I'm in the process of testing Windows 11 for rollout in our organization, and I've run into a frustrating problem. My computers are not able to connect to our WiFi until after I log in, following a shutdown or start-up. Once logged in, they remain connected even after a reboot or logging off and back on. This issue hasn't occurred with Windows 10, and it seems to consistently happen—I'd estimate about 90-95% of the time.
I'm testing a variety of HP laptops, including x360 G6s and Probook 460 G11s, and have confirmed that everything works fine with a Windows 10 image. I'm using Windows 11, version 25H2, that I downloaded from our Microsoft VLSC. Interestingly, I've noticed that while it authenticates me and connects to WiFi post-login, it doesn't pull our Group Policy controlled background or icons until I've signed in. The WiFi is set up to authenticate via WPA2-Enterprise with computer authentication and it's hidden. All drivers and BIOS are current, and I've ensured that power-saving settings aren't affecting the wireless connection. Any insights into why this is happening or potential fixes would be greatly appreciated!
3 Answers
Are your machines domain-joined and using RADIUS authentication? If you're on EAP-PEAP, make sure you've got the full Credential Guard stack disabled. Sometimes, if using EAP-TLS with NPS, you need to ensure your certs are properly mapped. It's crucial that your GPO is set to authenticate using the machine's credentials when no one’s logged in.
I noticed this problem mainly with laptops that have Intel network adapters, particularly those that support 6E. I found that adjusting the network adapter settings and changing the 802.11 wireless mode for better compatibility helped fix the problem. You could try this approach to see if it works for you!
That's interesting! I switched the 802.11 mode from ax to ac, but it didn't make a difference. I'll keep exploring other options.
We had a similar issue a while back and it turned out that adjusting a Group Policy helped us out. Disabling Credential Guard through GPO made a difference for us. You can navigate to Computer Configuration > Policies > Administrative Templates > System > Device Guard and set 'Turn On Virtualization Based Security' to DISABLE. This might be worth a shot for you!
Thanks for the tip! I had actually made that change via Registry settings. I'll definitely try implementing it through GPO next time we do a deployment.
Yes, they're domain-joined, and we are indeed using PEAP for authentication. We'll definitely check the RADIUS setup, as I know our networking person was looking into it.