2

Running into something very painful. We use Microsoft's Network Policy Server, and need the Network Policy Server security event subcategory to work - specifically, event id 6273 and 6272. NPS works, but event logs are not being written.

We've verified the following:

Network Policy Server is configured to log success and failure events:

PS > auditpol /get /subcategory:"Network Policy Server"
System audit policy

Category/Subcategory                      Setting
Logon/Logoff
  Network Policy Server                   Success and Failure

PS > cat $env:systemroot\security\audit\audit.csv | select-string net

,System,Audit Network Policy Server,{0cce9243-69ae-11d9-bed3-505054503030},Success and Failure,,3

We've confirmed that NPS is configured to log these:

  • Open NPS > Right click NPS (Local) > Properties > General Tab, both Successful and Rejected authentication requests boxes are checked

Unacceptable workarounds:

Text logs. They are being written without issue, but we have a variety of services and tools configured to use the event log data that should be working

What we've tried:

  • Restarting :shrug:
  • Manually disable network policy server audit policy, re-enable
  • Disable network policy server configuration to log successful and rejected authentication requests
  • Pair the above with restarting eventlog and ias services

Regardless of any changes, no NPS events are written to the event log

I'm sort of at a loss, outside of diving into procmon, but I have no idea when/where this might be failing, so something so verbose may not be super helpful.

Thanks!

4
  • That's pretty peculiar - has this every worked before? Are you seeing other security events (I'm assume so)?
    – Lucky Luke
    Feb 4 '20 at 15:41
  • 1
    Yes, it's quite peculiar and somewhat infuriating! It functions now on a nearly identically configured server - this is one of two domain controllers that use NPS - all other events categories are functioning, it's just that NPS on this one server is not generating windows event logs. Even more fun? We ran into this on a 2012 R2 domain controller some time ago, just... never had the time to look into it. At this point, will remove/add the role and report back... Feb 5 '20 at 3:13
  • 1
    Maybe this helps - export the config on the working NPS server and import it on the broken one? docs.microsoft.com/en-us/windows-server/networking/technologies/…
    – Lucky Luke
    Feb 5 '20 at 15:04
  • Did you ever get this working?
    – Lucky Luke
    Feb 10 '20 at 0:00
0

I would try setting the logging to disabled, then enable it again (possibly with a reboot before enabling it again)

From an elevated command prompt:

To disable

auditpol /set /subcategory:"Network Policy Server" /success:disable /failure:disable

To enable

auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
1
  • I thought the same! No luck : ( Feb 3 '20 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.