Using MS-CHAP with RADIUS authentication

Microsoft Windows NT Routing and Remote Access Server does not offer MS-CHAP authentication when used as a Remote Authentication Dial-In User Service (RADIUS) client.

This is by design because several third-party RADIUS servers do not support MS-CHAP authentication.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To enable MS-CHAP with RADIUS authentication, follow these steps to add a registry value:

1. Start Registry Editor (Regedt32.exe).
2. Locate the following key in the registry:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\PPP\CHAP
3. On the Edit menu, click Add Value, and then add the following registry value:
   DWORD: OfferMSCHAP
   Value: 0x00000001
   
4. Quit Registry Editor.

After this key is enabled, every incoming PPP connection may be offered MS-CHAP, and MS-CHAP may be used to authenticate each PPP user against the Radius server that your RAS server is using.

This behavior is by design.

Set the registry key located in the "Resolution" section to use MS-CHAP authentication when you use the Microsoft Windows NT Routing and Remote Access Server with either Microsoft RADIUS Server or a third-party Radius server that can offer MS-CHAP authentication.

Note We recommend that you use MS-CHAP version 2. For more information, visit the following Microsoft Web site: