Network Policy Server Security: Hardening the RADIUS Behind Wi-Fi and VPN

Windows Network Policy Server (NPS) decides who gets onto your Wi-Fi, wired 802.1X ports and VPN, yet it is often a server built once by the network team and never reviewed. A loose network policy, a reused shared secret, a server certificate that clients do not validate or an MFA extension left in test mode can each turn NPS into the easiest way past your network perimeter. This guide is for Windows, identity and network administrators who run NPS as a RADIUS server or proxy. It covers how NPS evaluates requests, certificate selection for PEAP and EAP-TLS, shared secrets, the Blast-RADIUS settings, the NPS extension for Microsoft Entra multifactor authentication, logging, configuration export and high availability. Protocol weaknesses and RadSec are covered in the RADIUS Security Guide; this page stays on the Windows implementation.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• Policy order is the access model. NPS uses the first network policy whose conditions match, so a broad policy near the top silently overrides every stricter one below it.
• Prefer EAP-TLS and make clients validate the server. PEAP-MS-CHAP v2 is only as strong as the password and the client's check of the NPS certificate; certificate-based EAP-TLS removes the password from the exchange.
• Every RADIUS client is a credential. Shared secrets are stored per client, exported in clear text by netsh nps export, and must be long, random and unique.
• Turn on Blast-RADIUS protections (off by default). Require Message-Authenticator per client and move limitProxyState and requireMsgAuth from Audit to Enable on any NPS that receives RADIUS over untrusted UDP paths.
• The MFA extension has sharp edges. REQUIRE_USER_MATCH set to FALSE lets unregistered users skip MFA, and approve or deny prompts over RADIUS do not support number matching.

How identity and access work in NPS

NPS is installed with the Network Policy and Access Services role, which Microsoft documents as available on Server with Desktop Experience only, not Server Core. It implements RADIUS (RFC 2865 and RFC 2866) and authenticates users and computers against Active Directory Domain Services or the local SAM database. Network access servers (NAS), meaning wireless controllers, access points, 802.1X switches and VPN gateways, are the RADIUS clients. End-user devices are not.

A network policy grants access when its conditions match and its permission is Access granted; if nothing matches, the request is rejected unless the user's dial-in properties allow it. That fallback is why Microsoft offers the option to ignore dial-in properties: in a large directory, some accounts carry old Allow settings from remote access days. NPS must also be registered in Active Directory, which adds the server to the RAS and IAS Servers group so it can read dial-in properties; register it in every domain that holds user accounts (netsh nps add registeredserver). Cross-forest EAP-TLS and PEAP-TLS need a RADIUS proxy.

Choosing the authentication method

Certificate selection for PEAP and EAP-TLS

• Server certificate: must chain to a root the clients trust, carry the Server Authentication EKU (1.3.6.1.5.5.7.3.1), have a non-blank subject and, if a SubjectAltName is present, include the server's DNS name. Microsoft's example template uses RSA 2048 with SHA-256. NPS does not offer certificates that lack the EKU or subject.
• Selecting it: the certificate is chosen per EAP type in the network policy (or connection request policy) constraints. When several NPS servers serve the same SSID, each needs a certificate the clients will accept, and renewing one server's certificate must not change the issuing chain clients pin.
• Client side: enforce Validate server certificate, the trusted root and the expected server names in the Wi-Fi and VPN profiles through Group Policy or MDM. Without it, any access point presenting any certificate can harvest PEAP credentials.
• Client certificates: Client Authentication EKU (1.3.6.1.5.5.7.3.2), UPN in the SAN for user certificates and FQDN for computer certificates, issued by an enterprise CA or mapped to an AD account. See the AD CS Security Guide for template hardening.
• Fragmentation: large EAP-TLS chains can be dropped silently; Microsoft suggests setting Framed-MTU to 1344 or less in the policy.

Admin roles and privileged access

Whoever can edit NPS policy decides who joins the network, so NPS servers belong at the same tier as the systems they gate.

• Local Administrators: Microsoft lists Administrators (or Domain Admins for wizard-based deployment) as the right needed to edit policies, register servers and import configuration. Keep membership to a named NPS admin group and never grant it to helpdesk staff who only need to read logs.
• Domain-joined server, tier zero adjacent: NPS reads directory data and processes domain passwords for PEAP-MS-CHAP v2. Manage it from privileged access workstations and apply the same patching and EDR as other identity servers. See the Tiered Administration and Enterprise Access Model Guide.
• NPS extension configuration: the setup script needs a Global Administrator to bind the extension's certificate to the tenant service principal. Do this through a time-bound privileged role, then leave the role.
• Change control: because import replaces the entire configuration and refreshes immediately, require a reviewed change for every import and keep the previous export as rollback.
• Group policy for supplicants: whoever controls the Wi-Fi and VPN profile GPOs or MDM profiles controls server certificate validation. Include them in the same review.

Integrations, API tokens and service accounts

Shared secrets

The shared secret authenticates each RADIUS client to NPS and keys the Message-Authenticator. It is a machine credential with all the usual risks.

• Unique per client: one secret per NAS device (or per small device group) so a leaked switch configuration does not unlock the whole estate.
• Long and random: generate secrets with a password manager or vault rather than human-chosen words; NAS configuration backups and support bundles often contain them in readable form.
• Templates: NPS Templates Management supports Shared Secrets, RADIUS Clients and Remote RADIUS Servers templates. They help consistency but encourage reuse; use them for per-site groups, not one secret for everything.
• Exports: netsh nps export filename=... exportPSK=YES writes every RADIUS client and remote server secret unencrypted into the XML. Microsoft advises an encrypted, password-protected archive and a secure location. Treat the file like a secrets dump. See the Secrets Management Guide.

Blast-RADIUS (Message-Authenticator) settings on NPS

Audit mode logs events 4419 (request would be dropped) and 4420 (proxy response would be dropped); Enable mode logs 4418 for dropped requests; 4421 at service start warns that protections are not enabled. Microsoft frames the risk around RADIUS over unsecured UDP networks. Rollout detail and the protocol background are in the RADIUS Security Guide.

NPS extension for Microsoft Entra multifactor authentication

The extension adds a cloud MFA step after NPS has validated the primary credential against AD DS. It needs Entra ID P1 or P2 MFA entitlement, outbound TCP 443 to Microsoft endpoints such as login.microsoftonline.com, strongauthenticationservice.auth.microsoft.com and adnotifications.windowsazure.com, and it must not be installed on the VPN server itself. An NPS server running the extension cannot proxy to another RADIUS server, so route only the RADIUS clients that need MFA to it.

Plain push approval over VPN can be abused through voice phishing plus repeated push notifications, so prefer number matching or phishing-resistant methods. The extension's service principal and certificate are also non-human identities: watch the service principal's key credentials for keys you did not add. See the MFA Fatigue and Bypass Guide.

Logging and detection

NPS offers event logging, local text accounting logs and SQL Server logging (SQL only, text only, parallel, or SQL with text backup). Microsoft recommends the DTS Compliant text format, which matches what NPS sends to SQL, and a log partition separate from the system drive (default path %systemroot%\System32\LogFiles). The If logging fails, discard connection requests option trades availability for accountability: enable it only where audit requirements outweigh an outage.

Forward all of these to the SIEM; local logs on a compromised NPS cannot be trusted. Correlate NPS grants with VPN gateway logs, as in the VPN and Firewall Log Detection Guide.

Metrics

• Method mix: share of successful authentications using EAP-TLS versus password-based methods, trending to certificates.
• Blast-RADIUS posture: RADIUS clients with requireauthattrib enabled, and count of 4419 and 4420 events per week, trending to zero.
• Secret hygiene: percentage of RADIUS clients with a unique secret rotated within your policy period.
• MFA coverage: VPN sign-ins completed with TOTP or phishing-resistant methods versus push approval.
• Certificate runway: days to expiry for each NPS server certificate and each extension certificate.

Hardening baseline

1. Inventory: export the configuration (to a protected location) and list every RADIUS client, remote server group, connection request policy and network policy with its order, conditions and allowed methods.
2. Restructure policies: put the narrowest policies first, condition each on a Windows group plus NAS Port Type (Wireless, Ethernet, Virtual for VPN), select Ignore user account dial-in properties, and end with an explicit deny.
3. Remove weak methods: clear PAP, CHAP and MS-CHAP from policy constraints except where an extension design needs PAP, and plan PEAP-MS-CHAP v2 to EAP-TLS migration with a pilot ring of IT devices.
4. Fix certificates: issue NPS server certificates from a controlled template, push client profiles that validate the server certificate and names, and track renewal.
5. Rotate secrets: replace shared or short secrets client by client during maintenance windows, changing the NAS and NPS together.
6. Close Blast-RADIUS: patch NPS and NAS firmware, set requireauthattrib, run limitProxyState and requireMsgAuth in Audit for two weeks, clear 4419 and 4420 sources, then Enable.
7. Harden the extension: remove REQUIRE_USER_MATCH=FALSE, encourage TOTP registration, set NAS timeouts to 60 seconds or more, and schedule certificate renewal.
8. Build high availability: run at least two NPS servers with identical configuration (export and import, which overwrites the destination and does not carry SQL logging settings), configure NAS devices with both servers, and on proxies use remote RADIUS server group priority and weight for failover and load sharing.
9. Roll back any step by re-importing the last known good export or returning one client to Audit or exception mode rather than disabling a protection globally.

Common misconfigurations

• A broad policy first: a policy matching Domain Users with any NAS type sits above the strict ones, so guest SSIDs and VPN share one decision.
• No server validation on clients: PEAP profiles that accept any certificate, letting a rogue access point collect domain credentials.
• One secret everywhere: the same shared secret on hundreds of switches, copied into templates, configuration backups and an unprotected export file.
• Blast-RADIUS left in Disable: event 4421 at every service start, ignored for years.
• Test settings in production: REQUIRE_USER_MATCH=FALSE left after the pilot, so anyone not registered for MFA gets VPN access with a password.
• Single NPS server: an outage takes down Wi-Fi and VPN together, so teams add an emergency PAP policy that is never removed.

Framework mapping

Practitioner checklist

• Review network policy order and conditions; add an explicit final deny and ignore dial-in properties.
• Make EAP-TLS the target method and enforce server certificate validation in every client profile.
• Give every RADIUS client a unique, random shared secret and treat NPS exports as secrets.
• Require Message-Authenticator on clients and remote servers, and move limitProxyState and requireMsgAuth to Enable after audit.
• Remove REQUIRE_USER_MATCH=FALSE and move VPN users from push to TOTP or certificate-based access.
• Renew NPS server and extension certificates on a tracked schedule, one certificate per server.
• Forward NPS security events, 4418 to 4421 and accounting logs to the SIEM and alert on denial bursts.
• Run at least two NPS servers with synchronised configuration and keep a protected last known good export.

Standards and references

• Microsoft Learn: Network Policy Server (NPS)
• Microsoft Learn: Integrate NPS with Microsoft Entra multifactor authentication
• Microsoft Learn: Configure certificate templates for PEAP and EAP requirements
• Microsoft Learn: Configure network policies
• Microsoft Learn: Configure Network Policy Server accounting
• Microsoft Learn: Export an NPS configuration for import on another server
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: RADIUS Security Guide · 802.1X and EAP-TLS Enterprise Wi-Fi Guide · VPN Security Guide · Secrets Management Guide