Ran into this with another customer today. Dug in a bit and found what I needed:
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
source: http://support.microsoft.com/kb/951005
SYMPTOMS
In Windows Server 2008, the Network Policy Server (NPS) may not log successful authentication events or failed authentication events in the Security log in Event Viewer. This behavior occurs even though Event Viewer is configured correctly to log such events.
This problem may occur on a fresh installation of Window Server 2008.
RESOLUTION
To resolve this issue, follow these steps:
- Click Start, type cmd in the Start Search box, right-click cmd in the Programs list, and then click Run as administrator.
If you are prompted for an administrator password or for confirmation, type the password, or click Continue. - At the command prompt, type the following command, and then press ENTER:
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable