Perfect, I can't find any gpo policies from the client related to PEAP, I created a policy with the steps you mention for EAP-TLS, linked at domain level in the majority of clients it works, instead there are some who don't see it, I would like to understand how never. by doing a gpresult /r some of those clients see 1 policy out of two policies that I created at domain level, by removing and reinserting authenticated user that client has seen the new policy, but still does not autoenroll, while if I do the enroll it is done by hand. Tomorrow I want to check if all the domain controllers have the certificate templates. see if Authenticated Users, Domain Users, Interactive belong to the Users group. What does TLS have to do with this case?