Windows OID's
In order for any Windows system to perform EAP authentication, the certificates need to have the proper OID's. In short, certain kinds of magic are required. The FreeRADIUS certificate creation scripts in /etc/raddb/certs/ create the certificates with the proper information.
These certificate creation scripts should always be used to create RADIUS certificates.
See also KB-814394, and KB-885453. Note that we do not necessarily agree with their explanations, but the fix does appear to work.