Hello Ringo,
I have gone through your question. Yes, the switches 3850 and 2960X supports Radius and MS-CHAP-V2. Radius method uses an external authentication server while Local EAP method uses local user database or LDAP to authenticate clients.Local EAP method supports MS-CHAP V2, but only if LDAP server is setup to return a cleartext password.
Yes, you can also configure a windows server 2012 as Radius server. Windows server has a network policy service using which it can also be configured as radius server.
Regards
Aditya kandari
Spooster IT Services