Say you have this:
An NPS server that grants access to users using client certificates (EAP-TLS).
So for example someone managed to snatch the domain administrator's password and they log in to the computer using the domain administrator's username and password. Then using their regular user certificate, the NPS server grants them access to the network and, based on their certificate, places them in a regular Users VLAN. That Users VLAN would be able to access the domain controller, otherwise no domain users could log in.
So now that this person has access to the network, they can log in to the domain controller as an administrator even though they don't have the administrator's certificate. All they needed was to know the administrator's password. So certificates here are essentially useless.
Why isn't there a way to log in to a domain controller other than just using a plain password? (I know there's smart cards, but they are too complicated and expensive to set up). Like why can't you make the domain controller log users in using their certificates?