Network Policy Server Event ID 4421 - How To Enable RequireMsgAuth and limitProxyState?

Question

Hi Support,

We got this Envent ID 4421 warning: RequireMsgAuth and/or limitProxyState configuration is in Disable mode. These settings should be configured in Enable mode for security purposes. See https://support.microsoft.com/help/5040268 to learn more."

So we tried the steps posted on this link:

https://support.microsoft.com/en-us/topic/kb5040268-how-to-manage-the-access-request-packets-attack-vulnerability-associated-with-cve-2024-3596-a0e2f0b1-f200-4a7b-844f-48d1d5ab9e66

We tried adding the two configurations via registry editor from here:
https://learn.microsoft.com/en-us/answers/questions/2188614/enable-requiremsgauth-and-or-limitproxystate

Event logs still show this error when we restart the NPS services.

The following steps below says to open the Radius Server in the Radius Server Groups.

This section for us is blank.

The Radius Client section is configured.

I'm sure we're missing some configuration. Most likely the Radius Server Group?

How do we enable RequireMsgAuth and limitProxyState within the NPS GUI since it looks like the registry route didn't resolve this issue?

Any assistance is greatly appreciated.

Thank you very much,

Sonny

Answer 1

Hello,

Thank you for posting in Q&A forum.

According to the official documentation provided by Microsoft, you can use the netsh command prompt to configure RequireMsgAuth and limitProxyState. I suggest you complete all the configurations and see if the relevant error message still appears.

https://support.microsoft.com/en-us/topic/kb5040268-how-to-manage-the-access-request-packets-attack-vulnerability-associated-with-cve-2024-3596-a0e2f0b1-f200-4a7b-844f-48d1d5ab9e66#bkmk_configurations

I hope the information above is helpful.

Best regards

Zunhui

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Thank you very much Cole.

Not sure if this is the right solution; however, we went into NPS and disabled the RequireMsgAuth to resolve this issue. Since we're using Duo as a 2FA for the Radius server's VPN connection.