[{"data":1,"prerenderedAt":1116},["ShallowReactive",2],{"sc:header-data-en":3,"sc:footer-data-en":95,"post-en--posts-kb5127648-peap-mschapv2-eap-tls-e5015173d9a57":126,"authors_data":898,"authors_data:SCEPman Team":982,"content-en-list-7b291c2dd91a4":984},{"lang":4,"home":5,"navigation":14},"en",{"name":6,"imgLight":7,"img":8,"languages":9},"home","/products/scepman/scepman-logo-all-white.svg","/products/scepman/scepman-logo-rgb.svg",{"en":10},{"title":11,"url":12,"alt":13},"Home","/en","SCEPman",[15,19,25,31,83,89],{"name":16,"languages":17},"nav-home",{"en":18},{"title":11,"url":12},{"name":20,"languages":21},"pricing",{"en":22},{"title":23,"url":24},"Pricing","/en/pricing",{"name":26,"languages":27},"partner",{"en":28},{"title":29,"url":30},"Partner","/en/partner",{"name":32,"languages":33,"children":36},"support-hub",{"en":34},{"title":35},"Support Hub",[37,53,68],{"name":38,"children":39},"support-hub-group-1",[40,47],{"name":41,"target":42,"languages":43},"docs","_blank",{"en":44},{"title":45,"url":46},"Docs","https://docs.scepman.com/",{"name":48,"languages":49},"faq",{"en":50},{"title":51,"url":52},"FAQ","/en/faq",{"name":54,"children":55},"support-hub-group-2",[56,62],{"name":57,"target":42,"languages":58},"support-ticket",{"en":59},{"title":60,"url":61},"Support Ticket","https://support.scepman.com/support/tickets/new?ticket_form=technical_support_request_%28scepman%29",{"name":63,"target":42,"languages":64},"drop-a-question",{"en":65},{"title":66,"url":67},"Contact Sales","https://support.scepman.com/support/tickets/new?ticket_form=drop_a_question_%28scepman%29",{"name":69,"children":70},"support-hub-group-3",[71,77],{"name":72,"languages":73},"glossary",{"en":74},{"title":75,"url":76},"Glossary","/en/glossary",{"name":78,"languages":79},"blog",{"en":80},{"title":81,"url":82},"Blog","/en/blog",{"name":84,"languages":85},"events",{"en":86},{"title":87,"url":88},"Events","/en/events",{"name":90,"languages":91},"about",{"en":92},{"title":93,"url":94},"About us","/en/about-us",{"data":96},{"mail":97,"logos":98,"socials":103,"links":116},"sales@SCEPman.com",[99],{"img":100,"alt":101,"url":102},"/products/scepman/scepman-logo-yellow.svg","SCEPman Logo","/",[104,108,112],{"icon":105,"url":106,"title":107},"fa-x-twitter","https://twitter.com/scepman_","X",{"icon":109,"url":110,"title":111},"fa-youtube","https://www.youtube.com/channel/UCKnLYxlQFhzdXkDADV_Unrg","Youtube",{"icon":113,"url":114,"title":115},"fa-linkedin","https://www.linkedin.com/showcase/scepman","LinkedIn",[117,120,123],{"title":118,"url":119,"target":42},"Privacy","https://www.glueckkanja.com/en/privacy",{"title":121,"url":122,"target":42},"Imprint","https://www.glueckkanja.com/en/imprint",{"title":124,"url":125,"target":42},"Contact & Locations","https://www.glueckkanja.com/en/company/contact-and-locations",{"id":127,"title":128,"author":129,"body":131,"cta":846,"description":306,"eventid":846,"extension":847,"hideInRecent":848,"layout":849,"meta":850,"moment":853,"navigation":329,"path":885,"seo":886,"stem":887,"tags":888,"webcast":848,"__hash__":897},"content_en/posts/kb5127648-peap-mschapv2-eap-tls.md","KB5127648 and NTLMv1: Why PEAP-MSCHAPv2 Wi-Fi, LAN and VPN Stopped Connecting and How to Fix It for Good",[130],"SCEPman Team",{"type":132,"value":133,"toc":828},"minimal",[134,139,143,146,152,180,184,187,236,247,250,254,257,271,274,279,293,296,300,343,347,350,413,418,427,433,453,468,471,475,501,504,508,511,598,601,605,612,616,619,651,655,694,703,707,710,713,717,763,767,822,825],[135,136,138],"h2",{"id":137},"the-short-answer","The short answer",[140,141,142],"p",{},"Since KB5127648, the October 2026 cumulative update for Windows 11 24H2, 25H2 and 26H2, Windows blocks NTLMv1-derived credentials for single sign-on by default. Windows Server 2025 gets the same change with its October 2026 update. On devices without Credential Guard, Wi-Fi, Ethernet (wired 802.1X) and VPN connections that use PEAP-MSCHAPv2 or EAP-MSCHAPv2 with Windows credentials no longer connect automatically.",[140,144,145],{},"Setting the registry value BlockNtlmv1SSO to 0 restores the old behavior for now. The permanent fix Microsoft recommends is certificate-based authentication with EAP-TLS.",[140,147,148],{},[149,150,151],"strong",{},"TL;DR",[153,154,155,162,168,174],"ul",{},[156,157,158,161],"li",{},[149,159,160],{},"What changed:"," Windows now enforces BlockNtlmv1SSO on every device where an admin hasn't configured it. Microsoft announced this in Message Center post MC1508562 and documents it in KB5066470.",[156,163,164,167],{},[149,165,166],{},"Who is hit:"," Devices without Credential Guard that use MS-CHAPv2-based single sign-on, typically domain-joined Windows clients.",[156,169,170,173],{},[149,171,172],{},"Quick workaround:"," Set BlockNtlmv1SSO to 0. Microsoft itself says the setting should not be used long-term.",[156,175,176,179],{},[149,177,178],{},"Permanent fix:"," Move to EAP-TLS. With SCEPman you can do that without building an on-premises PKI.",[135,181,183],{"id":182},"what-changed-with-kb5127648","What changed with KB5127648",[140,185,186],{},"Microsoft has been phasing out NTLM step by step. The latest step hits a protocol many networks still rely on every day: MS-CHAPv2. It is built on NTLMv1-derived credentials, and Windows no longer hands those out for single sign-on.",[188,189,193],"div",{"className":190,"style":192},[191],"post-table","grid-column: content; overflow-x: auto;",[194,195,196,197],"table",{},"\n  ",[198,199,200,196,211,196,220,196,228],"tbody",{},[201,202,203,204,203,208,196],"tr",{},"\n    ",[205,206,207],"th",{},"When",[205,209,210],{},"What happened",[201,212,203,213,203,217,196],{},[214,215,216],"td",{},"Late August 2025",[214,218,219],{},"Windows 11 24H2 and later start auditing NTLMv1-derived credential use (Event ID 4024).",[201,221,203,222,203,225,196],{},[214,223,224],{},"November 2025",[214,226,227],{},"Rollout of auditing begins on Windows Server 2025.",[201,229,203,230,203,233,196],{},[214,231,232],{},"October 13, 2026",[214,234,235],{},"KB5127648 (Windows 11 24H2, 25H2, 26H2) switches the default from Audit to Enforce on devices where BlockNtlmv1SSO has not been configured. Windows Server 2025 follows with its October 2026 update.",[140,237,238,239,246],{},"Microsoft announced the enforcement in Message Center post MC1508562, \"Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard\". The technical background is in ",[240,241,245],"a",{"href":242,"rel":243},"https://support.microsoft.com/help/5066470",[244],"nofollow","KB5066470",".",[140,248,249],{},"Microsoft calls this a planned security hardening change, not a known issue with the update. In other words, it is here to stay.",[135,251,253],{"id":252},"are-you-affected","Are you affected?",[140,255,256],{},"You are likely affected if all of the following apply:",[153,258,259,262,265,268],{},[156,260,261],{},"Your devices run Windows 11 24H2 or later, or Windows Server 2025, with the October 2026 update (KB5127648 on Windows 11) installed.",[156,263,264],{},"Credential Guard is disabled on those devices.",[156,266,267],{},"Your Wi-Fi, Ethernet (wired 802.1X) or VPN uses PEAP-MSCHAPv2 or EAP-MSCHAPv2 with single sign-on. This is typically a domain-joined device with \"Automatically use my Windows logon name and password\" enabled.",[156,269,270],{},"The BlockNtlmv1SSO registry value has never been set.",[140,272,273],{},"You are not affected by this change if your devices already use certificate-based authentication (EAP-TLS). Devices with Credential Guard enabled were already blocking this behavior, so password-based SSO was already broken there. The change is in Windows, so macOS, iOS, Android and Linux clients are not affected.",[275,276,278],"h3",{"id":277},"what-it-looks-like","What it looks like",[153,280,281,284,287,290],{},[156,282,283],{},"Devices no longer connect automatically, and users get a credential prompt.",[156,285,286],{},"Typing the password manually still works, but Windows can't save it for next time.",[156,288,289],{},"Workflows that used to connect without user interaction stop working, for example shared or kiosk devices and VPN profiles that connect automatically.",[156,291,292],{},"The client logs Event ID 4025 (\"blocked\") in Microsoft-Windows-NTLM/Operational. In Audit mode it logs Event ID 4024 instead.",[140,294,295],{},"The failure happens on the client, so your RADIUS or NPS logs may show little or nothing. Start troubleshooting on the endpoint.",[275,297,299],{"id":298},"how-to-check-a-device","How to check a device",[301,302,307],"pre",{"className":303,"code":304,"language":305,"meta":306,"style":306},"language-powershell shiki shiki-themes github-light github-dark","# Is BlockNtlmv1SSO configured? (no value = Windows uses the new Enforce default)\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO\n\n# Has Windows audited (4024) or blocked (4025) NTLMv1-derived credentials?\nGet-WinEvent -LogName 'Microsoft-Windows-NTLM/Operational' -FilterXPath '*[System[(EventID=4024 or EventID=4025)]]' -MaxEvents 50\n","powershell","",[308,309,310,318,324,331,337],"code",{"__ignoreMap":306},[311,312,315],"span",{"class":313,"line":314},"line",1,[311,316,317],{},"# Is BlockNtlmv1SSO configured? (no value = Windows uses the new Enforce default)\n",[311,319,321],{"class":313,"line":320},2,[311,322,323],{},"reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO\n",[311,325,327],{"class":313,"line":326},3,[311,328,330],{"emptyLinePlaceholder":329},true,"\n",[311,332,334],{"class":313,"line":333},4,[311,335,336],{},"# Has Windows audited (4024) or blocked (4025) NTLMv1-derived credentials?\n",[311,338,340],{"class":313,"line":339},5,[311,341,342],{},"Get-WinEvent -LogName 'Microsoft-Windows-NTLM/Operational' -FilterXPath '*[System[(EventID=4024 or EventID=4025)]]' -MaxEvents 50\n",[135,344,346],{"id":345},"the-quick-workaround-set-blockntlmv1sso-to-0","The quick workaround: set BlockNtlmv1SSO to 0",[140,348,349],{},"You can put affected devices back into Audit mode. Windows then allows NTLMv1-derived credentials again and logs each use with Event ID 4024.",[188,351,353],{"className":352,"style":192},[191],[194,354,196,355],{},[198,356,357,196,365,196,389,196,397,196,405],{},[201,358,203,359,203,362,196],{},[205,360,361],{},"Setting",[205,363,364],{},"Value",[201,366,203,367,203,370,196],{},[214,368,369],{},"Key",[214,371,372,373,376,377,379,380,382,383,385,386,388],{},"HKEY_LOCAL_MACHINE\\",[374,375],"wbr",{},"SYSTEM\\",[374,378],{},"CurrentControlSet\\",[374,381],{},"Control\\",[374,384],{},"Lsa\\",[374,387],{},"MSV1_0",[201,390,203,391,203,394,196],{},[214,392,393],{},"Value name",[214,395,396],{},"BlockNtlmv1SSO",[201,398,203,399,203,402,196],{},[214,400,401],{},"Type",[214,403,404],{},"REG_DWORD",[201,406,203,407,203,410,196],{},[214,408,409],{},"Data",[214,411,412],{},"0 = Audit (allowed, Event ID 4024), 1 = Enforce (blocked, Event ID 4025)",[140,414,415],{},[149,416,417],{},"Command line",[301,419,421],{"className":303,"code":420,"language":305,"meta":306,"style":306},"reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO /t REG_DWORD /d 0 /f\n",[308,422,423],{"__ignoreMap":306},[311,424,425],{"class":313,"line":314},[311,426,420],{},[140,428,429,432],{},[149,430,431],{},"Intune remediation"," (run in system context)",[301,434,436],{"className":303,"code":435,"language":305,"meta":306,"style":306},"# Detection script: compliant only if BlockNtlmv1SSO is explicitly set to 0\n$v = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -ErrorAction SilentlyContinue).BlockNtlmv1SSO\nif ($v -eq 0) { exit 0 } else { exit 1 }\n",[308,437,438,443,448],{"__ignoreMap":306},[311,439,440],{"class":313,"line":314},[311,441,442],{},"# Detection script: compliant only if BlockNtlmv1SSO is explicitly set to 0\n",[311,444,445],{"class":313,"line":320},[311,446,447],{},"$v = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -ErrorAction SilentlyContinue).BlockNtlmv1SSO\n",[311,449,450],{"class":313,"line":326},[311,451,452],{},"if ($v -eq 0) { exit 0 } else { exit 1 }\n",[301,454,456],{"className":303,"code":455,"language":305,"meta":306,"style":306},"# Remediation script\nNew-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -PropertyType DWord -Value 0 -Force | Out-Null\n",[308,457,458,463],{"__ignoreMap":306},[311,459,460],{"class":313,"line":314},[311,461,462],{},"# Remediation script\n",[311,464,465],{"class":313,"line":320},[311,466,467],{},"New-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0' -Name 'BlockNtlmv1SSO' -PropertyType DWord -Value 0 -Force | Out-Null\n",[140,469,470],{},"For domain-joined devices, use a Group Policy Preferences registry item with the same key, value name, type and data.",[275,472,474],{"id":473},"why-its-only-a-workaround","Why it's only a workaround",[153,476,477,483,489,495],{},[156,478,479,482],{},[149,480,481],{},"It reopens a weak path."," Microsoft says MS-CHAPv2-based endpoints \"are subject to risks similar to those affecting NTLMv1\" and advises that this setting \"should be evaluated carefully and not used long-term.\"",[156,484,485,488],{},[149,486,487],{},"It doesn't help devices with Credential Guard."," They block MS-CHAPv2 SSO regardless of this setting.",[156,490,491,494],{},[149,492,493],{},"Offline devices can't receive policy."," Devices that have already lost network access may need a wired or guest network to get the setting.",[156,496,497,500],{},[149,498,499],{},"Uninstalling the update is not an alternative."," It leaves your devices without the month's security fixes.",[140,502,503],{},"Use the workaround to buy time, give it a documented end date, and use that time to migrate.",[135,505,507],{"id":506},"the-permanent-fix-eap-tls-instead-of-passwords","The permanent fix: EAP-TLS instead of passwords",[140,509,510],{},"Microsoft recommends removing the dependency on MS-CHAPv2 and moving Wi-Fi and VPN connections to certificate-based authentication with EAP-TLS. The device or user then proves its identity with a certificate and a private key instead of a password, and the private key can be protected by the TPM.",[188,512,514],{"className":513,"style":192},[191],[194,515,196,516],{},[198,517,518,196,528,196,539,196,550,196,559,196,568,196,578,196,587],{},[201,519,203,520,203,522,203,525,196],{},[205,521],{},[205,523,524],{},"PEAP-MSCHAPv2",[205,526,527],{},"EAP-TLS",[201,529,203,530,203,533,203,536,196],{},[214,531,532],{},"Client credential",[214,534,535],{},"Password (NT-hash based)",[214,537,538],{},"X.509 certificate and private key",[201,540,203,541,203,544,203,547,196],{},[214,542,543],{},"Depends on NTLM-era cryptography",[214,545,546],{},"Yes",[214,548,549],{},"No",[201,551,203,552,203,555,203,557,196],{},[214,553,554],{},"Affected by KB5127648 and Credential Guard",[214,556,546],{},[214,558,549],{},[201,560,203,561,203,564,203,566,196],{},[214,562,563],{},"Password resets can break connectivity",[214,565,546],{},[214,567,549],{},[201,569,203,570,203,573,203,575,196],{},[214,571,572],{},"Exposed to credential capture and offline cracking",[214,574,546],{},[214,576,577],{},"No password to steal",[201,579,203,580,203,583,203,585,196],{},[214,581,582],{},"Ties access to a managed device",[214,584,549],{},[214,586,546],{},[201,588,203,589,203,592,203,595,196],{},[214,590,591],{},"Microsoft's guidance",[214,593,594],{},"Migrate away",[214,596,597],{},"Recommended",[140,599,600],{},"On top of fixing the outage, you get a better user experience and a stronger security posture.",[275,602,604],{"id":603},"why-so-many-networks-still-run-on-passwords","Why so many networks still run on passwords",[140,606,607,608,246],{},"The protocol isn't the hard part. The PKI is. The classic setup includes AD CS, NDES, the Intune Certificate Connector, an application proxy, CRL publishing, high availability and patching. That's a lot of moving parts just to put a certificate on a laptop, and it's why many teams have postponed the move for years. More on this in ",[240,609,611],{"href":610},"adcs-alternatives","Microsoft ADCS Alternatives in 2026",[275,613,615],{"id":614},"how-scepman-takes-the-pki-out-of-the-equation","How SCEPman takes the PKI out of the equation",[140,617,618],{},"SCEPman is an Azure-native certificate authority that runs entirely in your own Azure tenant, with keys in Azure Key Vault.",[153,620,621,627,633,639,645],{},[156,622,623,626],{},[149,624,625],{},"Fast start:"," Deploy via Azure Marketplace, ARM template or Terraform. Most teams issue their first certificate in under an hour.",[156,628,629,632],{},[149,630,631],{},"Managed devices:"," Microsoft Intune, Jamf Pro and other MDMs issue and renew device and user certificates automatically via SCEP.",[156,634,635,638],{},[149,636,637],{},"Real-time validation:"," Certificates are bound to the user or device object and checked via OCSP. When an identity changes, access is revoked automatically.",[156,640,641,644],{},[149,642,643],{},"Works with your network:"," SCEPman supports Cisco and Meraki, HPE Aruba, Fortinet, Juniper and others, and works with your existing RADIUS server.",[156,646,647,650],{},[149,648,649],{},"No RADIUS servers needed:"," Combined with RADIUSaaS, you get a complete cloud-native solution for certificate-based Wi-Fi, LAN and VPN access.",[135,652,654],{"id":653},"your-migration-path-in-six-steps","Your migration path in six steps",[656,657,658,664,670,676,682,688],"ol",{},[156,659,660,663],{},[149,661,662],{},"Take inventory."," Find out which SSIDs, wired 802.1X policies and VPN profiles still use MS-CHAPv2. Event IDs 4024 and 4025 show you which devices depend on it.",[156,665,666,669],{},[149,667,668],{},"Buy time where needed."," Set BlockNtlmv1SSO to 0 on critical devices, but document it and give it an end date.",[156,671,672,675],{},[149,673,674],{},"Deploy SCEPman"," and distribute its root CA certificate, either through an Intune trusted certificate profile or through Group Policy.",[156,677,678,681],{},[149,679,680],{},"Roll out certificates."," Issue device certificates (and user certificates where needed) via Intune, Jamf Pro or other MDM SCEP profiles.",[156,683,684,687],{},[149,685,686],{},"Switch over gradually."," Enable EAP-TLS on your RADIUS server (NPS, your existing RADIUS or RADIUSaaS) alongside PEAP. Then move your Wi-Fi, 802.1X and VPN profiles to EAP-TLS one group at a time.",[156,689,690,693],{},[149,691,692],{},"Clean up."," Remove the MS-CHAPv2 policies, then set BlockNtlmv1SSO back to 1 or delete the value so Windows uses the secure default again:",[301,695,697],{"className":303,"code":696,"language":305,"meta":306,"style":306},"reg delete \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" /v BlockNtlmv1SSO /f\n",[308,698,699],{"__ignoreMap":306},[311,700,701],{"class":313,"line":314},[311,702,696],{},[135,704,706],{"id":705},"bottom-line","Bottom line",[140,708,709],{},"Microsoft has made the decision: password-based network SSO via MS-CHAPv2 has no future on Windows. You can patch around KB5127648 for a few weeks, or you can use this moment to move to certificate-based access for good.",[140,711,712],{},"Boring PKI. Reliable certificates.",[714,715,716],"style",{},".cta.trial-cta { margin-bottom: 1.5rem; font-size: inherit; }",[140,718,719],{},[240,720,728,732],{"role":721,"className":722,"dataText":726,"href":727,"target":42},"button",[723,724,725],"cta","link","trial-cta","Try SCEPman for free","https://support.scepman.com/support/tickets/new?ticket_form=trial_request_%28scepman%29",[311,729,726],{"className":730},[731],"cta__text",[311,733,739],{"className":734,"style":738},[735,736,737],"icon","icon--right","icon--arrow","--color-icon:currentColor;--icon-rotation:0deg;--icon-scale:1;",[740,741,746],"svg",{"style":742,"viewBox":743,"width":744,"height":744,"xmlns":745},"stroke:currentColor;transform:rotate(var(--icon-rotation)) scale(var(--icon-scale));","0 0 28 17","28px","http://www.w3.org/2000/svg",[747,748,750,759],"g",{"transform":749},"translate(0.75 0.75)",[751,752],"path",{"d":753,"transform":754,"fill":755,"fillRule":756,"strokeWidth":757,"strokeLineCap":758,"strokeLineJoin":758},"M0.5 0.5L26 0.5","translate(0 7)","none","evenodd","1.5","round",[751,760],{"d":761,"transform":762,"fill":755,"fillRule":756,"strokeWidth":757,"strokeLineCap":758,"strokeLineJoin":758},"M0 15L7 7.5L0 0","translate(19 0)",[135,764,51],{"id":48,"className":765},[766],"faq-heading",[188,768,772,782,790,798,806,814],{"className":769,"style":771},[770],"faq-foldable","grid-column: content;",[773,774,775,779],"details",{},[776,777,778],"summary",{},"Why does my Wi-Fi ask for a password after installing KB5127648?",[140,780,781],{},"KB5127648 makes Windows block NTLMv1-derived credentials for single sign-on by default. PEAP-MSCHAPv2 needs exactly those credentials to sign in automatically with your Windows logon, so Windows falls back to a credential prompt.",[773,783,784,787],{},[776,785,786],{},"Should I uninstall KB5127648?",[140,788,789],{},"No. The change is a planned hardening step, not a bug, and uninstalling the update leaves devices without that month's security fixes. Use the BlockNtlmv1SSO workaround temporarily and migrate to EAP-TLS.",[773,791,792,795],{},[776,793,794],{},"Does the registry workaround help on devices with Credential Guard?",[140,796,797],{},"No. Credential Guard blocks MS-CHAPv2 single sign-on regardless of BlockNtlmv1SSO. Those devices need certificate-based authentication.",[773,799,800,803],{},[776,801,802],{},"Are macOS, iOS, Android or Linux devices affected?",[140,804,805],{},"No. The change is in Windows. Non-Windows clients that use PEAP-MSCHAPv2 keep working, although the protocol's weaknesses still apply to them.",[773,807,808,811],{},[776,809,810],{},"Why don't my RADIUS or NPS logs show any errors?",[140,812,813],{},"Windows blocks the credential on the client before the authentication completes. Check Event ID 4025 in Microsoft-Windows-NTLM/Operational on the device instead.",[773,815,816,819],{},[776,817,818],{},"Do I need AD CS or an on-premises PKI for EAP-TLS?",[140,820,821],{},"No. SCEPman runs as a certificate authority in your own Azure tenant and issues device and user certificates via Intune, Jamf Pro and other MDMs, without AD CS or NDES.",[714,823,824],{},"\npre {\n  grid-column: content !important;\n  box-sizing: border-box;\n  overflow-x: auto;\n  margin-bottom: 1.5rem;\n  padding: 1rem 1.25rem;\n  background: rgba(0, 0, 0, 0.04);\n  border: 1px solid rgba(0, 0, 0, 0.12);\n  font-size: 0.85rem;\n  line-height: 1.5;\n}\npre code { background: none; padding: 0; }\n.post-table { margin-bottom: 3rem; }\n.post-table table { border-collapse: collapse; width: 100%; }\n.post-table th,\n.post-table td {\n  border: 1px solid rgba(0, 0, 0, 0.15);\n  padding: 0.65rem 1rem;\n  vertical-align: top;\n  overflow-wrap: anywhere;\n  text-align: left;\n}\n.post-table th { background: rgba(0, 0, 0, 0.03); font-weight: 600; }\n.faq-heading {\n  margin-top: 4rem;\n  white-space: nowrap;\n}\n.faq-foldable {\n  margin-bottom: 4rem;\n}\n.faq-foldable details {\n  border-top: 1px solid rgba(0, 0, 0, 0.12);\n  padding: 0;\n}\n.faq-foldable details:last-of-type {\n  border-bottom: 1px solid rgba(0, 0, 0, 0.12);\n}\n.faq-foldable summary {\n  list-style: none;\n  cursor: pointer;\n  display: flex;\n  justify-content: space-between;\n  align-items: center;\n  gap: 1rem;\n  padding: 1rem 0;\n  font-weight: 600;\n}\n.faq-foldable summary::-webkit-details-marker {\n  display: none;\n}\n.faq-foldable summary::after {\n  content: \"\";\n  flex: 0 0 auto;\n  width: 1.5rem;\n  height: 0.75rem;\n  background: currentColor;\n  -webkit-mask: url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 12'%3E%3Cpolyline fill='none' stroke='%23000' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round' points='1.5 1.5 12 10.5 22.5 1.5'/%3E%3C/svg%3E\") center / contain no-repeat;\n  mask: url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 12'%3E%3Cpolyline fill='none' stroke='%23000' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round' points='1.5 1.5 12 10.5 22.5 1.5'/%3E%3C/svg%3E\") center / contain no-repeat;\n  transition: transform 0.5s cubic-bezier(0.19, 1, 0.2, 1);\n}\n.faq-foldable details[open] summary::after {\n  transform: rotate(180deg);\n}\n.faq-foldable details > *:not(summary) {\n  margin-bottom: 1rem;\n}\n.faq-foldable details[open] summary {\n  padding-bottom: 0.5rem;\n}\n",[714,826,827],{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":306,"searchDepth":320,"depth":320,"links":829},[830,831,832,836,839,843,844,845],{"id":137,"depth":320,"text":138},{"id":182,"depth":320,"text":183},{"id":252,"depth":320,"text":253,"children":833},[834,835],{"id":277,"depth":326,"text":278},{"id":298,"depth":326,"text":299},{"id":345,"depth":320,"text":346,"children":837},[838],{"id":473,"depth":326,"text":474},{"id":506,"depth":320,"text":507,"children":840},[841,842],{"id":603,"depth":326,"text":604},{"id":614,"depth":326,"text":615},{"id":653,"depth":320,"text":654},{"id":705,"depth":320,"text":706},{"id":48,"depth":320,"text":51},null,"md",false,"post",{"lang":4,"seoTitle":851,"titleClass":852,"date":853,"categories":854,"blogtitlepic":855,"socialimg":856,"customExcerpt":857,"keywords":858,"asideNav":859,"maxContent":329,"footer":884},"PEAP-MSCHAPv2 Wi-Fi Fails After KB5127648: Workaround and Fix","h2-font-size","2026-10-16",[13],"header-scepman-KB5127648.png","/blog/heads/header-scepman-KB5127648.png","KB5127648 blocks NTLMv1 SSO by default. Why PEAP-MSCHAPv2 Wi-Fi, LAN and VPN fail, the BlockNtlmv1SSO workaround, and the permanent fix: EAP-TLS.","KB5127648 PEAP, BlockNtlmv1SSO, PEAP-MSCHAPv2 Windows 11, NTLMv1 SSO, MS-CHAPv2 deprecation, Event ID 4025, MC1508562, KB5066470, EAP-TLS Intune, 802.1X Wi-Fi not connecting, WPA2-Enterprise Windows update, Credential Guard MS-CHAPv2",{"menuItems":860},[861,864,867,870,873,876,879,882],{"href":862,"text":863},"#the-short-answer","The Short Answer",{"href":865,"text":866},"#what-changed-with-kb5127648","What Changed with KB5127648",{"href":868,"text":869},"#are-you-affected","Are You Affected?",{"href":871,"text":872},"#the-quick-workaround-set-blockntlmv1sso-to-0","The Quick Workaround",{"href":874,"text":875},"#the-permanent-fix-eap-tls-instead-of-passwords","The Permanent Fix",{"href":877,"text":878},"#your-migration-path-in-six-steps","Your Migration Path in Six Steps",{"href":880,"text":881},"#bottom-line","Bottom Line",{"href":883,"text":51},"#faq",{"noMargin":329},"/posts/kb5127648-peap-mschapv2-eap-tls",{"title":128,"description":306},"posts/kb5127648-peap-mschapv2-eap-tls",[889,890,891,892,527,893,894,895,896],"KB5127648","NTLMv1","MS-CHAPv2","PEAP","Credential Guard","802.1X","Intune","RADIUS","beu91W9sCA_oPqsJoFUCsstpD7SEF1OMoUwlJCtfyTo",{"id":899,"extension":900,"meta":901,"stem":980,"__hash__":981},"authors_data/authors.json","json",{"path":902,"Alexander Rudolph":903,"Sophie Luna":909,"Nadine Kern":915,"Thorben Pöschus":921,"Karsten Kleinschmidt":927,"Julian Wendt":933,"Holger Bunkradt":938,"Ralf Mania":944,"Oliver Kieselbach":950,"Steffen Schwerdtfeger":956,"Christoph Hannebauer":962,"body":967,"title":979},"/authors",{"display_name":904,"avatar":905,"permalink":906,"twitter":907,"linkedin":908},"Alexander Rudolph","people/people-alexander-rudolph.png","author/alexander-rudolph/","AlexanderOnIT","rudolph-alexander",{"display_name":910,"avatar":911,"permalink":912,"twitter":913,"linkedin":914},"Sophie Luna","c_thumb,h_1600,w_1600/people/people-sophie-luna.jpg","author/sophie-luna/","glueckkanjagab","company/glueckkanja-gab",{"display_name":916,"avatar":917,"permalink":918,"twitter":919,"linkedin":920},"Nadine Kern","people/people-nadine-kern.png","author/nadine-kern/","nadineausRT","nadine-kern",{"display_name":922,"avatar":923,"permalink":924,"twitter":925,"linkedin":926},"Thorben Pöschus","people/people-thorben-poeschus.png","author/thorben-poeschus/","TPO901","thorben-pöschus-624693b7",{"display_name":928,"avatar":929,"permalink":930,"twitter":931,"linkedin":932},"Karsten Kleinschmidt","people/people-karsten-kleinschmidt.png","author/karsten-kleinschmidt/","KarstenonIT","karstenkleinschmidt",{"display_name":934,"avatar":935,"permalink":936,"linkedin":937},"Julian Wendt","people/people-julian-wendt.png","author/julian-wendt/","julian-wendt",{"display_name":939,"avatar":940,"permalink":941,"linkedin":942,"twitter":943},"Holger Bunkradt","people/people-holger-bunkradt.png","author/holger-bunkradt/","holger-bunkradt-12b5053b","hbunkradt",{"display_name":945,"avatar":946,"permalink":947,"linkedin":948,"twitter":949},"Ralf Mania","people/people-ralf-mania.png","author/ralf-mania/","ralf-mania-146a2757","RaMa1976",{"display_name":951,"avatar":952,"permalink":953,"linkedin":954,"twitter":955},"Oliver Kieselbach","people/people-oliver-kieselbach.png","author/oliver-kieselbach/","oliver-kieselbach-a4a3409","okieselbT",{"display_name":957,"avatar":958,"permalink":959,"linkedin":960,"twitter":961},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","author/steffen-schwerdtfeger/","steffen-schwerdtfeger","SteffenAtCloud",{"display_name":963,"avatar":964,"permalink":965,"twitter":913,"linkedin":914,"imageOffsetTop":966},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer/","72%",{"Alexander Rudolph":968,"Sophie Luna":969,"Nadine Kern":970,"Thorben Pöschus":971,"Karsten Kleinschmidt":972,"Julian Wendt":973,"Holger Bunkradt":974,"Ralf Mania":975,"Oliver Kieselbach":976,"Steffen Schwerdtfeger":977,"Christoph Hannebauer":978},{"display_name":904,"avatar":905,"permalink":906,"twitter":907,"linkedin":908},{"display_name":910,"avatar":911,"permalink":912,"twitter":913,"linkedin":914},{"display_name":916,"avatar":917,"permalink":918,"twitter":919,"linkedin":920},{"display_name":922,"avatar":923,"permalink":924,"twitter":925,"linkedin":926},{"display_name":928,"avatar":929,"permalink":930,"twitter":931,"linkedin":932},{"display_name":934,"avatar":935,"permalink":936,"linkedin":937},{"display_name":939,"avatar":940,"permalink":941,"linkedin":942,"twitter":943},{"display_name":945,"avatar":946,"permalink":947,"linkedin":948,"twitter":949},{"display_name":951,"avatar":952,"permalink":953,"linkedin":954,"twitter":955},{"display_name":957,"avatar":958,"permalink":959,"linkedin":960,"twitter":961},{"display_name":963,"avatar":964,"permalink":965,"twitter":913,"linkedin":914,"imageOffsetTop":966},"Authors","authors","PIJJchcHqfzD5YPmn4V8YLxY6gtySOfBG5u8lTczi2w",{"id":899,"extension":900,"meta":983,"stem":980,"__hash__":981},{},{"list":985,"authors":1115},[986,991,1006,1025,1040,1054,1067,1079,1091,1103],{"id":127,"title":128,"author":987,"cta":846,"description":306,"hideInRecent":848,"layout":849,"meta":988,"moment":853,"path":885,"stem":887,"tags":990,"webcast":848},[130],{"lang":4,"date":853,"categories":989,"blogtitlepic":855,"customExcerpt":857},[13],[889,890,891,892,527,893,894,895,896],{"id":992,"title":993,"author":994,"cta":846,"description":995,"hideInRecent":848,"layout":849,"meta":996,"moment":997,"path":1001,"stem":1002,"tags":1003,"webcast":848},"content_en/posts/ecc-vs-rsa-for-intune-scep.md","ECC vs RSA for Intune Clients",[130],"For certificate distribution to Intune-managed clients via SCEP, SCEPman recommends RSA. As of June 2026, ECC (Elliptic Curve Cryptography) is not officially supported for this scenario.",{"lang":4,"date":997,"categories":998,"blogtitlepic":999,"customExcerpt":1000},"2026-09-23",[13],"header-scepman-ecc-vs-rsa-for-intune-clients.png","Intune's SCEP profile only supports RSA keys, not ECC. Learn why SCEP and CMS encryption block elliptic curve certificates, and where ECC still works with SCEPman.","/posts/ecc-vs-rsa-for-intune-scep","posts/ecc-vs-rsa-for-intune-scep",[1004,895,1005],"SCEP","ECC vs RSA",{"id":1007,"title":1008,"author":1009,"cta":846,"description":1011,"hideInRecent":848,"layout":849,"meta":1012,"moment":1013,"path":1017,"stem":1018,"tags":1019,"webcast":848},"content_en/posts/private-ca-vs-public-ca.md","Private vs Public CAs: You Might Be Using the Wrong One",[1010],"Kevin Vo","To an IT team under pressure, a public Certificate Authority (CA) often looks like a hammer, and every encryption requirement looks like a nail. But using a public CA for every job is one of the most common ways to quietly break production.",{"lang":4,"date":1013,"categories":1014,"blogtitlepic":1015,"customExcerpt":1016},"2026-08-24",[13],"header-scepman-private-vs-public-ca.png","Public CA certificates lose client authentication support by March 2027. See when a private CA is required, and how SCEPman automates issuance.","/posts/private-ca-vs-public-ca","posts/private-ca-vs-public-ca",[1020,1021,1022,1023,1024],"Private CA","Public CA","PKI","Client Authentication","Certificate Authority",{"id":1026,"title":611,"author":1027,"cta":846,"description":1028,"hideInRecent":848,"layout":849,"meta":1029,"moment":1030,"path":1034,"stem":1035,"tags":1036,"webcast":848},"content_en/posts/adcs-alternatives.md",[130],"Microsoft Active Directory Certificate Services — also known as ADCS, ADCA, or Microsoft CA — has been the default PKI for Windows environments for years. Many organizations still rely on it for certificate issuance across users, devices, and servers.",{"lang":4,"date":1030,"categories":1031,"blogtitlepic":1032,"customExcerpt":1033},"2026-05-01",[13],"header-scepman-adcs-alternatives.png","Looking for ADCS, ADCA, or Microsoft CA alternatives? Active Directory Certificate Services adds complexity modern environments don't need. Here's what to look for in a replacement.","/posts/adcs-alternatives","posts/adcs-alternatives",[1037,1038,1022,1039],"ADCS","Alternatives","Active Directory Certificate Services",{"id":1041,"title":1042,"author":1043,"cta":846,"description":1044,"hideInRecent":848,"layout":849,"meta":1045,"moment":1030,"path":1049,"stem":1050,"tags":1051,"webcast":848},"content_en/posts/microsoft-cloud-pki-alternatives.md","Microsoft Cloud PKI Alternatives in 2026",[130],"Microsoft Cloud PKI is designed for issuing certificates to Intune-managed devices. It works well for mobile and endpoint management in Microsoft-centric environments.",{"lang":4,"date":1030,"categories":1046,"blogtitlepic":1047,"customExcerpt":1048},[13],"header-scepman-cloud-pki-alternatives.png","Looking for Microsoft Cloud PKI alternatives? Cloud PKI only covers Intune-managed devices — no Linux, no servers, no IoT. Here's where it falls short and what to look for in a replacement.","/posts/microsoft-cloud-pki-alternatives","posts/microsoft-cloud-pki-alternatives",[1052,1038,1053,1022],"Microsoft Cloud PKI","Microsoft Intune",{"id":1055,"title":1056,"author":1057,"cta":846,"description":306,"hideInRecent":848,"layout":849,"meta":1058,"moment":1059,"path":1063,"stem":1064,"tags":1065,"webcast":848},"content_en/posts/microsoft-cloud-pki-iot-certificates.md","Creating IoT Certificates with Microsoft Cloud PKI: Your Alternatives and Solutions",[130],{"lang":4,"date":1059,"categories":1060,"blogtitlepic":1061,"customExcerpt":1062},"2026-03-25",[13],"header-scepman-iot-certificates.png","Are you looking for a way to create and manage certificates for IoT devices using Microsoft Cloud PKI? Unfortunately, Microsoft Cloud PKI does not support IoT certificates. By design it only supports Intune managed devices.","/posts/microsoft-cloud-pki-iot-certificates","posts/microsoft-cloud-pki-iot-certificates",[1052,1066,1053],"IoT Certificates",{"id":1068,"title":1069,"author":1070,"cta":846,"description":306,"hideInRecent":848,"layout":849,"meta":1071,"moment":1059,"path":1075,"stem":1076,"tags":1077,"webcast":848},"content_en/posts/microsoft-cloud-pki-linux-certificates.md","Creating Linux Endpoint Certificates with Microsoft Cloud PKI: Your Alternatives and Solutions",[130],{"lang":4,"date":1059,"categories":1072,"blogtitlepic":1073,"customExcerpt":1074},[13],"header-scepman-linux-endpoint-certificates.png","Are you searching for a solution to create and manage certificates for Linux endpoints with Microsoft Cloud PKI? Unfortunately, Microsoft Cloud PKI does not support Linux endpoint certificates.","/posts/microsoft-cloud-pki-linux-certificates","posts/microsoft-cloud-pki-linux-certificates",[1052,1078,1053],"Linux Endpoint Certificates",{"id":1080,"title":1081,"author":1082,"cta":846,"description":306,"hideInRecent":848,"layout":849,"meta":1083,"moment":1059,"path":1087,"stem":1088,"tags":1089,"webcast":848},"content_en/posts/microsoft-cloud-pki-manually-issuing-certificates.md","Manually Issuing Certificates with Microsoft Cloud PKI: Your Alternatives and Solutions",[130],{"lang":4,"date":1059,"categories":1084,"blogtitlepic":1085,"customExcerpt":1086},[13],"header-scepman-manual-certificates.png","Do you need to manually issue certificates for specific scenarios, such as securing web servers, signing code, or other use cases? Unfortunately, Microsoft Cloud PKI does not support manual certificate issuance. By design, it only supports Intune managed devices.","/posts/microsoft-cloud-pki-manually-issuing-certificates","posts/microsoft-cloud-pki-manually-issuing-certificates",[1052,1090,1053],"Manually Issued Certificates",{"id":1092,"title":1093,"author":1094,"cta":846,"description":306,"hideInRecent":848,"layout":849,"meta":1095,"moment":1059,"path":1099,"stem":1100,"tags":1101,"webcast":848},"content_en/posts/microsoft-cloud-pki-network-device-certificates.md","Creating Certificates for Network Devices with Microsoft Cloud PKI: Your Alternatives and Solutions",[130],{"lang":4,"date":1059,"categories":1096,"blogtitlepic":1097,"customExcerpt":1098},[13],"header-scepman-certificates-network-devices.png","Are you searching for a solution to create and manage certificates for network devices with Microsoft Cloud PKI? Unfortunately, Microsoft Cloud PKI does not support network devices certificates. By design it only supports Intune managed devices, only.","/posts/microsoft-cloud-pki-network-device-certificates","posts/microsoft-cloud-pki-network-device-certificates",[1052,1102,1053],"Network Device Certificates",{"id":1104,"title":1105,"author":1106,"cta":846,"description":306,"hideInRecent":848,"layout":849,"meta":1107,"moment":1059,"path":1111,"stem":1112,"tags":1113,"webcast":848},"content_en/posts/microsoft-cloud-pki-server-certificates.md","Creating Server Certificates with Microsoft Cloud PKI: Alternatives and Solutions",[130],{"lang":4,"date":1059,"categories":1108,"blogtitlepic":1109,"customExcerpt":1110},[13],"header-scepman-server-certificates.png","Are you looking for a way to create server certificates using Microsoft Cloud PKI? Many organizations rely on Microsoft's PKI solutions for certificate management, but there’s a significant limitation: Microsoft Cloud PKI does not support server certificates. By design it only supports Intune managed devices, only.","/posts/microsoft-cloud-pki-server-certificates","posts/microsoft-cloud-pki-server-certificates",[1052,1114,1053],"Server Certificates",{},1792170597507]