Authorization Wi-Fi RADIUS + AD + UniFi only through a certificate (without log.pass)?

Question

Active Directory

at present in a sheaf the certificate + a broad gull a pass of the domain user - everything works.
without a certificate or a pass log - no.
PEAP method, MSCHAPV2...
if you remove EAP or certificate in the user verification method (network policy properties), it stops working.

Answer 1

Can I see the conditions for NPS?
Why do you need a certificate?
If the PC is entered into the domain, then it can log in to WIFI itself and the user does not have to enter his credentials. Also, if a user logs in on a laptop under a domain account, then authorization on WIFI will already be transparent.