Windows Server 2022 – NPS rejects RADIUS requests with invalid authenticator – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

VPN or Wi-Fi authentications fail broadly, preventing user and device network access.

Environment & Reproduction

Usually follows network device firmware reset or RADIUS shared secret mismatch.

Get-WinEvent -LogName Security -MaxEvents 100 | ? {$_.Id -in 6272,6273}

Root Cause Analysis

Authenticator validation fails due to mismatched shared secret, packet alteration, or duplicate client definition.

Quick Triage

Verify NPS client entry and compare secret values with NAS device config.

Step-by-Step Diagnosis

Trace request source IP, policy match order, and message authenticator requirements.

netsh nps show client
netsh nps show np

Solution – Primary Fix

Recreate RADIUS client with correct secret and required authenticator settings.

# In NPS console: remove and re-add client with verified shared secret
Restart-Service IAS

Solution – Alternative Approaches

Temporarily route authentication to secondary NPS while primary policy is corrected.

Verification & Acceptance Criteria

Authentication success events (6272) observed for test users across all network segments.

Rollback Plan

Restore prior exported NPS policy XML if revised policies produce unexpected denies.

Prevention & Hardening

Use centralized secret rotation with dual-control and regular NPS config backups.

Related Errors & Cross-Refs

Check clock skew, certificate trust for EAP-TLS, and load balancer source NAT behavior.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: NPS troubleshooting, RADIUS shared secret practices, and EAP deployment guidance.