topic Re: ISE TEAP - Combine User and Computer Authentication Win10 CredGuar in Network Access Control

ISE TEAP - Combine User and Computer Authentication Win10 CredGuard

Nils 86 — Mon, 26 Jun 2023 20:28:25 GMT

hi,

i am searching for a way to combine computer certificate (eap-tls) and user authentication (mschapv2) in one session. with EAP-TEAP this should be possible, but i have a problem with the user authentication. if the windows 10 feature credential guard is active the username/password cant be used for the mschapv2 part. is this right or a misunderstanding or has anyone a solution for this problem?

i hope any one can help me 🙂

best regards nils

Re: ISE TEAP - Combine User and Computer Authentication Win10 CredGuar

ahollifield — Tue, 27 Jun 2023 00:10:32 GMT

This is correct. Why not use user certificates instead? You can also disable credential guard.

Re: ISE TEAP - Combine User and Computer Authentication Win10 CredGuar

Nils 86 — Tue, 27 Jun 2023 07:04:10 GMT

hi, completely disabling credential guard is not a good idea becaus of security reasons.

if the user certificate is the only other option, i will try it! thank you

are there any other option with the cisco secure client NAM Module?

regards Nils

Re: ISE TEAP - Combine User and Computer Authentication Win10 CredGuar

Aref Alsouqi — Tue, 27 Jun 2023 08:07:14 GMT

In my opinion TEAP would be a better option comparing to AnyConnect NAM because it is native and doesn't require any additional licenses.

Re: ISE TEAP - Combine User and Computer Authentication Win10 CredGuar

ahollifield — Tue, 27 Jun 2023 13:34:13 GMT

No my understanding is Credential Guard prevents the account credentials from being used directly across the OS. Certificate based auth methods are much preferred.