Credential Guard is a powerful security mechanism against Man-in-the-Middle attacks (https://en.wikipedia.org/wiki/Man-in-the-middle_attack) that have become more common with the rise of the Cryptolocker ransomware.

The service enables virtualization-based security by using the Windows Hypervisor to support security services on the device.

Microsoft makes this available to all their customers running Windows 10 on supported devices (https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements), and it is fairly simple to implement (https://msendpointmgr.com/2016/06/15/enable-credential-guard-in-windows-10-during-osd-with-configmgr/).

But it turns out that enabling the service will prevent the authentication supplicant in Windows 10 from sending the user's credentials to the Cisco ISE RADIUS service (or ANY RADIUS server for that matter).

So if you have enabled Credential Guard in Windows 10 and have a network security mechanism like Cisco ISE or just plain Enterprise WPA2 - then you WILL run into issues if you have set your authentication method to PEAP (EAP-MSCHAPv2).

And you will notice a lot of entries in the Cisco ISE live authentications view, similar to this:

Unfortunately, a fix from either Cisco or Microsoft does not seem available at the time of writing this, so switching over to a certificate or smart-card based authentication is the only option short of disabling Credential Guard.

And it might never get "fixed" since Credential Guard was developed to secure against tools like Mimikatz, which basically does the same thing as PEAP authentication - namely passing the users hashed credentials.

Let's hope an alternative comes along in the future. As the PEAP option does provide some flexibility over using certificates, albeit being slower to authenticate. Though I doubt it as this is the price of added security. And PEAP is not as safe as some might think.

That's why I recommend using certificate-based authentication with User certificates, which can be distributed either through Group Policy or via Microsoft Intune, leveraging SCEP (https://msendpointmgr.com/2018/06/22/certificate-deployment-for-mobile-devices-using-microsoft-intune-part-3-install-ndes/).

Below is a sample of the steps that occur in Cisco ISE when the client tries to connect and fails:

Please note that this is not a bug! It will affect any authentication using PEAP as this is the design of Credential Guard - so you might want to consider this problem if you have other services that rely on PEAP, and experience issues after enabling Credential Guard.

Read more about this new security mechanism here: https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard