Windows Server 2019 — NPS RADIUS service rejects all authentication requests — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Network Policy Server on Windows Server 2019 starts but rejects every RADIUS request, so VPN, 802.1X, and Wi-Fi authentication all fail. Users cannot access wireless or remote access services and helpdesk volume spikes.

Environment & Reproduction

Reproduce after a policy change, certificate renewal, or AD trust modification. Inspect NPS accounting log and Security log entries.

Get-Service -Name nps
Get-WinEvent -LogName System -MaxEvents 40
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Root Cause Analysis

Causes include shared secret drift between NPS and clients, expired server certificate for PEAP/EAP, missing AD user-account dial-in permissions, or broken connection request policies.

Quick Triage

Capture failing request authenticator identity, the policy that matched, and the rejection reason before remediation.

sc.exe query nps
Get-Service -Name nps | Select-Object Status,StartType
Get-EventLog -LogName System -Newest 30 | Where-Object {$_.Source -match 'nps'}

Step-by-Step Diagnosis

Read NPS events, list connection request and network policies, and validate the server certificate chain.

Get-WinEvent -LogName System -MaxEvents 50 | Where-Object {$_.ProviderName -match 'nps'} | Select TimeCreated,Id,LevelDisplayName,Message
sc.exe qfailure nps
sfc /verifyonly

Solution — Primary Fix

Reissue shared secrets, bind the correct server certificate, and reorder policies so the expected one matches first.

Restart-Service -Name nps -Force
Get-Service -Name nps | Select-Object Status,StartType
Get-WinEvent -LogName System -MaxEvents 20 | Where-Object {$_.ProviderName -match 'nps'}

Solution — Alternative Approaches

If the policy database is corrupt, reset NPS via netsh nps reset and re-import a known-good configuration.

sc.exe config nps start= auto
sc.exe failure nps reset= 86400 actions= restart/60000/restart/60000/run/1000
Restart-Service -Name nps -Force

Verification & Acceptance Criteria

Test users authenticate, NPS events show Access-Accept, and accounting records flow into the configured store.

Get-Service -Name nps
Get-WinEvent -LogName System -MaxEvents 25 | Where-Object {$_.ProviderName -match 'nps' -and $_.LevelDisplayName -eq 'Error'}
Test-NetConnection -ComputerName localhost -Port 

Rollback Plan

Restore the previous NPS configuration export and re-add the prior certificate.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
wbadmin get versions
# Restore previous configuration export if available

Prevention & Hardening

Document shared secrets in a secrets store, monitor certificate expiry, and dry-run policy changes in a lab.

Get-Service -Name nps | Export-Clixml C:/Temp/nps-baseline.xml
Get-WinEvent -LogName System -MaxEvents 50 > C:/Temp/nps-events.txt
Get-ScheduledTask | Where-Object {$_.TaskName -match 'nps'}

Related Errors & Cross-Refs

Often correlates with events 6273, 6274, and TLS handshake errors in Schannel.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn references for NPS troubleshooting and policy ordering on Windows Server 2019.