Background (I'm new to this, so bear with me):
So, I set up an NPS server vm in an AD domain to try out RADIUS client WAPs. The NPS is installed alongside an AD CS server (enterprise, plus one offline). I configured the NPS server with RADIUS clients and network policy using PEAP and requiring a cert, etc. Conditions included an AD group I created that included domain users and computers. I then configured GPO to distribute cert, along with wireless profile to my specified OU.
Now the kicker/question: I actually forgot to register this server in AD as RAS/IAS... but it was still able to authenticate via AD credentials without a hitch. I didn't even notice it at first--only noticed the option after tinkering and then researching. So how was it able to work without AD registration and is it really even necessary, even when you want to authenticate with AD? Maybe the AD CS server on same VM?
This is all on 2012 R2 STD in a learning/non-production setting, so I'm not really restricted in terms of testing. Just baffled as to why this was possible and to ensure that I'm not missing something. If more info is needed, please let me know.