diff --git a/radiuscontroller/raddb/mods-enabled/mschap b/radiuscontroller/raddb/mods-enabled/mschap
index f1204b0..d7e58fb 100644
--- a/radiuscontroller/raddb/mods-enabled/mschap
+++ b/radiuscontroller/raddb/mods-enabled/mschap
@@ -2,10 +2,8 @@ mschap {
 	# Send MS-CHAP-Error with E=691 on authentication failure,
 	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
 	send_error = yes
-
-	# Force the rejection format to return the MSCHAPv2 failure code
-	# (Error 691 explicitly maps to an incorrect password on iOS)
-	passchange {
-		ntlm_auth = "/usr/bin/ntlm_auth"
-	}
+	use_mppe = yes
+	require_encryption = yes
+	require_strong = yes
+	with_ntdomain_hack = yes
 }
diff --git a/radiuscontroller/raddb/sites-enabled/inner-tunnel b/radiuscontroller/raddb/sites-enabled/inner-tunnel
index eef3b96..fe32bd0 100644
--- a/radiuscontroller/raddb/sites-enabled/inner-tunnel
+++ b/radiuscontroller/raddb/sites-enabled/inner-tunnel
@@ -30,7 +30,6 @@ post-auth {
 	sql
 	Post-Auth-Type REJECT {
 		sql
-		attr_filter.access_reject
 	}
 }
 }