2

Running into something very painful. We use Microsoft's Network Policy Server, and need the Network Policy Server security event subcategory to work - specifically, event id 6273 and 6272. NPS works, but event logs are not being written.

We've verified the following:

Network Policy Server is configured to log success and failure events:

PS > auditpol /get /subcategory:"Network Policy Server"
System audit policy

Category/Subcategory                      Setting
Logon/Logoff
  Network Policy Server                   Success and Failure

PS > cat $env:systemroot\security\audit\audit.csv | select-string net

,System,Audit Network Policy Server,{0cce9243-69ae-11d9-bed3-505054503030},Success and Failure,,3

We've confirmed that NPS is configured to log these:

  • Open NPS > Right click NPS (Local) > Properties > General Tab, both Successful and Rejected authentication requests boxes are checked

Unacceptable workarounds:

Text logs. They are being written without issue, but we have a variety of services and tools configured to use the event log data that should be working

What we've tried:

  • Restarting :shrug:
  • Manually disable network policy server audit policy, re-enable
  • Disable network policy server configuration to log successful and rejected authentication requests
  • Pair the above with restarting eventlog and ias services

Regardless of any changes, no NPS events are written to the event log

I'm sort of at a loss, outside of diving into procmon, but I have no idea when/where this might be failing, so something so verbose may not be super helpful.

Thanks!

Cookie Monster
  • 182
  • 1
  • 2
  • 9
  • That's pretty peculiar - has this every worked before? Are you seeing other security events (I'm assume so)? – Lucky Luke Feb 04 '20 at 15:41
  • 1
    Yes, it's quite peculiar and somewhat infuriating! It functions now on a nearly identically configured server - this is one of two domain controllers that use NPS - all other events categories are functioning, it's just that NPS on this one server is not generating windows event logs. Even more fun? We ran into this on a 2012 R2 domain controller some time ago, just... never had the time to look into it. At this point, will remove/add the role and report back... – Cookie Monster Feb 05 '20 at 03:13
  • 1
    Maybe this helps - export the config on the working NPS server and import it on the broken one? https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-export – Lucky Luke Feb 05 '20 at 15:04
  • Did you ever get this working? – Lucky Luke Feb 10 '20 at 00:00

1 Answers1

0

I would try setting the logging to disabled, then enable it again (possibly with a reboot before enabling it again)

From an elevated command prompt:

To disable 

auditpol /set /subcategory:"Network Policy Server" /success:disable /failure:disable

To enable

auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
Dre
  • 1,375
  • 6
  • 12