Using Windows 10 with Credential Guard - AnyConnect Supplicant

[daabruze]

Team -

I'm with a customer this week and don't have a way to test for this question at the moment.

ISE v1.4 Patch 7

Like many Federal DOD customers, they have a Windows 10 Workstation STIG (STIG ID: WN10-CC-000075) that requires them enable the Credential Guard feature on Windows 10; which does not allow for PEAP-MSCHAPv2 Machine Authentication.

The simple answer is the one I'm currently pursuing; which is to have them disable the feature and continue using Machine Auth. They do not have the infrastructure to put valid certificates on the workstations for EAP-TLS.

I would like to know though, if they use the AnyConnect client as the supplicant, would that be a solution or is NTLM and Kerberos authentication (MSCHAPv2) still affected by enabling Credential Guard regardless of the supplicant being native or AnyConnect.

Thanks for any feedback.

Damon

[hslai · Accepted solution]

Protect derived domain credentials with Credential Guard (Windows 10) says,

Credential Guard also does not allow unconstrained Kerberos delegation, NTLMv1, MS-CHAPv2, Digest, CredSSP, and Kerberos DES encryption.

...

• If you are using Wi-Fi and VPN end points that are based on MS-CHAPv2, they are subject to similar attacks as NTLMv1. We recommend that organizations use certificated-based authentication for Wi-Fi and VPN connections.

...

From what I understood, it implied certificate-based auth would be a must if this feature is enabled.

I will check with our teams and see whether anyone knows it differently. You could probably try EAP-GTC as the inner method.