Win7 not accepting cert from NPS

[CSCO10662744_2]

An environment I'm working on has Cisco WLC, MS NPS RADIUS server, and some clients doing WPA2-Enterprise authentication.
For some reason, all the endpoints work, except Win7 clients.

With either self, or public signed certs, Win7 would prompt for username/password, but after clicking OK, authentication would fail.

Win7 does NOT prompt for user to accept cert, while NPS has a log saying cert is not trusted.
Why would Win7 not prompt for user to accept cert, and how do we enable that prompt?

Is this an NPS-specific issue?
If we use ISE to do RADIUS auth in the backend, would this issue go away?

[Philip D'Ath]

It sounds like the Windows 7 machines are missing the CA certificate that was used to issue the NPS certificate used for the PEAP authentication.

[CSCO10662744_2]

Thanks for the reply.

In the past, even when the CA cert is not in the trust store, Win7 would still prompt user w/ a warning, and user still had a choice to accept/deny.

In this case, the user doesn't even get prompted.

We changed the CN in cert, and created a DNS entry, and somehow that made Win7 clients to start prompting users now.

I was curious to know why Win7 didn't prompt, and if this is a specific behavior when NPS s used as RADIUS server.