12.2 Network Policy and Access Services (NPAS), RADIUS & Policy Processing
Key Takeaways
- Network Policy Server is Microsoft's RADIUS server and RADIUS proxy, and every authenticator such as a VPN server, wireless AP, or switch must be registered on it as a RADIUS client.
- An authenticator that is not defined as a RADIUS client is silently ignored, which is the usual cause of authentication requests that never appear in the NPS log.
- A Connection Request Policy decides where authentication happens: locally against Active Directory or forwarded to a remote RADIUS server group for another realm.
- A Network Policy decides whether access is granted and under what constraints, evaluating conditions top-down by processing order until the first match.
- Because evaluation stops at the first matching Network Policy, a broad deny or restrictive policy placed above a specific grant policy blocks users the administrator intended to allow.
Network Policy and Access Services (NPAS), RADIUS & Policy Processing
1. Network Policy and Access Services (NPAS) & RADIUS Framework
The Network Policy and Access Services (NPAS) role provides centralized Authentication, Authorization, and Accounting (AAA) via the Remote Authentication Dial-In User Service (RADIUS) protocol (RFC 2865 for Authentication/Authorization and RFC 2866 for Accounting).
+-----------------------------------------------------------------------------------+
| NPAS / RADIUS ARCHITECTURE FLOW |
| |
| [CLIENT] [RADIUS CLIENT (NAS)] [NPS SERVER (AAA)] |
| - VPN Client - RRAS Server - Evaluates CRP |
| - 802.1X Workstation - 802.1X Switch / Wi-Fi AP - Evaluates NP |
| | | | |
| |--- (1) Auth Request ---->| | |
| | (EAP / Credentials) |--- (2) RADIUS Access-Request ->| |
| | | (UDP 1812 / 1645) | |
| | | |-- (3) Active|
| | | | Directory |
| | |<-- (4) RADIUS Access-Accept ---| Lookup |
| |<-- (5) Session Granted --| (or Access-Reject) | |
| | | | |
| | |--- (6) RADIUS Accounting ----->| |
| | | (UDP 1813 / 1646) | |
+-----------------------------------------------------------------------------------+
Network Access Servers (NAS / RADIUS Clients)
Any device that forwards user authentication requests to NPS is a RADIUS Client (Network Access Server). This includes Windows Server RRAS instances, enterprise Wi-Fi Access Points (802.1X), Cisco/Aruba switches (802.1X port-based access), and hardware firewalls.
# Register the NPS Server in Active Directory Domain Services
# (Grants NPS permission to read user account dial-in properties and tokens)
# There is NO Register-NpsServer cmdlet. The NPS module ships exactly seven cmdlets:
# Get/New/Remove/Set-NpsRadiusClient, Get-NpsSharedSecretTemplate, and
# Import/Export-NpsConfiguration. Registration is done in the NPS console
# (right-click \"NPS (Local)\" > \"Register Server in Active Directory\") or with netsh:
netsh nps add registeredserver corp.contoso.com NPS-01
# Add a new RADIUS Client (RRAS VPN Gateway)
New-NpsRadiusClient `
-Name 'Edge-RRAS-01' `
-Address '192.168.10.1' `
-SharedSecret 'RadClientSecret2026!Complex' `
-AuthAttributeRequired $true
[!IMPORTANT] Active Directory Registration Requirement: If an NPS server is not registered in Active Directory (via the NPS console context menu Register Server in Active Directory, or
netsh nps add registeredserver <domain> <server>for a server outside its own domain), it cannot read user account dial-in permissions or Kerberos/NTLM authentication properties, resulting in all RADIUS connection attempts failing with generic access-denied errors.
2. Connection Request Policies vs. Network Policies
The single most critical exam concept in NPAS is understanding the exact architectural boundary between Connection Request Policies (CRP) and Network Policies (NP).
+-----------------------------------------------------------------------------------+
| CONNECTION REQUEST POLICIES VS NETWORK POLICIES |
| |
| DIMENSION CONNECTION REQUEST POLICIES NETWORK POLICIES |
| --------------------+-----------------------------+-----------------------------|
| Core Purpose | WHO evaluates authentication| WHETHER access is granted |
| | (Local vs Remote Proxy) | and WHAT constraints apply |
| Evaluation Order | Processed First | Processed Second (after CRP)|
| Key Decisions | - Authenticate locally | - Grant Access vs Deny |
| | - Forward to RADIUS Proxy | - EAP-TLS / PEAP methods |
| | - Realm name manipulation | - Group membership checks |
| Output / Action | Specifies Authentication | Issues RADIUS Attributes |
| | Provider / Server Group | (VLAN IDs, Filter-Id, ACLs) |
+-----------------------------------------------------------------------------------+
1. Connection Request Policies (CRP)
Connection Request Policies inspect incoming RADIUS packets to determine whether the local NPS server should authenticate the credentials against local Active Directory or act as a RADIUS Proxy by forwarding the request to a Remote RADIUS Server Group.
- Conditions: Evaluates incoming client IPv4 address, NAS Port Type (e.g., Virtual VPN vs Wireless IEEE 802.11), or User-Name regular expression patterns (e.g.,
^CORP\\vs.*@partner\.com). - Authentication Target: Configured under Settings -> Authentication: either "Authenticate requests on this server" or "Forward requests to the following remote RADIUS server group for authentication".
2. Network Policies (NP)
Once a Connection Request Policy determines that the request will be processed locally, NPS evaluates Network Policies sequentially from top to bottom (Processing Order 1, 2, 3...) until the first matching policy is found.
- Conditions: AD DS Security Group membership (e.g.,
CORP\VPN-Allowed-Users), Client Machine health status, Day and Time restrictions, NAS-Port-Type. - Access Permission: Grant access or Deny access.
- Authentication Methods (EAP):
- EAP-TLS: Mutual certificate authentication (highest security for smart cards and managed domain devices).
- PEAP-MS-CHAPv2: Protected EAP with server certificate validation and user password authentication.
- Constraints & RADIUS Attributes:
- Idle Timeout / Session Timeout limits.
- RADIUS VLAN Tagging: Dynamically assigning authenticated switch ports or Wi-Fi sessions to specific VLANs using attributes:
Tunnel-Type=VLAN(value13)Tunnel-Medium-Type=802(value6)Tunnel-Private-Group-ID=<VLAN_ID>(e.g.,100)
[!CAUTION] Evaluation Order Rule: NPS stops evaluating Network Policies immediately upon finding the first matching policy. If a user matches Policy #1, but Policy #1 denies access due to an authentication method mismatch, NPS will not continue evaluating Policy #2. Always order specific, restrictive policies above general catch-all policies.
3. RADIUS Accounting and RADIUS Proxy Scenarios
RADIUS Accounting (RFC 2866)
NPS tracks session lifecycles for auditing, billing, and security forensics by logging:
- Accounting-Start: Sent when the user connects and receives an IP address.
- Accounting-Stop: Sent when the session terminates, recording total duration, input packets, output packets, and session termination reason.
- Interim-Update: Periodic keep-alive metrics sent during long-lived sessions.
- Storage Targets: NPS can write accounting data to local text log files in W3C Extended or IAS Format (
C:\Windows\System32\LogFiles), or stream directly to an enterprise Microsoft SQL Server database via ODBC for centralized auditing.
RADIUS Proxy Routing
In multi-tenant, merged enterprise, or service provider environments, a central NPS server can act as a RADIUS Proxy. By inspecting the realm suffix in the user identity (e.g., user@emea.contoso.com), the proxy forwards the RADIUS Access-Request to the EMEA NPS server cluster over UDP port 1812, proxies the Access-Accept response back to the local NAS, and preserves end-to-end authentication isolation.
You are deploying a new Network Policy Server (NPS) on Windows Server 2025 to authenticate 802.1X wireless clients. You configure Network Policies and add the wireless access points as RADIUS clients. However, when domain users attempt to authenticate, all requests fail with an access-denied error stating that the directory account cannot be read. What step was omitted?
An administrator wants to configure an NPS server so that authentication requests from users belonging to the 'CORP\Contractors' group are evaluated locally against Active Directory, while requests from the 'PARTNER\Vendors' realm are forwarded to a partner company's RADIUS server. Which policy configuration achieves this?
A network administrator is troubleshooting an NPS server where domain users are unexpectedly denied VPN access. Inspection reveals two Network Policies: Policy 1 ('All Employees', Order 1, Grant Access, requires EAP-TLS) and Policy 2 ('VPN Users', Order 2, Grant Access, requires PEAP-MS-CHAPv2). The users are members of both groups and connect using PEAP-MS-CHAPv2. Why are the users being rejected?