I am recently on a wireless network security assessment task for a enterprise client. They didn't apply the WPA-PEAP-MSCHAPv2 user authentication configuration correctly (stations don't validate the servers' identity) and I successfully intercepted the NETNTLM string by Evil Twin attack, cracked the string, got the NT hash and managed to join their wireless network from Kali Linux using the wpa-supplicant tool with the hash.
However, for reasons I don't know or understand, the client's IT manager insists it's not adequate PoC if I can only show him the evidence that Kali joined their network and asked me to show him that I got my Windows laptop into their network.
I did a lot of Googling trying to find out how to let Windows machine joining a wireless network only use the NT hash instead of the plaintext password but cannot find anything helpful. So I wonder if this is viable at all or I am just stuck on some questions too naive to be given an answer?