settings everything is configured as per GPO ("this settings is managed by your administrator"):

On a W10 client the GPO seems to be completely ignored: also Network Authentication revert to "Microsoft: PEAP (Protecetd EAP)":

The strange thing is that this only occurs if I select a Root Certificate in the "TEAP Properties" window (see above) and if I select "Microsoft EAP: TEAP" as Network Authentication method: if I don't select any Root Certificate in the "TEAP Properites" window the GPO is also applied to Windows 10.

Please notes that I have a standalone Offline root CA and an Enterprise Issuing CA (2-tier PKI hierarchy) but even if I select a public Root Certificate (ie Entrust) I get the same.

Any help would be much appreciated.

Thank you very much.

Andrea

Answer 1

Hi,

This is the process I used to get this working in our system.

https://community.cisco.com/t5/security-knowledge-base/teap-for-windows-10-using-group-policy-and-ise-teap/ta-p/4134289