Background (I'm new to this, so bear with me):

So, I set up an NPS server vm in an AD domain to try out RADIUS client WAPs. The NPS is installed alongside an AD CS server (enterprise, plus one offline). I configured the NPS server with RADIUS clients and network policy using PEAP and requiring a cert, etc. Conditions included an AD group I created that included domain users and computers. I then configured GPO to distribute cert, along with wireless profile to my specified OU.

Now the kicker/question: I actually forgot to register this server in AD as RAS/IAS... but it was still able to authenticate via AD credentials without a hitch. I didn't even notice it at first--only noticed the option after tinkering and then researching. So how was it able to work without AD registration and is it really even necessary, even when you want to authenticate with AD? Maybe the AD CS server on same VM?

This is all on 2012 R2 STD in a learning/non-production setting, so I'm not really restricted in terms of testing. Just baffled as to why this was possible and to ensure that I'm not missing something. If more info is needed, please let me know.

  • Do any of the configured policies have 'Ignore user account dial-in properties' checked?
    – jscott
    Apr 8, 2015 at 11:50

1 Answer 1


Ah, thank you--it was indeed checked. Was almost too easy for me to miss, as I was digging deeper only to find it on the very first page of the policy properties. So enabling this allows NPS to evaluate based upon network access policy only (according to documentation)?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.