Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Is Making Enterprise Wi-Fi Authentication Mandatory
Transcript
- Lucas: If your IT team still has a pre-shared key taped to the breakroom whiteboard, Windows 11's next feature update is going to force a serious conversation about enterprise Wi-Fi security. Luna: I feel like every few months there's another Wi-Fi mandate coming down the pipe. What's changing this time? Lucas: So with the 25H2 update — which is expected to start rolling out later this year — Microsoft is making WPA3-Enterprise with 802.1X authentication the default requirement for new wireless networks configured through Group Policy. Basically, if you're deploying a new Wi-Fi profile across your fleet, Windows will reject anything using WPA2-TKIP or even WPA2-AES with a pre-shared key unless you explicitly override it. The default security template shifts. Luna: That's a big deal for any organization that still has older access points or IoT devices that don't support WPA3. And I imagine a lot of small to medium businesses are in that exact spot. Lucas: Honestly, if today's tech conversation gave you something usable, and you're the kind of person who'd like to see us keep doing this without running ads, there's a link that makes that really easy — buy me a coffee dot com slash fexingo. It's a simple way to say this episode was worth a coffee to you, and it genuinely helps keep the show independent. Luna: Yeah, we appreciate every bit of support. It lets us dig into these details without worrying about sponsors. Lucas: So back to the Wi-Fi shift. The key date to watch is the release of 25H2 to the Windows Server update channel, which typically prefigures what hits Windows 11 enterprise. Microsoft has been signaling this for a while — they deprecated WPA2-TKIP in Windows 10 1903, but this is the first time they're making the authentication method itself a compliance requirement at the policy level. Luna: Right, so it's not just a recommendation anymore. If an IT admin creates a new Wi-Fi profile in Group Policy and picks WPA2-PSK, what actually happens? Lucas: The policy will apply, but the client will fall back to a lower security state and log a warning in the event viewer. For a strict security admin, that warning is a red flag during compliance audits. Microsoft's guidance is to move to WPA3-Enterprise with 802.1X, which means every device needs a certificate — either from an internal CA or a public provider. That's a non-trivial lift. Luna: Especially for things like printers, badge scanners, or HVAC controllers that are still running some embedded version of Windows IoT or even Linux. Getting certificates onto those is a whole project. Lucas: Exactly. And Microsoft knows that, so they've included a transitional policy setting called 'WPA2-AES with 802.1X' that's still allowed in the default template — but it's flagged as deprecated. So you get a yellow banner in the Group Policy editor. The message is clear: start testing WPA3 now. Luna: Is there any actual security vulnerability that drove this, or is it more about aligning with industry standards? Lucas: Both, honestly. WPA2-TKIP has been broken since 2008 with the Beck-Tews attack. Even WPA2-AES is vulnerable to KRACK attacks if the client doesn't implement fixes properly. WPA3 introduces SAE — Simultaneous Authentication of Equals — which provides forward secrecy. So even if an attacker captures the handshake, they can't decrypt past traffic. Microsoft's enterprise customers have been asking for stronger defaults for years. Luna: I remember reading that the NSA actually recommended deprecating WPA2-TKIP back in 2021 for government systems. So this feels like Microsoft catching up to that guidance. Lucas: Yeah, the NSA's Commercial National Security Algorithm suite basically says no TKIP, no WEP, no pre-shared keys for classified networks. Microsoft's move extends that logic to the broader enterprise. The interesting wrinkle is that 25H2 will also change the default for the 'wireless network policy' extension in Group Policy. Until now, if you didn't explicitly define a security type, it would default to WPA2-AES. After 25H2, the default becomes WPA3-Enterprise. Luna: That's going to break a lot of existing deployments if the policy refreshes and the access point doesn't support WPA3. Do you think most IT teams are aware of this? Lucas: Probably not. A lot of organizations set their Wi-Fi policies years ago and haven't touched them. I've seen audits where the same WPA2-PSK profile has been pushed to thousands of machines since Windows 7. The change is only for newly created policies — existing ones remain untouched — but when they go to add a new SSID or update the policy, they'll hit the new defaults. Luna: So what's the practical advice for IT teams listening? Where should they start? Lucas: First, audit your access point inventory. If any of your APs don't support WPA3, you need a hardware upgrade plan. Second, stand up or renew your internal certificate authority if you don't already have one for 802.1X. Third, test a pilot group with WPA3-Enterprise on a separate SSID before the update rolls out. Microsoft publishes a detailed deployment guide for WPA3 migration — I'd start there. Luna: And for the devices that genuinely can't do WPA3 — like some older IoT or embedded systems — is there a workaround? Lucas: Microsoft's official stance is to isolate those devices on a separate VLAN with its own SSID that still uses WPA2-AES with 802.1X, and apply strict firewall rules to limit their access. You can also use a dedicated Group Policy that targets only those devices and overrides the default. But the deprecation timeline is clear: in a future release, that override may disappear. Luna: I've also heard that some organizations are using Wi-Fi 6E or Wi-Fi 7 access points that require WPA3 anyway. So this might actually accelerate adoption of newer hardware. Lucas: Absolutely. The Wi-Fi Alliance made WPA3 mandatory for Wi-Fi 6E certification, so if you bought new APs in the last two years, you're probably already covered. The bottleneck is the client devices — especially older laptops or thin clients that might not have WPA3 drivers. Intel and Qualcomm have been shipping WPA3 support in their wireless adapters since 2020, but there are still plenty of machines from 2018 or 2019 that don't. Luna: So the real cost isn't the software change — it's the hardware refresh cycle. And that's a budget conversation that needs to happen before 25H2 hits. Lucas: Exactly. The good news is that Microsoft has been pretty transparent about this timeline. They published a deprecation notice in Windows 11 22H2, they added the warning banner in 23H2, and now 25H2 is the enforcement point. No one should be surprised. But in practice, IT teams are stretched thin, and Wi-Fi security often takes a backseat to patching or app compatibility. Luna: One thing I find interesting is that this change also affects Windows 10 Enterprise devices that are managed by the same Group Policy. Even if you haven't moved to Windows 11, the policy update can still apply to your Windows 10 machines — assuming they're on a supported build. Lucas: Great point. Group Policy is central, so if your domain controllers push the new template, Windows 10 clients will also see the new default. Microsoft's documentation says the policy applies to Windows 10 version 2004 and later, so any machine still on 21H2 or something older might not get the new defaults. But that's a shrinking pool. Luna: Let's talk about the certificate piece for a moment. For a company that's never done 802.1X, setting up a PKI is a significant project. Do you see this pushing more enterprises toward cloud-managed Wi-Fi solutions like Meraki or Aruba Central that handle the certificate lifecycle automatically? Lucas: I think it will accelerate that trend. Cloud-managed networking platforms often include built-in certificate authority services that integrate with Microsoft's NDES or SCEP. That lowers the barrier significantly. But for on-premises shops, there's still the option of using Microsoft's own Active Directory Certificate Services. It's just that configuring it correctly — especially for auto-enrollment and revocation — is non-trivial. Luna: So the real takeaway is: test early, test often, and don't assume your existing Wi-Fi policy will survive the next Windows update intact. Lucas: Exactly. The clock is ticking. 25H2 is expected to enter broad preview around September 2026, with general availability in October or November. That gives most IT teams about four to five months to audit, test, and migrate. If you're still using pre-shared keys for anything other than a guest network, now is the time to start planning your move to WPA3-Enterprise.