Windows Event ID 6272 – Microsoft-Windows-Security-Auditing: Network Policy Server Granted Access

Start by examining the complete event details to understand the authentication context and client information.

1. Open Event Viewer on your NPS server or domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 6272 using the filter option
4. Double-click on a recent Event ID 6272 entry to view full details
5. Review the following key fields in the event description:
   • User Name: Identity of the authenticated user or device
   • Client Machine: Source device requesting access
   • Authentication Type: Method used (EAP-TLS, PEAP, etc.)
   • Network Policy Name: Applied policy that granted access
   • NAS IP Address: Network access server handling the request
6. Note the timestamp and session identifier for correlation with other events

Use PowerShell to extract and analyze Event ID 6272 entries for detailed network access reporting.

1. Open PowerShell as Administrator on your NPS server
2. Run this command to retrieve recent NPS access grants:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6272} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. For more detailed analysis, extract specific properties:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6272} -MaxEvents 100
$Events | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    $Properties = $EventXML.Event.EventData.Data
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        UserName = ($Properties | Where-Object {$_.Name -eq 'SubjectUserName'}).InnerText
        ClientMachine = ($Properties | Where-Object {$_.Name -eq 'CallingStationId'}).InnerText
        NASIPAddress = ($Properties | Where-Object {$_.Name -eq 'NASIPAddress'}).InnerText
        AuthenticationType = ($Properties | Where-Object {$_.Name -eq 'AuthenticationType'}).InnerText
    }
} | Export-Csv -Path "C:\Temp\NPS_Access_Grants.csv" -NoTypeInformation

4. Review the exported CSV file for access patterns and policy compliance

Verify that the network policies referenced in Event ID 6272 align with your intended access control configuration.

1. Open Network Policy Server management console
2. Navigate to Policies → Network Policies
3. Locate the policy name mentioned in the Event ID 6272 details
4. Right-click the policy and select Properties
5. Review the following policy settings:
   • Conditions: Verify user groups, device types, and time restrictions
   • Constraints: Check authentication methods and session limits
   • Settings: Confirm VLAN assignments and bandwidth restrictions
6. Cross-reference the policy settings with the user/device information from the event
7. Use PowerShell to export current network policy configuration:

Import-Module NetworkPolicy
Get-NpsNetworkPolicy | Select-Object PolicyName, ProcessingOrder, PolicySource, Enabled | Format-Table -AutoSize

8. Document any discrepancies between intended policy behavior and actual access grants

Analyze the authentication methods captured in Event ID 6272 to ensure strong security practices are being enforced.

1. Create a PowerShell script to analyze authentication method distribution:

$StartDate = (Get-Date).AddDays(-7)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6272; StartTime=$StartDate}

$AuthMethods = @{}
$Events | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    $AuthType = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'AuthenticationType'}).InnerText
    if ($AuthMethods.ContainsKey($AuthType)) {
        $AuthMethods[$AuthType]++
    } else {
        $AuthMethods[$AuthType] = 1
    }
}

Write-Host "Authentication Method Distribution (Last 7 Days):"
$AuthMethods.GetEnumerator() | Sort-Object Value -Descending | Format-Table Name, Value

2. Review the output to identify weak authentication methods
3. Check for certificate-based authentication usage:

$CertAuthEvents = $Events | Where-Object {
    $EventXML = [xml]$_.ToXml()
    $AuthType = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'AuthenticationType'}).InnerText
    $AuthType -like "*TLS*" -or $AuthType -like "*Certificate*"
}

Write-Host "Certificate-based authentications: $($CertAuthEvents.Count) out of $($Events.Count) total"
Write-Host "Certificate adoption rate: $(($CertAuthEvents.Count / $Events.Count * 100).ToString('F2'))%"

4. Generate a security posture report based on authentication strength
5. Review NPS server certificate configuration in HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13

Set up comprehensive monitoring for Event ID 6272 to detect unusual access patterns and potential security issues.

1. Create a scheduled task to monitor for suspicious access patterns:

# Create monitoring script: C:\Scripts\NPSMonitoring.ps1
$StartTime = (Get-Date).AddHours(-1)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6272; StartTime=$StartTime}

# Check for unusual access patterns
$ClientCounts = @{}
$Events | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    $Client = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'CallingStationId'}).InnerText
    if ($ClientCounts.ContainsKey($Client)) {
        $ClientCounts[$Client]++
    } else {
        $ClientCounts[$Client] = 1
    }
}

# Alert on clients with excessive authentication attempts
$SuspiciousClients = $ClientCounts.GetEnumerator() | Where-Object {$_.Value -gt 10}
if ($SuspiciousClients) {
    $AlertMessage = "Suspicious NPS activity detected. Clients with >10 authentications in last hour: $($SuspiciousClients.Name -join ', ')"
    Write-EventLog -LogName Application -Source "NPS Monitor" -EventId 1001 -EntryType Warning -Message $AlertMessage
}

2. Register the custom event source for monitoring alerts:

New-EventLog -LogName Application -Source "NPS Monitor"

3. Create a scheduled task to run the monitoring script:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\NPSMonitoring.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Hours 1) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "NPS Access Monitor" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

4. Configure Windows Event Forwarding to centralize NPS events across multiple servers
5. Set up custom views in Event Viewer for rapid analysis of access patterns