Windows 11 Pro with TEAP or EAP using Group Policy on delivery

Question

Hey there everyone, wondering if anyone else is seeing this issue and if there may be a solution for it.

Posting for my team. We're deploying 802.x settings out to Windows 11 via GPO. Intentions to enforce certificate authentication. The problem we're seeing, when deploying the GPO to test computers & users, the WiFi adapters get disabled when the gp successfully updates on the computer. Some additional conf. details below:

GPO settings for Computer Policy / Security Settings include the following: Policy type [Windows Vista and Later Releases] Network SSID [Network Name Defined], Network Type [Infrastructure], automatically connect to this network [enabled], automatically switch to a more preferred network [enabled] Enable use of IEEE 802.1x, access for all networks [enabled] Validate server certificate [enabled] Update and manage certificates that use cert. templates from AD [enabled] Automatic certificate request [computer] Wired Network (IEEE 802.3) Policies - include smart card or cert. EAP-TLS, User or Computer authentication
Advanced configuration & properties include the correct certificates (confirmed matching) Wireless Network (IEEE 802.11) Policies - include Profile name [SSID], WPA-Enterprise
MS Smart Card or other cert. (EAP-TLS), User or Computer authentication
Advanced configuration & properties include matching certs. (confirmed matching)

Pretty basic stuff, although left out some specific details, relevant to us. So, the odd thing is when we deploy the GPO to the workstation(s) in testing, we see the WiFi Adapters get disabled. Standard hardware with Windows 11 Pro, licensed. Ruled out GPO by testing successfully without the GPOs in place and performing the authentication methods manually by, joining the said SID and obtaining IP and some basic ping / route testing.

... Has anyone else seen this issue, is there a fix or known problem in our method of use.

Thanks

Answer 1

Located two additional services in the GPO which were disabling the adapters.

dot3svc and WlanSvc, when enabled caused the adapters to be in a disabled state.