Check EAP profile trust after a Windows 11 upgrade

Source facts

Windows 11 applies a consistent server-certificate validation model across the EAP methods supplied with Windows, including wired, wireless, and VPN use. Microsoft notes that some Windows 10 PEAP or EAP-TLS connections could validate with only a root certificate in the trusted store; upgrade failures therefore warrant checking the connection profile. For the documented upgrade issue, specifying the root certificate thumbprint in the profile is usually sufficient when that root already exists in the trusted store. Microsoft Learn.

Applicability

Confirm that the failure concerns server validation and identify the exact profile used by the upgraded client. Read all applicable trust conditions, including configured server-name validation. Do not infer that a trusted-store entry alone satisfies the Windows 11 profile.

DSE recommendation

Compare an affected pilot profile with its intended root and server-name settings. Ask the identity and network owners to verify the certificate actually presented by the authentication service. Correct the managed profile only after that identity is established. Preserve server validation rather than disabling it to restore connectivity, and retain the original profile for comparison.

Verification

Reapply the reviewed profile and repeat the approved connection. Confirm the expected server certificate and profile trust settings, then capture the authentication result. Include a controlled wrong-server or untrusted-certificate case in the test plan so restored connectivity is not the only acceptance condition.

Official references

Microsoft Learn: EAP – What’s changed in Windows 11. Source reviewed September 8, 2026.