Cisco ISE and windows 11 WPA2-Enterprise

[JR1111]

Hi All,

facing an issue with devices that are in place upgraded from win10 22H2 to 24H2, when the device completes the update I can see it has not joined the network via wifi it should auto connect.

When logging on and connecting to the SSID presented with a message below, it connects without an issue and after a reboot stays connected its just after the upgrade it seems to drop, I do not have a wireless GPO is that the problem? Any help or adevice would be appreciated. 

Continue connecting?
If you expect to find in this
location, go ahead and connect Otherwise, it
may be a different network with the same
name.
Show certificate details

[balaji.bandi]

May be this end device behavior, also check on ISE you see any other logs ?

you need to troubleshoot in windows side  :

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure?tabs=intune#disable-credential-guard

[Dustin Anderson]

Windows 11 has a device guard/credential guard that is enabled by default and you can run into issue if the device is on-domain and sends user credentials. 

I'll attach a document I made a year or so ago on getting Windows 11 to work on the wireless.

[MHM Cisco World]

https://bst.cisco.com/quickview/bug/CSCwm35873

MHM

[dal]

We had problems with W11 as well. The problem was that W11 uses TLS1.3 as default, but ISE versions below 3.3 patch 3 (I think) does not support TLS1.3

So we had to force the supplicant in W11 to use TLS 1.2, and that worked like a charm
I believe the command was:

reg add HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13  /v TlsVersion /t REG_DWORD /d 0xc0

https://support.microsoft.com/en-us/topic/windows-10-devices-can-t-connect-to-an-802-1x-environment-179ef277-e6ef-8ea3-cb0e-11a6b80fa955