Windows NPS authentication failure

Understanding Your Setup​

Key Points from Your Logs:​

1. Connection Request Policy Name: Secure Wired Connections (SNN)
2. Network Policy Name: Empty (This indicates your policy did not match)
3. Authentication Type: MD5-CHAP
4. EAP Type: Not present (No EAP type means your policy isn’t firing)

   Problem​

   The error message indicates an "Authentication failed due to a user credentials mismatch." The client seems to be using MD5-CHAP, which is not supported by NPS, and since no EAP type is used, the policy you intended for controlling VLAN conditions isn't activated.

   Steps to Resolve​

5. Change the Authentication Method:
   • Switch to EAP: Update the configuration on the client-side to use an EAP method. Common choices include EAP-TLS (which requires certificates) or PEAP (Protected EAP), as these are compatible with NPS. You'll likely want PEAP, as it works well without requiring certificates for every client.
   []Network Policy for VLAN Return:
   • Create a new Network Policy in NPS that specifically checks if the connection is from an Ethernet source and returns a VLAN-ID.
   • Ensure this policy is set to be applied before any restrictive policies that might be denying access.
   []Adjust Connection Request Policy:
   • Make sure your Connection Request Policy allows for the new EAP method you plan to implement, as it must also match the request.
   []Testing:
   • After making these changes, attempt to connect again and check the NPS logs. Ensure that the EAP type appears correctly this time and that your Network Policy actually gets hit.
   []User Credentials:
   • Double-check that the user account you are testing with actually exists in AD, and that the credentials used on the client side are correct. If you implement these changes and still face issues, don't hesitate to reach out for more troubleshooting steps. Networking can be finicky, but with patience and tweaks, you'll get it working! Good luck!