To answer your question, you really need to understand a little bit about how WPA2 works.
To start with, both sides need a common starting point (the "Pairwise Master Key" or PMK) on which to build the encryption key ("Pairwise Transient Key" or PTK). This PMK is either the PSK for WPA2-PSK or it is generated by the RADIUS server during the EAP exchange for WPA2-Enterprise.
The PTK is created by combining and hashing the following values: the PMK, the authenticator nonce value or ANonce, the supplicant nonce value or SNonce, the MAC address of the AP (BSSID), and finally the MAC address of the station.
The information for the PTK is exchanged in a four way handshake:
- After the station authenticates, the AP will send the ANonce to the station.
- The station responds with the SNonce plus a MIC (message integrity code).
- The AP then responds to the station with the GTK (group temporal key - used for broadcast/multicast) and a MIC.
- The station sends an acknowledgement to the AP.
Once this is done, both the station and the AP have been able to generate the PTK and know that the other side has been able to do so as well.
What makes WPA2-Enterprise so much more secure than WPA2-PSK, is that each and every authenticated station will have a unique PMK, and the PMK will be unique every time the station connects. So even if someone were to brute force the PTK and calculate the PMK, this would only apply to the single station and only until it reconnects.
With WPA2-PSK, once the attacker has calculated the PMK (in this case the PSK), as long as it can capture the four way handshakes between the station(s) and AP, it can decrypt all the data on the wireless network. This is often done by spoofing a deauthentication frame to the stations causing them to reconnect.