Can NPS authenticate non-Domain computers via EAP-TLS?

Hello Alex Wu,

Thank you for posting in Q&A forum.

Yes, NPS can support EAP-TLS for non-domain joined computers using computer certificates. But there are a few things to consider and set up to get this working smoothly:

1. The client devices must have a valid computer certificate issued by a trusted Certificate Authority (CA). The NPS server must trust the CA that issued the client certificates. This typically involves installing the CA's root certificate on the NPS server.
2. You need to configure NPS to accept EAP-TLS authentication. This involves setting up the appropriate network policies and connection request policies. Ensure that the EAP type (EAP-TLS) is supported by both the client devices and the NPS policy.
3. For non-domain joined devices, you can use certificate mapping to associate the certificate with a user or computer account in Active Directory. This is not mandatory but can help in managing access control. Alternatively, you can configure NPS to accept certificates based on specific attributes, such as the Subject Alternative Name (SAN) value.
4. Create policies in NPS that match the conditions for non-domain joined devices. This might include specifying the SSID for Wi-Fi connections or other relevant parameters. Ensure that the policies are correctly set up to handle the authentication requests from non-domain joined devices.
5. If you encounter issues, check the NPS logs for detailed error messages. Common issues include mismatched certificates, incorrect policy configurations, or missing CA certificates.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

I'm on the same boat as the OP and hate to see answers without specific guidance.

1. Our non-domain devices have a valid client authentication cert from our CA.
   1. The cert on the device has both the subject name and SAN with the device FQDN.
2. The CA is trusted by the NPS server.
3. The NPS policy is configured for EAP-TLS with the EAP Auth set to 'Microsoft: Smart Card or other certificate. Besides that, the only other condition is the NAS port type, set to the appropriate wireless types.

Despite all this, the devices cannot connect to the Wifi network using it's certificate. NPS is still trying to match the device with an AD account and rejects the auth request. The audit logs simply stating 'The specified user account does not exist.'

Here's my problem with the answer provided here by the MS people:

1. "Alternatively, you can configure NPS to accept certificates based on specific attributes, such as the Subject Alternative Name (SAN) value." No links, no guidance on how this is accomplished. I'm yet to find anything in the NPS policies related to this.
2. "Ensure that the policies are correctly set up to handle the authentication requests from non-domain joined devices." Meaning what? Again, no specifics. I've made this policy as vanilla as I can.

Countless other searches have provided similar outcomes. So I'm calling bs on the notion that NPS can authenticate non-domain devices just using device certificates. It still wants an AD object associated with it.