Within the RRAS MMC console there is an option called Remote Access Logging & Polices.
If I right mouse click and can get to the NPS and tried to configure a couple of basic settings (e.g. group membership of Domain Admins required) for granting access.
However when testing this, the policy did not seem to apply (aka the user got on even though group membership was not correct).
I have made sure that the dial-in properties for the user was set to Control access through NPS Network Policy.
Q/ For the above to work, do I actually need to install the NPS role itself or can it work independently?