Windows Event ID 6273 – Microsoft-Windows-Security-Auditing: Network Policy Server Granted Access

Start by examining the complete event details to understand the authentication context and client information.

1. Open Event Viewer on your NPS server or domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 6273 using the filter option
4. Double-click the event to view detailed information including:
   • User name and domain
   • Client IP address and MAC address
   • Authentication method used
   • Network policy name that granted access
   • Session identifier and timestamp
5. Note the Calling Station ID which typically contains the client's MAC address
6. Check the NAS-Identifier field to identify which network device processed the request

Use PowerShell to extract and analyze Event ID 6273 occurrences for patterns and trends.

1. Open PowerShell as Administrator on your NPS server
2. Query recent successful authentications:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6273} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='User';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*User Name:*'}) -replace '.*User Name:\s*',''}}, @{Name='ClientIP';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Client IP Address:*'}) -replace '.*Client IP Address:\s*',''}}

3. Filter events by specific user or time range:

   $StartTime = (Get-Date).AddHours(-24)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6273; StartTime=$StartTime}
   $Events | Where-Object {$_.Message -like '*john.doe*'}

4. Export authentication data for compliance reporting:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6273; StartTime=(Get-Date).AddDays(-7)} | Select-Object TimeCreated, @{Name='Details';Expression={$_.Message}} | Export-Csv -Path 'C:\Logs\NPS_Access_Granted.csv' -NoTypeInformation

Verify that the granted access aligns with your intended network policy configuration and security requirements.

1. Open Network Policy Server console from Administrative Tools
2. Navigate to Policies → Network Policies
3. Locate the policy name mentioned in the Event ID 6273 details
4. Review the policy conditions to ensure they match your security requirements:
   • User/Group membership requirements
   • Time-based access restrictions
   • Device compliance requirements
   • Location-based conditions
5. Check the policy constraints and settings:
   • Authentication methods allowed
   • Session timeout values
   • VLAN assignments or IP filters
   • Bandwidth limitations
6. Verify the policy processing order by checking the Processing Order column
7. Test policy changes in a controlled environment before production deployment

Implement monitoring to detect unusual authentication patterns that might indicate security concerns.

1. Create a PowerShell script to monitor authentication frequency:

   # Monitor for unusual authentication patterns
   $Yesterday = (Get-Date).AddDays(-1)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6273; StartTime=$Yesterday}
   
   # Group by user to identify high-frequency authentications
   $UserStats = $Events | ForEach-Object {
       $Message = $_.Message
       $User = ($Message -split '\n' | Where-Object {$_ -like '*User Name:*'}) -replace '.*User Name:\s*',''
       $ClientIP = ($Message -split '\n' | Where-Object {$_ -like '*Client IP Address:*'}) -replace '.*Client IP Address:\s*',''
       [PSCustomObject]@{
           User = $User
           ClientIP = $ClientIP
           TimeCreated = $_.TimeCreated
       }
   } | Group-Object User | Select-Object Name, Count | Sort-Object Count -Descending
   
   $UserStats | Where-Object {$_.Count -gt 100}

2. Set up scheduled tasks to run monitoring scripts and alert on anomalies
3. Configure Windows Event Forwarding to centralize NPS logs from multiple servers
4. Use registry settings to increase Security log size if needed:

   Set-ItemProperty -Path 'HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security' -Name 'MaxSize' -Value 0x6400000  # 100MB

Enable comprehensive NPS logging for detailed authentication flow analysis and advanced troubleshooting scenarios.

1. Configure NPS accounting and authentication logging:
   • Open Network Policy Server console
   • Right-click NPS (Local) and select Properties
   • Go to the Event Logging tab
   • Enable Success and failure events for both authentication and accounting
2. Enable detailed request logging:
   • Navigate to Accounting in the NPS console
   • Right-click Log File Properties
   • Configure log file format as IAS (Legacy) or DTS Compliant
   • Set appropriate log file rotation and size limits
3. Analyze NPS log files for detailed session information:

   # Parse NPS log files for authentication details
   $LogPath = 'C:\Windows\System32\LogFiles\IN*.log'
   $LogEntries = Get-Content $LogPath | Where-Object {$_ -like '*6273*' -or $_ -like '*Access-Accept*'}
   $LogEntries | Select-Object -First 10

4. Cross-reference Event ID 6273 with corresponding RADIUS accounting start/stop events (Event IDs 6272, 6274)
5. Use network packet capture tools like Wireshark to analyze RADIUS traffic if authentication issues persist