[{"data":1,"prerenderedAt":1105},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":95,"post-da--posts-kb5127648-peap-mschapv2-eap-tls-e5015173d9a57":133,"authors_data":901,"authors_data:SCEPman Team":985,"content-da-list-7b291c2dd91a4":987},{"lang":4,"home":5,"navigation":14},"en",{"name":6,"imgLight":7,"img":8,"languages":9},"home","/products/scepman/scepman-logo-all-white.svg","/products/scepman/scepman-logo-rgb.svg",{"da":10},{"title":11,"url":12,"alt":13},"Forside","/da","SCEPman",[15,19,25,31,83,89],{"name":16,"languages":17},"nav-home",{"da":18},{"title":11,"url":12},{"name":20,"languages":21},"pricing",{"da":22},{"title":23,"url":24},"Priser","/da/pricing",{"name":26,"languages":27},"partner",{"da":28},{"title":29,"url":30},"Partnere","/da/partner",{"name":32,"languages":33,"children":36},"support-hub",{"da":34},{"title":35},"Support Hub",[37,53,68],{"name":38,"children":39},"support-hub-group-1",[40,47],{"name":41,"target":42,"languages":43},"docs","_blank",{"da":44},{"title":45,"url":46},"Docs","https://docs.scepman.com/",{"name":48,"languages":49},"faq",{"da":50},{"title":51,"url":52},"FAQ","/da/faq",{"name":54,"children":55},"support-hub-group-2",[56,62],{"name":57,"target":42,"languages":58},"support-ticket",{"da":59},{"title":60,"url":61},"Support Ticket","https://support.scepman.com/support/tickets/new?ticket_form=technical_support_request_%28scepman%29",{"name":63,"target":42,"languages":64},"drop-a-question",{"da":65},{"title":66,"url":67},"Contact Sales","https://support.scepman.com/support/tickets/new?ticket_form=drop_a_question_%28scepman%29",{"name":69,"children":70},"support-hub-group-3",[71,77],{"name":72,"languages":73},"glossary",{"da":74},{"title":75,"url":76},"Ordliste","/da/glossary",{"name":78,"languages":79},"blog",{"da":80},{"title":81,"url":82},"Blog","/da/blog",{"name":84,"languages":85},"events",{"da":86},{"title":87,"url":88},"Arrangementer","/da/events",{"name":90,"languages":91},"about",{"da":92},{"title":93,"url":94},"Om os","/da/about-us",{"data":96},{"mail":97,"logos":98,"socials":103,"links":116,"linksDa":126},"sales@SCEPman.com",[99],{"img":100,"alt":101,"url":102},"/products/scepman/scepman-logo-yellow.svg","SCEPman Logo","/",[104,108,112],{"icon":105,"url":106,"title":107},"fa-x-twitter","https://twitter.com/scepman_","X",{"icon":109,"url":110,"title":111},"fa-youtube","https://www.youtube.com/channel/UCKnLYxlQFhzdXkDADV_Unrg","Youtube",{"icon":113,"url":114,"title":115},"fa-linkedin","https://www.linkedin.com/showcase/scepman","LinkedIn",[117,120,123],{"title":118,"url":119,"target":42},"Privacy","https://www.glueckkanja.com/en/privacy",{"title":121,"url":122,"target":42},"Imprint","https://www.glueckkanja.com/en/imprint",{"title":124,"url":125,"target":42},"Contact & Locations","https://www.glueckkanja.com/en/company/contact-and-locations",[127,129,131],{"title":128,"url":119,"target":42},"Privatlivspolitik",{"title":130,"url":122,"target":42},"Juridisk information",{"title":132,"url":125,"target":42},"Kontakt og adresser",{"id":134,"title":135,"author":136,"body":138,"cta":853,"description":313,"eventid":853,"extension":854,"hideInRecent":855,"layout":856,"meta":857,"moment":861,"navigation":336,"path":888,"seo":889,"stem":890,"tags":891,"webcast":855,"__hash__":900},"content_da/posts/kb5127648-peap-mschapv2-eap-tls.md","KB5127648 og NTLMv1: Hvorfor PEAP-MSCHAPv2 Wi-Fi, LAN og VPN stoppede med at forbinde, og hvordan du løser det permanent",[137],"SCEPman Team",{"type":139,"value":140,"toc":835},"minimal",[141,146,150,153,159,187,191,194,243,254,257,261,264,278,281,286,300,303,307,350,354,357,420,425,434,440,460,475,478,482,508,511,515,518,605,608,612,619,623,626,658,662,701,710,714,717,720,724,770,774,829,832],[142,143,145],"h2",{"id":144},"det-korte-svar","Det korte svar",[147,148,149],"p",{},"Siden KB5127648, den kumulative opdatering fra oktober 2026 til Windows 11 24H2, 25H2 og 26H2, blokerer Windows NTLMv1-afledte legitimationsoplysninger til single sign-on som standard. Windows Server 2025 får den samme ændring med sin oktober 2026-opdatering. På enheder uden Credential Guard forbinder Wi-Fi, Ethernet (kabelbaseret 802.1X) og VPN-forbindelser, der bruger PEAP-MSCHAPv2 eller EAP-MSCHAPv2 med Windows-legitimationsoplysninger, ikke længere automatisk.",[147,151,152],{},"Hvis du sætter registreringsværdien BlockNtlmv1SSO til 0, gendannes den tidligere adfærd midlertidigt. Den permanente løsning, som Microsoft anbefaler, er certifikatbaseret godkendelse med EAP-TLS.",[147,154,155],{},[156,157,158],"strong",{},"TL;DR",[160,161,162,169,175,181],"ul",{},[163,164,165,168],"li",{},[156,166,167],{},"Hvad ændrede sig:"," Windows håndhæver nu BlockNtlmv1SSO på alle enheder, hvor en administrator ikke har konfigureret det. Microsoft annoncerede dette i Message Center-opslaget MC1508562 og dokumenterer det i KB5066470.",[163,170,171,174],{},[156,172,173],{},"Hvem rammes:"," Enheder uden Credential Guard, der bruger MS-CHAPv2-baseret single sign-on, typisk domænetilsluttede Windows-klienter.",[163,176,177,180],{},[156,178,179],{},"Hurtig workaround:"," Sæt BlockNtlmv1SSO til 0. Microsoft understreger selv, at indstillingen ikke bør bruges på lang sigt.",[163,182,183,186],{},[156,184,185],{},"Permanent løsning:"," Skift til EAP-TLS. Med SCEPman kan du gøre det uden at bygge en on-premises PKI.",[142,188,190],{"id":189},"hvad-ændrede-sig-med-kb5127648","Hvad ændrede sig med KB5127648",[147,192,193],{},"Microsoft har udfaset NTLM trin for trin. Det seneste trin rammer en protokol, som mange netværk stadig er afhængige af i dagligdagen: MS-CHAPv2. Den er bygget på NTLMv1-afledte legitimationsoplysninger, og Windows udleverer dem ikke længere til single sign-on.",[195,196,200],"div",{"className":197,"style":199},[198],"post-table","grid-column: content; overflow-x: auto;",[201,202,203,204],"table",{},"\n  ",[205,206,207,203,218,203,227,203,235],"tbody",{},[208,209,210,211,210,215,203],"tr",{},"\n    ",[212,213,214],"th",{},"Hvornår",[212,216,217],{},"Hvad skete der",[208,219,210,220,210,224,203],{},[221,222,223],"td",{},"Ultimo august 2025",[221,225,226],{},"Windows 11 24H2 og nyere begynder at auditere brug af NTLMv1-afledte legitimationsoplysninger (Event ID 4024).",[208,228,210,229,210,232,203],{},[221,230,231],{},"November 2025",[221,233,234],{},"Udrulning af auditering begynder på Windows Server 2025.",[208,236,210,237,210,240,203],{},[221,238,239],{},"13. oktober 2026",[221,241,242],{},"KB5127648 (Windows 11 24H2, 25H2, 26H2) skifter standarden fra Audit til Enforce på enheder, hvor BlockNtlmv1SSO ikke er konfigureret. Windows Server 2025 følger med sin oktober 2026-opdatering.",[147,244,245,246,253],{},"Microsoft annoncerede håndhævelsen i Message Center-opslaget MC1508562, \"Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard\". Den tekniske baggrund findes i ",[247,248,252],"a",{"href":249,"rel":250},"https://support.microsoft.com/help/5066470",[251],"nofollow","KB5066470",".",[147,255,256],{},"Microsoft betegner dette som en planlagt sikkerhedshærdende ændring, ikke et kendt problem med opdateringen. Den er med andre ord kommet for at blive.",[142,258,260],{"id":259},"er-du-påvirket","Er du påvirket?",[147,262,263],{},"Du er sandsynligvis påvirket, hvis alle følgende gælder:",[160,265,266,269,272,275],{},[163,267,268],{},"Dine enheder kører Windows 11 24H2 eller nyere, eller Windows Server 2025, med oktober 2026-opdateringen (KB5127648 på Windows 11) installeret.",[163,270,271],{},"Credential Guard er deaktiveret på disse enheder.",[163,273,274],{},"Dit Wi-Fi, Ethernet (kabelbaseret 802.1X) eller VPN bruger PEAP-MSCHAPv2 eller EAP-MSCHAPv2 med single sign-on. Dette er typisk en domænetilsluttet enhed med \"Brug automatisk mit Windows-logonnavn og -adgangskode\" aktiveret.",[163,276,277],{},"Registreringsværdien BlockNtlmv1SSO er aldrig blevet sat.",[147,279,280],{},"Du er ikke påvirket af denne ændring, hvis dine enheder allerede bruger certifikatbaseret godkendelse (EAP-TLS). Enheder med Credential Guard aktiveret blokerede allerede denne adfærd, så adgangskodebaseret SSO var allerede ikke-fungerende der. Ændringen er i Windows, så macOS-, iOS-, Android- og Linux-klienter er ikke påvirket.",[282,283,285],"h3",{"id":284},"sådan-ser-det-ud","Sådan ser det ud",[160,287,288,291,294,297],{},[163,289,290],{},"Enheder forbinder ikke længere automatisk, og brugerne får en legitimationsprompt.",[163,292,293],{},"Det virker stadig at skrive adgangskoden manuelt, men Windows kan ikke gemme den til næste gang.",[163,295,296],{},"Arbejdsgange, der tidligere forbandt uden brugerinteraktion, holder op med at fungere, for eksempel delte enheder eller kiosk-enheder og VPN-profiler, der forbinder automatisk.",[163,298,299],{},"Klienten logger Event ID 4025 (\"blokeret\") i Microsoft-Windows-NTLM/Operational. I Audit-tilstand logges Event ID 4024 i stedet.",[147,301,302],{},"Fejlen opstår på klienten, så dine RADIUS- eller NPS-logs viser måske lidt eller ingenting. Begynd fejlfinding på endpointet.",[282,304,306],{"id":305},"sådan-undersøger-du-en-enhed","Sådan undersøger du en enhed",[308,309,314],"pre",{"className":310,"code":311,"language":312,"meta":313,"style":313},"language-powershell shiki shiki-themes github-light github-dark","# Er BlockNtlmv1SSO konfigureret? (ingen værdi = Windows bruger den nye Enforce-standard)\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO\n\n# Har Windows auditeret (4024) eller blokeret (4025) NTLMv1-afledte legitimationsoplysninger?\nGet-WinEvent -LogName 'Microsoft-Windows-NTLM/Operational' -FilterXPath '*[System[(EventID=4024 or EventID=4025)]]' -MaxEvents 50\n","powershell","",[315,316,317,325,331,338,344],"code",{"__ignoreMap":313},[318,319,322],"span",{"class":320,"line":321},"line",1,[318,323,324],{},"# Er BlockNtlmv1SSO konfigureret? (ingen værdi = Windows bruger den nye Enforce-standard)\n",[318,326,328],{"class":320,"line":327},2,[318,329,330],{},"reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO\n",[318,332,334],{"class":320,"line":333},3,[318,335,337],{"emptyLinePlaceholder":336},true,"\n",[318,339,341],{"class":320,"line":340},4,[318,342,343],{},"# Har Windows auditeret (4024) eller blokeret (4025) NTLMv1-afledte legitimationsoplysninger?\n",[318,345,347],{"class":320,"line":346},5,[318,348,349],{},"Get-WinEvent -LogName 'Microsoft-Windows-NTLM/Operational' -FilterXPath '*[System[(EventID=4024 or EventID=4025)]]' -MaxEvents 50\n",[142,351,353],{"id":352},"den-hurtige-workaround-sæt-blockntlmv1sso-til-0","Den hurtige workaround: sæt BlockNtlmv1SSO til 0",[147,355,356],{},"Du kan sætte påvirkede enheder tilbage i Audit-tilstand. Windows tillader da NTLMv1-afledte legitimationsoplysninger igen og logger hvert enkelt tilfælde med Event ID 4024.",[195,358,360],{"className":359,"style":199},[198],[201,361,203,362],{},[205,363,364,203,372,203,396,203,404,203,412],{},[208,365,210,366,210,369,203],{},[212,367,368],{},"Indstilling",[212,370,371],{},"Værdi",[208,373,210,374,210,377,203],{},[221,375,376],{},"Nøgle",[221,378,379,380,383,384,386,387,389,390,392,393,395],{},"HKEY_LOCAL_MACHINE\\",[381,382],"wbr",{},"SYSTEM\\",[381,385],{},"CurrentControlSet\\",[381,388],{},"Control\\",[381,391],{},"Lsa\\",[381,394],{},"MSV1_0",[208,397,210,398,210,401,203],{},[221,399,400],{},"Værdinavn",[221,402,403],{},"BlockNtlmv1SSO",[208,405,210,406,210,409,203],{},[221,407,408],{},"Type",[221,410,411],{},"REG_DWORD",[208,413,210,414,210,417,203],{},[221,415,416],{},"Data",[221,418,419],{},"0 = Audit (tilladt, Event ID 4024), 1 = Enforce (blokeret, Event ID 4025)",[147,421,422],{},[156,423,424],{},"Kommandolinje",[308,426,428],{"className":310,"code":427,"language":312,"meta":313,"style":313},"reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO /t REG_DWORD /d 0 /f\n",[315,429,430],{"__ignoreMap":313},[318,431,432],{"class":320,"line":321},[318,433,427],{},[147,435,436,439],{},[156,437,438],{},"Intune remediation"," (kør i systemkontekst)",[308,441,443],{"className":310,"code":442,"language":312,"meta":313,"style":313},"# Detection script: compliant only if BlockNtlmv1SSO is explicitly set to 0\n$v = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -ErrorAction SilentlyContinue).BlockNtlmv1SSO\nif ($v -eq 0) { exit 0 } else { exit 1 }\n",[315,444,445,450,455],{"__ignoreMap":313},[318,446,447],{"class":320,"line":321},[318,448,449],{},"# Detection script: compliant only if BlockNtlmv1SSO is explicitly set to 0\n",[318,451,452],{"class":320,"line":327},[318,453,454],{},"$v = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -ErrorAction SilentlyContinue).BlockNtlmv1SSO\n",[318,456,457],{"class":320,"line":333},[318,458,459],{},"if ($v -eq 0) { exit 0 } else { exit 1 }\n",[308,461,463],{"className":310,"code":462,"language":312,"meta":313,"style":313},"# Remediation script\nNew-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -PropertyType DWord -Value 0 -Force | Out-Null\n",[315,464,465,470],{"__ignoreMap":313},[318,466,467],{"class":320,"line":321},[318,468,469],{},"# Remediation script\n",[318,471,472],{"class":320,"line":327},[318,473,474],{},"New-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -PropertyType DWord -Value 0 -Force | Out-Null\n",[147,476,477],{},"Til domænetilsluttede enheder bruger du et Group Policy Preferences-registreringselement med samme nøgle, værdinavn, type og data.",[282,479,481],{"id":480},"hvorfor-det-kun-er-en-workaround","Hvorfor det kun er en workaround",[160,483,484,490,496,502],{},[163,485,486,489],{},[156,487,488],{},"Det genåbner en svag vej."," Microsoft siger, at MS-CHAPv2-baserede endpoints \"er udsat for risici svarende til dem, der påvirker NTLMv1\", og råder til, at denne indstilling \"bør evalueres nøje og ikke bruges på lang sigt.\"",[163,491,492,495],{},[156,493,494],{},"Det hjælper ikke enheder med Credential Guard."," De blokerer MS-CHAPv2 SSO uanset denne indstilling.",[163,497,498,501],{},[156,499,500],{},"Offline-enheder kan ikke modtage politikker."," Enheder, der allerede har mistet netværksadgang, kan have brug for et kabelbaseret netværk eller et gæstenetværk for at modtage indstillingen.",[163,503,504,507],{},[156,505,506],{},"Afinstallation af opdateringen er ikke et alternativ."," Det efterlader dine enheder uden månedens sikkerhedsrettelser.",[147,509,510],{},"Brug workarounden til at købe tid, giv den en dokumenteret slutdato, og brug den tid på at migrere.",[142,512,514],{"id":513},"den-permanente-løsning-eap-tls-i-stedet-for-adgangskoder","Den permanente løsning: EAP-TLS i stedet for adgangskoder",[147,516,517],{},"Microsoft anbefaler at fjerne afhængigheden af MS-CHAPv2 og flytte Wi-Fi- og VPN-forbindelser til certifikatbaseret godkendelse med EAP-TLS. Enheden eller brugeren beviser da sin identitet med et certifikat og en privat nøgle i stedet for en adgangskode, og den private nøgle kan beskyttes af TPM'en.",[195,519,521],{"className":520,"style":199},[198],[201,522,203,523],{},[205,524,525,203,535,203,546,203,557,203,566,203,575,203,585,203,594],{},[208,526,210,527,210,529,210,532,203],{},[212,528],{},[212,530,531],{},"PEAP-MSCHAPv2",[212,533,534],{},"EAP-TLS",[208,536,210,537,210,540,210,543,203],{},[221,538,539],{},"Klientlegitimation",[221,541,542],{},"Adgangskode (NT-hash-baseret)",[221,544,545],{},"X.509-certifikat og privat nøgle",[208,547,210,548,210,551,210,554,203],{},[221,549,550],{},"Afhænger af NTLM-ærens kryptografi",[221,552,553],{},"Ja",[221,555,556],{},"Nej",[208,558,210,559,210,562,210,564,203],{},[221,560,561],{},"Påvirket af KB5127648 og Credential Guard",[221,563,553],{},[221,565,556],{},[208,567,210,568,210,571,210,573,203],{},[221,569,570],{},"Adgangskodeskift kan bryde forbindelsen",[221,572,553],{},[221,574,556],{},[208,576,210,577,210,580,210,582,203],{},[221,578,579],{},"Udsat for opfangning af legitimationsoplysninger og offline-crackning",[221,581,553],{},[221,583,584],{},"Ingen adgangskode at stjæle",[208,586,210,587,210,590,210,592,203],{},[221,588,589],{},"Knytter adgang til en administreret enhed",[221,591,556],{},[221,593,553],{},[208,595,210,596,210,599,210,602,203],{},[221,597,598],{},"Microsofts anbefaling",[221,600,601],{},"Migrer væk",[221,603,604],{},"Anbefalet",[147,606,607],{},"Ud over at løse nedbruddet får du en bedre brugeroplevelse og en stærkere sikkerhedsprofil.",[282,609,611],{"id":610},"hvorfor-så-mange-netværk-stadig-kører-på-adgangskoder","Hvorfor så mange netværk stadig kører på adgangskoder",[147,613,614,615,253],{},"Protokollen er ikke det svære. PKI'en er. Den klassiske opsætning inkluderer AD CS, NDES, Intune Certificate Connector, en application proxy, CRL-publicering, høj tilgængelighed og patching. Det er mange bevægelige dele bare for at lægge et certifikat på en laptop, og det er årsagen til, at mange teams har udskudt skiftet i årevis. Læs mere om det i ",[247,616,618],{"href":617},"adcs-alternatives","Microsoft ADCS Alternatives in 2026",[282,620,622],{"id":621},"hvordan-scepman-tager-pkien-ud-af-ligningen","Hvordan SCEPman tager PKI'en ud af ligningen",[147,624,625],{},"SCEPman er en Azure-native certifikatmyndighed, der kører udelukkende i din egen Azure-tenant med nøgler i Azure Key Vault.",[160,627,628,634,640,646,652],{},[163,629,630,633],{},[156,631,632],{},"Hurtig opstart:"," Deployment via Azure Marketplace, ARM-skabelon eller Terraform. De fleste teams udsteder deres første certifikat på under en time.",[163,635,636,639],{},[156,637,638],{},"Administrerede enheder:"," Microsoft Intune, Jamf Pro og andre MDM'er udsteder og fornyer enheds- og brugercertifikater automatisk via SCEP.",[163,641,642,645],{},[156,643,644],{},"Realtidsvalidering:"," Certifikater er bundet til bruger- eller enhedsobjektet og kontrolleres via OCSP. Når en identitet ændres, tilbagekaldes adgangen automatisk.",[163,647,648,651],{},[156,649,650],{},"Virker med dit netværk:"," SCEPman understøtter Cisco og Meraki, HPE Aruba, Fortinet, Juniper og andre, og fungerer med din eksisterende RADIUS-server.",[163,653,654,657],{},[156,655,656],{},"Ingen RADIUS-servere nødvendige:"," Kombineret med RADIUSaaS får du en komplet cloud-native løsning til certifikatbaseret Wi-Fi-, LAN- og VPN-adgang.",[142,659,661],{"id":660},"din-migrationssti-i-seks-trin","Din migrationssti i seks trin",[663,664,665,671,677,683,689,695],"ol",{},[163,666,667,670],{},[156,668,669],{},"Lav en opgørelse."," Find ud af, hvilke SSID'er, kabelbaserede 802.1X-politikker og VPN-profiler der stadig bruger MS-CHAPv2. Event ID 4024 og 4025 viser dig, hvilke enheder der er afhængige af det.",[163,672,673,676],{},[156,674,675],{},"Køb tid, hvor det er nødvendigt."," Sæt BlockNtlmv1SSO til 0 på kritiske enheder, men dokumentér det og giv det en slutdato.",[163,678,679,682],{},[156,680,681],{},"Deploy SCEPman"," og distribuer dets root CA-certifikat, enten via en Intune-profil for betroede certifikater eller via Group Policy.",[163,684,685,688],{},[156,686,687],{},"Rul certifikater ud."," Udsted enhedscertifikater (og brugercertifikater, hvor det er nødvendigt) via Intune, Jamf Pro eller andre MDM SCEP-profiler.",[163,690,691,694],{},[156,692,693],{},"Skift gradvist."," Aktivér EAP-TLS på din RADIUS-server (NPS, din eksisterende RADIUS eller RADIUSaaS) side om side med PEAP. Flyt derefter dine Wi-Fi-, 802.1X- og VPN-profiler til EAP-TLS én gruppe ad gangen.",[163,696,697,700],{},[156,698,699],{},"Ryd op."," Fjern MS-CHAPv2-politikkerne, og sæt derefter BlockNtlmv1SSO tilbage til 1, eller slet værdien, så Windows bruger den sikre standard igen:",[308,702,704],{"className":310,"code":703,"language":312,"meta":313,"style":313},"reg delete \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO /f\n",[315,705,706],{"__ignoreMap":313},[318,707,708],{"class":320,"line":321},[318,709,703],{},[142,711,713],{"id":712},"bundlinjen","Bundlinjen",[147,715,716],{},"Microsoft har truffet beslutningen: adgangskodebaseret netværks-SSO via MS-CHAPv2 har ingen fremtid på Windows. Du kan lappe rundt om KB5127648 i et par uger, eller du kan bruge dette øjeblik til at skifte til certifikatbaseret adgang for bestandigt.",[147,718,719],{},"Kedelig PKI. Pålidelige certifikater.",[721,722,723],"style",{},".cta.trial-cta { margin-bottom: 1.5rem; font-size: inherit; }",[147,725,726],{},[247,727,735,739],{"role":728,"className":729,"dataText":733,"href":734,"target":42},"button",[730,731,732],"cta","link","trial-cta","Prøv SCEPman gratis","https://support.scepman.com/support/tickets/new?ticket_form=trial_request_%28scepman%29",[318,736,733],{"className":737},[738],"cta__text",[318,740,746],{"className":741,"style":745},[742,743,744],"icon","icon--right","icon--arrow","--color-icon:currentColor;--icon-rotation:0deg;--icon-scale:1;",[747,748,753],"svg",{"style":749,"viewBox":750,"width":751,"height":751,"xmlns":752},"stroke:currentColor;transform:rotate(var(--icon-rotation)) scale(var(--icon-scale));","0 0 28 17","28px","http://www.w3.org/2000/svg",[754,755,757,766],"g",{"transform":756},"translate(0.75 0.75)",[758,759],"path",{"d":760,"transform":761,"fill":762,"fillRule":763,"strokeWidth":764,"strokeLineCap":765,"strokeLineJoin":765},"M0.5 0.5L26 0.5","translate(0 7)","none","evenodd","1.5","round",[758,767],{"d":768,"transform":769,"fill":762,"fillRule":763,"strokeWidth":764,"strokeLineCap":765,"strokeLineJoin":765},"M0 15L7 7.5L0 0","translate(19 0)",[142,771,51],{"id":48,"className":772},[773],"faq-heading",[195,775,779,789,797,805,813,821],{"className":776,"style":778},[777],"faq-foldable","grid-column: content;",[780,781,782,786],"details",{},[783,784,785],"summary",{},"Hvorfor beder mit Wi-Fi om en adgangskode efter installation af KB5127648?",[147,787,788],{},"KB5127648 får Windows til at blokere NTLMv1-afledte legitimationsoplysninger til single sign-on som standard. PEAP-MSCHAPv2 har netop brug for disse legitimationsoplysninger til automatisk at logge ind med dit Windows-logon, så Windows falder tilbage til en legitimationsprompt.",[780,790,791,794],{},[783,792,793],{},"Bør jeg afinstallere KB5127648?",[147,795,796],{},"Nej. Ændringen er et planlagt hærднingstrin, ikke en fejl, og afinstallation af opdateringen efterlader enheder uden månedens sikkerhedsrettelser. Brug BlockNtlmv1SSO-workarounden midlertidigt og migrer til EAP-TLS.",[780,798,799,802],{},[783,800,801],{},"Hjælper registry-workarounden på enheder med Credential Guard?",[147,803,804],{},"Nej. Credential Guard blokerer MS-CHAPv2 single sign-on uanset BlockNtlmv1SSO. Disse enheder har brug for certifikatbaseret godkendelse.",[780,806,807,810],{},[783,808,809],{},"Er macOS-, iOS-, Android- eller Linux-enheder påvirket?",[147,811,812],{},"Nej. Ændringen er i Windows. Ikke-Windows-klienter, der bruger PEAP-MSCHAPv2, fortsætter med at virke, selvom protokollens svagheder stadig gælder for dem.",[780,814,815,818],{},[783,816,817],{},"Hvorfor viser mine RADIUS- eller NPS-logs ingen fejl?",[147,819,820],{},"Windows blokerer legitimationsoplysningerne på klienten, inden godkendelsen gennemføres. Tjek i stedet Event ID 4025 i Microsoft-Windows-NTLM/Operational på enheden.",[780,822,823,826],{},[783,824,825],{},"Har jeg brug for AD CS eller en on-premises PKI til EAP-TLS?",[147,827,828],{},"Nej. SCEPman kører som certifikatmyndighed i din egen Azure-tenant og udsteder enheds- og brugercertifikater via Intune, Jamf Pro og andre MDM'er, uden AD CS eller NDES.",[721,830,831],{},"\npre {\n  grid-column: content !important;\n  box-sizing: border-box;\n  overflow-x: auto;\n  margin-bottom: 1.5rem;\n  padding: 1rem 1.25rem;\n  background: rgba(0, 0, 0, 0.04);\n  border: 1px solid rgba(0, 0, 0, 0.12);\n  font-size: 0.85rem;\n  line-height: 1.5;\n}\npre code { background: none; padding: 0; }\n.post-table { margin-bottom: 3rem; }\n.post-table table { border-collapse: collapse; width: 100%; }\n.post-table th,\n.post-table td {\n  border: 1px solid rgba(0, 0, 0, 0.15);\n  padding: 0.65rem 1rem;\n  vertical-align: top;\n  overflow-wrap: anywhere;\n  text-align: left;\n}\n.post-table th { background: rgba(0, 0, 0, 0.03); font-weight: 600; }\n.faq-heading {\n  margin-top: 4rem;\n  white-space: nowrap;\n}\n.faq-foldable {\n  margin-bottom: 4rem;\n}\n.faq-foldable details {\n  border-top: 1px solid rgba(0, 0, 0, 0.12);\n  padding: 0;\n}\n.faq-foldable details:last-of-type {\n  border-bottom: 1px solid rgba(0, 0, 0, 0.12);\n}\n.faq-foldable summary {\n  list-style: none;\n  cursor: pointer;\n  display: flex;\n  justify-content: space-between;\n  align-items: center;\n  gap: 1rem;\n  padding: 1rem 0;\n  font-weight: 600;\n}\n.faq-foldable summary::-webkit-details-marker {\n  display: none;\n}\n.faq-foldable summary::after {\n  content: \"\";\n  flex: 0 0 auto;\n  width: 1.5rem;\n  height: 0.75rem;\n  background: currentColor;\n  -webkit-mask: url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 12'%3E%3Cpolyline fill='none' stroke='%23000' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round' points='1.5 1.5 12 10.5 22.5 1.5'/%3E%3C/svg%3E\") center / contain no-repeat;\n  mask: url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 12'%3E%3Cpolyline fill='none' stroke='%23000' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round' points='1.5 1.5 12 10.5 22.5 1.5'/%3E%3C/svg%3E\") center / contain no-repeat;\n  transition: transform 0.5s cubic-bezier(0.19, 1, 0.2, 1);\n}\n.faq-foldable details[open] summary::after {\n  transform: rotate(180deg);\n}\n.faq-foldable details > *:not(summary) {\n  margin-bottom: 1rem;\n}\n.faq-foldable details[open] summary {\n  padding-bottom: 0.5rem;\n}\n",[721,833,834],{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":313,"searchDepth":327,"depth":327,"links":836},[837,838,839,843,846,850,851,852],{"id":144,"depth":327,"text":145},{"id":189,"depth":327,"text":190},{"id":259,"depth":327,"text":260,"children":840},[841,842],{"id":284,"depth":333,"text":285},{"id":305,"depth":333,"text":306},{"id":352,"depth":327,"text":353,"children":844},[845],{"id":480,"depth":333,"text":481},{"id":513,"depth":327,"text":514,"children":847},[848,849],{"id":610,"depth":333,"text":611},{"id":621,"depth":333,"text":622},{"id":660,"depth":327,"text":661},{"id":712,"depth":327,"text":713},{"id":48,"depth":327,"text":51},null,"md",false,"post",{"lang":858,"seoTitle":859,"titleClass":860,"date":861,"categories":862,"blogtitlepic":863,"socialimg":864,"customExcerpt":865,"keywords":866,"asideNav":867,"maxContent":336,"footer":887},"da","PEAP-MSCHAPv2 Wi-Fi fejler efter KB5127648: Workaround og løsning","h2-font-size","2026-10-16",[13],"header-scepman-KB5127648.png","/blog/heads/header-scepman-KB5127648.png","KB5127648 blokerer NTLMv1 SSO som standard. Hvorfor PEAP-MSCHAPv2 Wi-Fi, LAN og VPN fejler, BlockNtlmv1SSO-workaround og den permanente løsning: EAP-TLS.","KB5127648 PEAP, BlockNtlmv1SSO, PEAP-MSCHAPv2 Windows 11, NTLMv1 SSO, MS-CHAPv2 deprecation, Event ID 4025, MC1508562, KB5066470, EAP-TLS Intune, 802.1X Wi-Fi not connecting, WPA2-Enterprise Windows update, Credential Guard MS-CHAPv2",{"menuItems":868},[869,871,873,875,878,881,883,885],{"href":870,"text":145},"#det-korte-svar",{"href":872,"text":190},"#hvad-ændrede-sig-med-kb5127648",{"href":874,"text":260},"#er-du-påvirket",{"href":876,"text":877},"#den-hurtige-workaround-sæt-blockntlmv1sso-til-0","Den hurtige workaround",{"href":879,"text":880},"#den-permanente-løsning-eap-tls-i-stedet-for-adgangskoder","Den permanente løsning",{"href":882,"text":661},"#din-migrationssti-i-seks-trin",{"href":884,"text":713},"#bundlinjen",{"href":886,"text":51},"#faq",{"noMargin":336},"/posts/kb5127648-peap-mschapv2-eap-tls",{"title":135,"description":313},"posts/kb5127648-peap-mschapv2-eap-tls",[892,893,894,895,534,896,897,898,899],"KB5127648","NTLMv1","MS-CHAPv2","PEAP","Credential Guard","802.1X","Intune","RADIUS","kPQpTdNMLoGjnRW62Sf7Ac7gpS6E5Y0LBduj0REDR1g",{"id":902,"extension":903,"meta":904,"stem":983,"__hash__":984},"authors_data/authors.json","json",{"path":905,"Alexander Rudolph":906,"Sophie Luna":912,"Nadine Kern":918,"Thorben Pöschus":924,"Karsten Kleinschmidt":930,"Julian Wendt":936,"Holger Bunkradt":941,"Ralf Mania":947,"Oliver Kieselbach":953,"Steffen Schwerdtfeger":959,"Christoph Hannebauer":965,"body":970,"title":982},"/authors",{"display_name":907,"avatar":908,"permalink":909,"twitter":910,"linkedin":911},"Alexander Rudolph","people/people-alexander-rudolph.png","author/alexander-rudolph/","AlexanderOnIT","rudolph-alexander",{"display_name":913,"avatar":914,"permalink":915,"twitter":916,"linkedin":917},"Sophie Luna","c_thumb,h_1600,w_1600/people/people-sophie-luna.jpg","author/sophie-luna/","glueckkanjagab","company/glueckkanja-gab",{"display_name":919,"avatar":920,"permalink":921,"twitter":922,"linkedin":923},"Nadine Kern","people/people-nadine-kern.png","author/nadine-kern/","nadineausRT","nadine-kern",{"display_name":925,"avatar":926,"permalink":927,"twitter":928,"linkedin":929},"Thorben Pöschus","people/people-thorben-poeschus.png","author/thorben-poeschus/","TPO901","thorben-pöschus-624693b7",{"display_name":931,"avatar":932,"permalink":933,"twitter":934,"linkedin":935},"Karsten Kleinschmidt","people/people-karsten-kleinschmidt.png","author/karsten-kleinschmidt/","KarstenonIT","karstenkleinschmidt",{"display_name":937,"avatar":938,"permalink":939,"linkedin":940},"Julian Wendt","people/people-julian-wendt.png","author/julian-wendt/","julian-wendt",{"display_name":942,"avatar":943,"permalink":944,"linkedin":945,"twitter":946},"Holger Bunkradt","people/people-holger-bunkradt.png","author/holger-bunkradt/","holger-bunkradt-12b5053b","hbunkradt",{"display_name":948,"avatar":949,"permalink":950,"linkedin":951,"twitter":952},"Ralf Mania","people/people-ralf-mania.png","author/ralf-mania/","ralf-mania-146a2757","RaMa1976",{"display_name":954,"avatar":955,"permalink":956,"linkedin":957,"twitter":958},"Oliver Kieselbach","people/people-oliver-kieselbach.png","author/oliver-kieselbach/","oliver-kieselbach-a4a3409","okieselbT",{"display_name":960,"avatar":961,"permalink":962,"linkedin":963,"twitter":964},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","author/steffen-schwerdtfeger/","steffen-schwerdtfeger","SteffenAtCloud",{"display_name":966,"avatar":967,"permalink":968,"twitter":916,"linkedin":917,"imageOffsetTop":969},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer/","72%",{"Alexander Rudolph":971,"Sophie Luna":972,"Nadine Kern":973,"Thorben Pöschus":974,"Karsten Kleinschmidt":975,"Julian Wendt":976,"Holger Bunkradt":977,"Ralf Mania":978,"Oliver Kieselbach":979,"Steffen Schwerdtfeger":980,"Christoph Hannebauer":981},{"display_name":907,"avatar":908,"permalink":909,"twitter":910,"linkedin":911},{"display_name":913,"avatar":914,"permalink":915,"twitter":916,"linkedin":917},{"display_name":919,"avatar":920,"permalink":921,"twitter":922,"linkedin":923},{"display_name":925,"avatar":926,"permalink":927,"twitter":928,"linkedin":929},{"display_name":931,"avatar":932,"permalink":933,"twitter":934,"linkedin":935},{"display_name":937,"avatar":938,"permalink":939,"linkedin":940},{"display_name":942,"avatar":943,"permalink":944,"linkedin":945,"twitter":946},{"display_name":948,"avatar":949,"permalink":950,"linkedin":951,"twitter":952},{"display_name":954,"avatar":955,"permalink":956,"linkedin":957,"twitter":958},{"display_name":960,"avatar":961,"permalink":962,"linkedin":963,"twitter":964},{"display_name":966,"avatar":967,"permalink":968,"twitter":916,"linkedin":917,"imageOffsetTop":969},"Authors","authors","PIJJchcHqfzD5YPmn4V8YLxY6gtySOfBG5u8lTczi2w",{"id":902,"extension":903,"meta":986,"stem":983,"__hash__":984},{},{"list":988,"authors":1104},[989,994,1013,1029,1043,1056,1068,1080,1092],{"id":134,"title":135,"author":990,"cta":853,"description":313,"hideInRecent":855,"layout":856,"meta":991,"moment":861,"path":888,"stem":890,"tags":993,"webcast":855},[137],{"lang":858,"date":861,"categories":992,"blogtitlepic":863,"customExcerpt":865},[13],[892,893,894,895,534,896,897,898,899],{"id":995,"title":996,"author":997,"cta":853,"description":999,"hideInRecent":855,"layout":856,"meta":1000,"moment":1001,"path":1005,"stem":1006,"tags":1007,"webcast":855},"content_da/posts/private-ca-vs-public-ca.md","Private vs. offentlige CA'er: du bruger måske den forkerte",[998],"Kevin Vo","For et presset it-team ligner en offentlig certifikatmyndighed (CA) tit en hammer, og så ligner ethvert krav om kryptering et søm. Men at bruge en offentlig CA til alting er en af de mest udbredte måder at ødelægge produktionen på, uden at nogen opdager det.",{"lang":858,"date":1001,"categories":1002,"blogtitlepic":1003,"customExcerpt":1004},"2026-08-24",[13],"header-scepman-private-vs-public-ca.png","Certifikater fra offentlige CA'er mister understøttelsen af klientautentificering inden marts 2027. Se, hvornår en privat CA er nødvendig, og hvordan SCEPman automatiserer udstedelsen.","/posts/private-ca-vs-public-ca","posts/private-ca-vs-public-ca",[1008,1009,1010,1011,1012],"Private CA","Public CA","PKI","Client Authentication","Certificate Authority",{"id":1014,"title":1015,"author":1016,"cta":853,"description":1017,"hideInRecent":855,"layout":856,"meta":1018,"moment":1019,"path":1023,"stem":1024,"tags":1025,"webcast":855},"content_da/posts/adcs-alternatives.md","Alternativer til Microsoft ADCS i 2026",[137],"Microsoft Active Directory Certificate Services, også kendt som ADCS, ADCA eller Microsoft CA, har i årevis været standard-PKI'en i Windows-miljøer. Mange organisationer bruger den stadig til at udstede certifikater til brugere, enheder og servere.",{"lang":858,"date":1019,"categories":1020,"blogtitlepic":1021,"customExcerpt":1022},"2026-05-01",[13],"header-scepman-adcs-alternatives.png","Leder du efter alternativer til ADCS, ADCA eller Microsoft CA? Active Directory Certificate Services tilfører en kompleksitet, moderne miljøer ikke har brug for. Her er, hvad du skal se efter i en erstatning.","/posts/adcs-alternatives","posts/adcs-alternatives",[1026,1027,1010,1028],"ADCS","Alternatives","Active Directory Certificate Services",{"id":1030,"title":1031,"author":1032,"cta":853,"description":1033,"hideInRecent":855,"layout":856,"meta":1034,"moment":1019,"path":1038,"stem":1039,"tags":1040,"webcast":855},"content_da/posts/microsoft-cloud-pki-alternatives.md","Alternativer til Microsoft Cloud PKI i 2026",[137],"Microsoft Cloud PKI er lavet til at udstede certifikater til Intune-administrerede enheder. Det fungerer godt til administration af mobile enheder og endepunkter i miljøer med Microsoft i centrum.",{"lang":858,"date":1019,"categories":1035,"blogtitlepic":1036,"customExcerpt":1037},[13],"header-scepman-cloud-pki-alternatives.png","Leder du efter alternativer til Microsoft Cloud PKI? Cloud PKI dækker kun Intune-administrerede enheder, altså ingen Linux, ingen servere, ingen IoT. Her er, hvor det kommer til kort, og hvad du skal se efter i en erstatning.","/posts/microsoft-cloud-pki-alternatives","posts/microsoft-cloud-pki-alternatives",[1041,1027,1042,1010],"Microsoft Cloud PKI","Microsoft Intune",{"id":1044,"title":1045,"author":1046,"cta":853,"description":313,"hideInRecent":855,"layout":856,"meta":1047,"moment":1048,"path":1052,"stem":1053,"tags":1054,"webcast":855},"content_da/posts/microsoft-cloud-pki-iot-certificates.md","Sådan laver du IoT-certifikater med Microsoft Cloud PKI: dine alternativer og løsninger",[137],{"lang":858,"date":1048,"categories":1049,"blogtitlepic":1050,"customExcerpt":1051},"2026-03-25",[13],"header-scepman-iot-certificates.png","Leder du efter en måde at lave og administrere certifikater til IoT-enheder med Microsoft Cloud PKI? Desværre understøtter Microsoft Cloud PKI ikke IoT-certifikater. Den understøtter efter design kun Intune-administrerede enheder.","/posts/microsoft-cloud-pki-iot-certificates","posts/microsoft-cloud-pki-iot-certificates",[1041,1055,1042],"IoT Certificates",{"id":1057,"title":1058,"author":1059,"cta":853,"description":313,"hideInRecent":855,"layout":856,"meta":1060,"moment":1048,"path":1064,"stem":1065,"tags":1066,"webcast":855},"content_da/posts/microsoft-cloud-pki-linux-certificates.md","Sådan laver du certifikater til Linux-endepunkter med Microsoft Cloud PKI: dine alternativer og løsninger",[137],{"lang":858,"date":1048,"categories":1061,"blogtitlepic":1062,"customExcerpt":1063},[13],"header-scepman-linux-endpoint-certificates.png","Leder du efter en løsning til at lave og administrere certifikater til Linux-endepunkter med Microsoft Cloud PKI? Desværre understøtter Microsoft Cloud PKI ikke certifikater til Linux-endepunkter.","/posts/microsoft-cloud-pki-linux-certificates","posts/microsoft-cloud-pki-linux-certificates",[1041,1067,1042],"Linux Endpoint Certificates",{"id":1069,"title":1070,"author":1071,"cta":853,"description":313,"hideInRecent":855,"layout":856,"meta":1072,"moment":1048,"path":1076,"stem":1077,"tags":1078,"webcast":855},"content_da/posts/microsoft-cloud-pki-manually-issuing-certificates.md","Sådan udsteder du certifikater manuelt med Microsoft Cloud PKI: dine alternativer og løsninger",[137],{"lang":858,"date":1048,"categories":1073,"blogtitlepic":1074,"customExcerpt":1075},[13],"header-scepman-manual-certificates.png","Har du brug for at udstede certifikater manuelt til bestemte scenarier, for eksempel sikring af webservere, kodesignering eller andre formål? Desværre understøtter Microsoft Cloud PKI ikke manuel certifikatudstedelse. Den understøtter efter design kun Intune-administrerede enheder.","/posts/microsoft-cloud-pki-manually-issuing-certificates","posts/microsoft-cloud-pki-manually-issuing-certificates",[1041,1079,1042],"Manually Issued Certificates",{"id":1081,"title":1082,"author":1083,"cta":853,"description":313,"hideInRecent":855,"layout":856,"meta":1084,"moment":1048,"path":1088,"stem":1089,"tags":1090,"webcast":855},"content_da/posts/microsoft-cloud-pki-network-device-certificates.md","Sådan laver du certifikater til netværksenheder med Microsoft Cloud PKI: dine alternativer og løsninger",[137],{"lang":858,"date":1048,"categories":1085,"blogtitlepic":1086,"customExcerpt":1087},[13],"header-scepman-certificates-network-devices.png","Leder du efter en løsning til at lave og administrere certifikater til netværksenheder med Microsoft Cloud PKI? Desværre understøtter Microsoft Cloud PKI ikke certifikater til netværksenheder. Den understøtter efter design kun Intune-administrerede enheder.","/posts/microsoft-cloud-pki-network-device-certificates","posts/microsoft-cloud-pki-network-device-certificates",[1041,1091,1042],"Network Device Certificates",{"id":1093,"title":1094,"author":1095,"cta":853,"description":313,"hideInRecent":855,"layout":856,"meta":1096,"moment":1048,"path":1100,"stem":1101,"tags":1102,"webcast":855},"content_da/posts/microsoft-cloud-pki-server-certificates.md","Sådan laver du servercertifikater med Microsoft Cloud PKI: alternativer og løsninger",[137],{"lang":858,"date":1048,"categories":1097,"blogtitlepic":1098,"customExcerpt":1099},[13],"header-scepman-server-certificates.png","Leder du efter en måde at lave servercertifikater med Microsoft Cloud PKI? Mange organisationer bruger Microsofts PKI-løsninger til certifikathåndtering, men der er en væsentlig begrænsning: Microsoft Cloud PKI understøtter ikke servercertifikater. Den understøtter efter design kun Intune-administrerede enheder.","/posts/microsoft-cloud-pki-server-certificates","posts/microsoft-cloud-pki-server-certificates",[1041,1103,1042],"Server Certificates",{},1792170594806]