I already done three methods for troubleshooting 

• reset TCP/IP 
• disable IPv6
  delete the registry key (exported it before, to keep a backup)
  KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RemoteAccess\RouterManagers\Ipv6  

And already facing the same issue the manager company  told me maybe cuz server having two ip address  and that's why maybe the routing and remote access cant respond   

I have the following set but nothing at all appears on the event log under Network Policy and Access Services.

1. Set to log both rejected and successful attempts under NPS properties

2. Checked the log file location under Accounting

3. Checked the following...

C:\Windows\system32>auditpol /get /subcategory:"Network Policy Server"
System audit policy
Category/Subcategory                      Setting
Logon/Logoff
Network Policy Server                   Success and Failure

I have tried re-enabling it using the following, I have also tried disabling it and re-enabling it

C:\Windows\system32>auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

4. I have also tried fully removing the NPS roles and features the re-adding them but still it logs nothing!

I have two domains: domain.local and corp.local.domain. Each domain has its RADIUS: nps1.domain.local and nps2.corp.local.domain
I need to configure RADUIS-proxy nps3.domain.local which will forward requests to the corresponding NPSs based on domain belonging. I've created two Request Policies, each has a RADIUS-group with one NPS only. The conditions are:

but it doesn't work:

"nps3","IAS",07/26/2019,10:31:26,1,"host/AT-NB.corp.local.domain",,"54-80-28-a0-07-c0","48-2a-e3-0f-9c-2d",,,"HP","192.168.100.23",35,0,"192.168.100.23","192.168.100.23",,,15,"CONNECT Ethernet 1000Mbps Full duplex",1,2,,,0,"311 1 192.168.100.245 07/25/2019 07:39:36 10",,,,,,,,,,,,,,,,,,13,6,,,,"1",,,,,,11,,,,,,,,,,"nps3","IAS",07/26/2019,10:31:26,3,,,,,,,,,,0,"192.168.100.23","192.168.100.23",,,,,,,,,49,"311 1 192.168.100.245 07/25/2019 07:39:36 10",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

If I leave only one policy, without the "Client Friendly Name" conditions, it works:

"nps3","IAS",07/25/2019,17:41:31,1,"host/AT-NB.corp.local.domain",,"54-80-28-a0-07-c0","48-2a-e3-0f-9c-2d",,,"HP","192.168.100.23",35,0,"192.168.100.23","192.168.100.23",,,15,"CONNECT Ethernet 1000Mbps Full duplex",1,2,,,0,,,,,,,,,,,,,,,,,,,13,6,,,,"1",,,,,,11,,,,,"RADIUS",2,"AT","192.168.100.223",,"nps3","IAS",07/25/2019,17:41:31,11,,,,,,,,,,0,"192.168.100.23","192.168.100.23",,,,,,,,,0,,30,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"RADIUS",2,"AT","192.168.100.223",,

How can I properly create the domain conditions?

Thank you in advance!

Hi Everyone,

I am new to NPS. I am using Windows Server 2008 R2. I have developed an Authentication Extension DLL which is basically a MFC Extension DLL for custom authentication in NPS. (http://msdn.microsoft.com/en-us/library/windows/desktop/bb892024(v=vs.85).aspx)

Now, to apply this Extension DLL at NPS I have used following steps:- 

1. I have put that DLL in %System Root%\System32\radius.dll folder.
2. I have create HKLM\System\CurrentControlSet\Services\AuthSrv\Parameters\registry key and set path of DLL as described here http://msdn.microsoft.com/en-us/library/windows/desktop/bb892024(v=vs.85).aspx

Now, when I am restarting NPS server I am getting following error:-

"Extension Host is failed to load DLL.Path %System Root%\System32\radius.dll".

Bear with me, this requires some explanation but this is really our last shot.

We are a software company that delivers apps, we have a couple of VPSs hosted by TransIP (transip.nl) and have multiple APIs running to connect to our services.

In February we started experiencing some connection problems to a particular VPS. It all started when I couldn't connect to the API (or really anything running on this VPS) from my home network. Then a couple of weeks later my mobile network (which is on the KPN network) also had the same issues. More days passed and some of our clients also started experiencing the same issues. (For them we have some dirty workarounds but we need to get back to normal service).

We are no server gurus so we contacted our admin at TransIP. We've been talking back and forth since then (for like 2 months) and they assure us that nothing is broken on their side and that our issue has to be a local network error. They told us to run some MTR tests which we did, but weirdly enough the MTR test gave no result, absolutely nothing. So they checked with their engineers and they are still absolutely sure that the problems exists in the network which tries to connect to the VPS. They also ran tests from every corner they had and they all came back positive. However the problem exists on 4G networks and seemingly start at random for new networks.

So we really tried everything and have talked to multiple professionals about what this problem could be, nobody really knows.

• KPN mobile network fails but only on some phones
• Some home networks fail
• Randomly mobile networks that didn't work before started working again.
• Other way around, networks that worked, stopped working after some time

We are running Windows Server 2016 with IIS.

Also note that there is NOTHING in the VPS logs about any devices trying to connect for the devices that can not connect.

From networks where you cannot connect: if I enable a VPN (NordVPN for example) it magically works.

This morning one of our employees started experiencing the problem from the 4G network on their Android phone (OnePlus 6T). It didn't work at all, no connection was possible to the VPS. But then we switched the SIM card to the 2nd SIM slot and now it works on the 2nd SIM slot. Switching back to the original SIM slot and it magically starts working again as well.

Conclusion:

Problem: From a network user can not connect to our VPS. Local or mobile networks. Hosting party can not find the problem. Should be a problem on the VPS. VPS does not have firewall enabled (for testing) and devices that try to connect but are rejected (timeout on client side) and do not show up in the VPS logs (which they should if they would get blocked?).

Solution: A pointer to where the blockade is happening and how we can resolve the issue. Experienced people might've stumbled upon this problem before and might also be able to point us into a direction.

If you have any clue, everything is welcome. Any pointers would help us tremendously.

Hello All,

I have a lab setup. the configuration is as follows.

DC server 2016 192.18.0.1

ADC server 2016 192.168.0.2

exchange server 2016 192.168.0.3

second exchange server 2016 192.168.0.4

forest name abc.local

another forest XYZ.local

DC server 2019 10.10.10.1

ADC server 2019 10.10.10.2

Exchange server 2019 10.10.10.3

Router (workgroup) server 2019

RRAS role installed three network cards added.

ABC network card 192.168.0.8
XYZ network card 10.10.10.8
Host network card 192.168.1.7 (this IP is assigned directly from netgear router that i have)

issue is i did the conditional forwards between ABC and XYZ forest and made the IP of RRAS router machine the default gateway for all machines with their respective subnets. Example ABC card in router machine has IP of 192.168.0.8 so this becomes default gateway for all machines in ABC forest, and IP 10.10.10.8 which is IP for second network adapter in router machine for XYZ card i made this as default gateway for machine sin XYZ forest. So ping is happening between both the forests successfully. 

Now the third card which is the INTERNET card that i added to the router machine that give sit internet access. i configured with RRAS so all the machines in the respective forest should have internet access as well. 

But here comes the problem as my host machine is windows 10 in which i have all this virtual environment set up. i was wondering if my host machine could ping the respective virtual machines inside. As my host machine has IP assigned 192.168.1.5 which is assigned by NETGEAR router as well. Now point to be noted from my host machine windows 10 i am able to ping all the three IPs of router which is ABC card 192.168.0.8 as well as XYZ card 10.10.10.8 as well as external (internet) card which is 192.168.1.7. But i cannot ping any VMs of any forest through my host machine. Also the strange point my VMs are able to ping my host machine successfully and are also able to access internet. 

i have done the RRAS configuration as follows. 

One windows 7 sample machine in ABC forest configuration 

Successfully pinging to google.com

Sample Machine configuration in XYZ forest

Successfully pinging to google.com

Router Machine configuration all three network cards

ABC card

XYZ card

router RRAS machine also able to ping google.com successfully

Host Windows 10 machine where all my VMs are residing configuration

able to ping google.com



But not able to ping DC in ABC forest neither any machine in ABC forest

same condition for XYZ forest as well 

But able to ping router machine IP address which is 192.168.1.7

Any suggestions would be highly appreciated

(could not upload more than 9 images if any other information requited please contact )

Sorabh awaray

Hi exert

we need to integrate radius server with iis ftp server or other ftp server (filezilla,titan...)!

is there any way to have radius server in DMZ zone whenever user need to access file server in FTP server authenticate by radius server ? 

please give me hand 

thank you in advance 

Hello,

I have recently set up an NPS 2016 server for RADIUS authentication with our Check Point VPN server (RADIUS Client).

I am not using an NPS Proxy server.  The NetBIOS domain name is different from the UPN suffix

Users usually dial the vpn using the following formats:

1.Username

2.Domain\Username

3. FirstName.Lastname@UPNSUFFIX.com

The first scenario (USERNAME) worked out of the box with no additional configuration.

The second scenario (Domain\USername) required some attribute manipulation namely the USername attribute, replacing (.*)\\(.*) with $2

The issue i have is with the third scenario. UPN authentication is just not working which is required because i am integrating with O365 MFA.

following instructions in another thread i added "^\w+\.\w+@upnsuffix\.com$" on the "User Name" dialog box in the policy conditions however it's Still not working.

From my understanding UPN authentication should be accepted by default. 

Any ideas on how to get the RADIUS Server to accept the UPN user name?

Hi all,

I'm trying to achieve the following through attribute manipulation in a connection request policy on an NPS server acting as a RADIUS proxy:

Change user@test.domain.com to user@domain.com and then forward to a RADIUS
authentication server.

Under Specify a Realm Name on theSettings tab, I have tried a number of variations in theFind and Replace
With fields for the User-Nameattribute but have not managed to generate the desired user name. Combinations
I have tried and their resulting outcome according to the NPS log are:

Find: user@test\.domain\.com
Replace With: user@domain.com
Resulting user name: user@test.domain.com

Find: user@test\.domain\.com
Replace With: user@domain\.com
Resulting user name: user@domain\.com

Find: @test(.*)
Replace With: @$1
Resulting user name: user@.domain.com

Find: @test\.(.*)
Replace With: @$1Resulting user name: user@test.domain.com

Find: @test\.
Replace With: @$'
Resulting user name: user@domain.comdomain.com<o:p> </o:p>

Find: @test\.
Replace With: @$
Resulting user name: user@$domain.com

Find: @test\.
Replace With: @
Resulting user name: user@test.domain.com

As I understand it what I'm trying to achieve should be straightforward. Inhttps://technet.microsoft.com/en-us/library/cc731342(v=ws.10).aspx it's stated that you can:<o:p></o:p>

"Change the realm name but not its syntax. For example, the user name user1@example.com is changed to
user1@wcoast.example.com."<o:p></o:p>

This is pretty similar to what I'm after. However, I can't find any specific examples on the web, and have run out of ideas. Can anybody point me in the right direction?<o:p></o:p>

Thanks in advance.<o:p></o:p>

Stuart

Hello,

I am trying to utilize NPS in a resource forest (Azure MFA NPS extension to be exact), that has two-way trusts with 2 user forest, lets say Forest A and Forest B.  The forest trust are setup with selective authentication. I have added the NPS server, 'Allowed to Authenticate" on the DC's of Forest A and Forest B.  When testing connection from the user forests to the NPS forest with radius.. NPS denies access and gives Access-Reject message.. NPS never gets passed the Connection Request Policy, which is set to default : 'Use Windows authentication for all users'

I then added the NPS server from resource forest to the IAS and RAS server group in the two user forest. Still no luck.  In my troubleshooting I changed the forest authentication to Forest-Wide authentication and viola, it authenticated the users and passed NPS. 

How do I get this working in Selective auth?  This is a lab environment now (home-based), but production will require selective auth when our org decides to go with this route.  Thank you for your time and help!

Hello everybody

I work as a helpdesk in an organization with up to 1200 users. recently the IT Management department decided to run Active Directory. We Joined almost all the users to the domain but some users have not joined their Computers to the domain yet. some of them resist from joining to the domain or some other excuses are the reasons that they ae not joined yet.

our policy is to prevent the computers or users that are not joined to the domain to access the network.

Our server is : Windows Server 2016

So what are possible solutions to make it automatically?

Is there any way to set a policy for DHCP to not to assign an IP address to these computers?

in previous versions of windows the NAP service made this operation done. 

I'm looking for a solution in server 2016.

Thanks in advance

Sincerely

Hello everybody

I work as a helpdesk in an organization with up to 1200 users. recently the IT Management department decided to run Active Directory. We Joined almost all the users to the domain but some users have not joined their Computers to the domain yet. some of them resist from joining to the domain or some other excuses are the reasons that they ae not joined yet.

our policy is to prevent the computers or users that are not joined to the domain to access the network.

Our server is : Windows Server 2016

So what are possible solutions to make it automatically?

Is there any way to set a policy for DHCP to not to assign an IP address to these computers?

in previous versions of windows the NAP service made this operation done. 

I'm looking for a solution in server 2016.

Thanks in advance

Sincerely

Hello, I am migrating NPS / Radius authentication to a new Server 2016 domain controller from a 2008 domain controller. 

I was able to export the configuration from the 2008 to the new 2016 server. All Radius clients and settings successfully imported. 

When testing the radius clients from the Cisco Meraki Dashboard, I get an authentication failure, even though I'm able to test successfully to the old 2008 radius server with the same domain admin credentials.

I am thinking the issue might be caused from not having a certificate configured. When looking at the NPS certificate for PEAP on the old server, I receive this message: 

Not sure how the old server is working with no certificate configured? I was hoping to see what type of certificate was being used and from where so I could get a new one for the new Radius server. 

hi

currently we have one stand alone radius server running in azure on V-net-01 , serving as P2S VPN.

how to configure two node NPS with MFA in azure using Azure Internal load balance pointing to same V-net-01

Ragav

Hi,

I'm doing the setup of a Network Policy Server (Radius).

We have actually two DNS domains : 

company.tld and company.xyz.tld

The Active directory Domain is compagny.tld

Our radius shoud authenticate the users, even if they use the second DNS.

For that, I have a dedicated connection request policy that match the DNS domain. In the settings, I've configured a regex on the attribute User-Name.

I've some troubles with this regex : I cannot match the dot (.)

The only things that works is when I replace "xyz" with nothing.

Then, in the logs I can see that the domain became company..tld (double dot) and of cours did not match any known domain.

I tried everything : 

replace xyz\. with nothing

replace xyz\\. with nothing

etc...

I've looked a lot on google, but still not working.

The environment is : Windows 2016 Standard, Version 1607, OS Build : 14393.1883

I also tried to look in the registry but I did not find the tree. I also have exported the config in xml and the content is consistent with what I've configured in the MMC.

So I'm interested if you have any suggestion for me,

Regards,

Jean-Sébastien Stoffen

Hi everybody,

I've got a small issue regarding Wifi authentication through Radius.

We've got a Wifi controller with a SSID that does 802.1x.
Clients authenticate through their domain credentials, these devices are non-domain.

When a client connects, the user needs to enter the entire domain-username and prefix "username@domain.com"

If I try to enter "domain\user" or only the "username", the client is unable to connect.
The security-eventlog on our server does not show anything regarding an authentication attempt.
Only if we use the entire username with domain prefix (authentication successful).

We actually want clients to connect simply by entering their "username" without any prefix.

The NPS works entirely, a cert and connection policy has been configured. 
There is a connection request policy where I can set an attribute, I tried several option but without any luck.

https://docs.microsoft.com/nl-nl/windows-server/networking/technologies/nps/nps-crp-reg-expressions

Is there something I'm missing?

Kind regards,

Tim

I am trying to set separate auth policies up per WLAN. The attribute "Called-Station-ID" contains the mac address and SSID of the WLAN a client is connecting from so this seemed an obvious choice. When I specify any kind of regex pattern in the "Called-Station-ID" authentication fails with error 69 stating the Called-Station-ID does not match any policy. I know the policy is fine except for the Called-Station-ID attribute b/c If I enter the exact Called-Station-ID value, as pulled from the logs, which includes the mac address and SSID it works fine. I searched Google first and none of the suggestions I found worked. I would appreciate some help.

Working Called-Station-ID: 00-17-df-34-82-80:RSC-Secure-Wireless

List of attempts:

.*:RSC-Secure-Wireless

.0-17-df-34-82-80:RSC-Secure-Wireless

^00-17-df-34-82-80:RSC-Secure-Wireless$

/00-17-df-34-82-80:RSC-Secure-Wireless/

/^00-17-df-34-82-80:RSC-Secure-Wireless$/

While my first attempt may have been incorrect at least one of my test patterns should have worked. From what I can gather its not processing the value as a pattern at all.