document Windows behavior

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 84660d7c1e84d9cdd144b2ceba08a44ebc44d7e1..97c7435a7c741138626a55153a322ca53fdc81f0 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -1148,6 +1148,17 @@ eap {
        #
        #  The TEAP module implements the EAP-TEAP protocol
        #
+       #  Note that for Windows:
+       #
+       #  * "machine" authentication is ALWAYS EAP-TLS.
+       #  * "user" authentication is almost always EAP-MSCHAPv2,
+       #    except when Windows is configured for "smartcard"
+       #    authentication.
+       #
+       #  If you configure FreeRADIUS to do anything else, then
+       #  Windows will either fail, or will just return one of the
+       #  methods listed above.
+       #
        #teap {
                #  Point to the common TLS configuration
                #