PRJ: MSCHAPv2 to Certificate-Based Authentication Migration

Vulnerable to offline dictionary attacks

NTLM hash can be cracked if captured

No mutual authentication by default

Credentials exposed during authentication

Strongest wireless/wired security

Mutual authentication (client + server)

No credentials transmitted over the air

Revocation capability via CRL/OCSP

ise-windows::partials/eaptls-vs-mschapv2-comparison.adoc[EAP-TLS vs MSCHAPv2]

Cisco ISE EAP-TLS Configuration Guide

Intune Certificate Deployment

JAMF PKI Certificates

Planning - Migration waves, timeline, stakeholders

Implementation - ISE policy changes, monitoring, progress

Decisions & Risks - Decision log, risks, rollback