Windows Server / Services, IIS & Secure Operations
Find the policy reason for an NPS authentication rejection
A VPN or wireless login can reach NPS and still be rejected by authentication or network policy. Collect the actual reason code.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6273; StartTime=(Get-Date).AddHours(-2)} -MaxEvents 30Read the result
On the NPS server with relevant auditing enabled and authorized access, the event identifies recorded denial context. Missing events can reflect logging configuration.
Resolve and verify
Match the request source, identity and reason with the intended policy, certificate and directory state. Repair the demonstrated dependency and validate one controlled login.
Before changing production
Do not broaden all network policies or disable certificate checks merely because authentication fails.