Security

Reply
MVP
Posts: 727
Registered: ‎03-25-2009

NPS 2008 - user auth and fails not showing in eventviewer?

Anybody have an idea what might be causing NPS 2008 to not show authentication events in eventviewer?
I've filtered on source "Microsoft Windows security auditing" and "NPS" but nothing shows up. I did also set a filter for event ID 6273, 1 and 2 as otherwise the eventviewer is spammed by non-radius events.

Even without the filters I cannot find the user authentication events anywhere.. so anybody got an idea?
Koen (ACMX #351 | ACDX #547 | ACCP)

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Guru Elite
Posts: 20,573
Registered: ‎03-29-2007

Re: NPS 2008 - user auth and fails not showing in eventviewer?

Go under Custom Views> Server Roles> Network Policy and Access Services.


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

MVP
Posts: 727
Registered: ‎03-25-2009

Re: NPS 2008 - user auth and fails not showing in eventviewer?

Ran into this with another customer today. Dug in a bit and found what I needed:

 

auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable


source: http://support.microsoft.com/kb/951005

 

SYMPTOMS

In Windows Server 2008, the Network Policy Server (NPS) may not log successful authentication events or failed authentication events in the Security log in Event Viewer. This behavior occurs even though Event Viewer is configured correctly to log such events.

This problem may occur on a fresh installation of Window Server 2008.

RESOLUTION

To resolve this issue, follow these steps:
  1. Click StartStart button, type cmd in the Start Search box, right-click cmd in the Programs list, and then click Run as administrator.

    User Access Control permission
    If you are prompted for an administrator password or for confirmation, type the password, or click Continue.
  2. At the command prompt, type the following command, and then press ENTER:
    auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable


Koen (ACMX #351 | ACDX #547 | ACCP)

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Search Airheads
Showing results for 
Search instead for 
Did you mean: