NPS role installed but EAP-TLS (method 13) not available on Windows Server 2022 VM

Question

We are deploying a Network Policy Server (NPS) on a fresh Windows Server 2022 Datacenter (Azure Edition) VM running in Azure, intended to act as a RADIUS server for 802.1X Wi-Fi authentication using EAP-TLS.

Even though the NPS role installs successfully, the option “Microsoft: Smart Card or other certificate (EAP-TLS)” does not appear under EAP Types when configuring a Network Policy. Only Protected EAP (PEAP) and Microsoft Secured Password (MS-CHAP v2) are shown.

We have already validated the following:

rastls.dll is present in C:\Windows\System32.

A valid public certificate is installed in LocalMachine\My with:

Subject is not empty (CN is set)

  EKU includes **Server Authentication (1.3.6.1.5.5.7.3.1)**
  
     Key Usage includes **Digital Signature, Key Encipherment (a0)**
     
        Private key is present (`HasPrivateKey = True`) and `NETWORK SERVICE` has read permissions on the key container.
        
           Intermediate and root CA certificates are installed and trusted.
           
           NPS role and management tools installed using: `Install-WindowsFeature -Name NPAS,CMAK,RemoteAccess,Routing,RSAT-RemoteAccess,RSAT-RemoteAccess-Mgmt -IncludeManagementTools`
           
           Services `EapHost`, `RasMan` and `IAS` are present and running.
           
           **Registry keys are missing**:
           
              `HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Methods\13` does not exist.
              
                 `HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13` does not exist.
                 

Expected result: EAP-TLS (method 13) should be registered and available as “Microsoft: Smart Card or other certificate” inside NPS → Network Policy → Constraints → Authentication Methods → EAP Types.

Actual result: Method 13 is not present and cannot be selected.

Goal: Enable EAP-TLS for 802.1X Wi-Fi authentication using computer certificates issued via Intune Cloud PKI.

Environment details:

OS: Windows Server 2022 Datacenter - Azure Edition

Build: 20348.4171

VM size: Standard B2ms

Network: Private IP only, no public IP

NPS and EAP roles installed

• Azure Bastion used for management accessWe are deploying a Network Policy Server (NPS) on a fresh Windows Server 2022 Datacenter (Azure Edition) VM running in Azure, intended to act as a RADIUS server for 802.1X Wi-Fi authentication using EAP-TLS. Even though the NPS role installs successfully, the option “Microsoft: Smart Card or other certificate (EAP-TLS)” does not appear under EAP Types when configuring a Network Policy. Only Protected EAP (PEAP) and Microsoft Secured Password (MS-CHAP v2) are shown. We have already validated the following:
  • rastls.dll is present in C:\Windows\System32.
  • A valid public certificate is installed in LocalMachine\My with:
    • Subject is not empty (CN is set)
    • EKU includes Server Authentication (1.3.6.1.5.5.7.3.1)
    • Key Usage includes Digital Signature, Key Encipherment (a0)
    • Private key is present (HasPrivateKey = True) and NETWORK SERVICE has read permissions on the key container.
    • Intermediate and root CA certificates are installed and trusted.
  • NPS role and management tools installed using:
    Install-WindowsFeature -Name NPAS,CMAK,RemoteAccess,Routing,RSAT-RemoteAccess,RSAT-RemoteAccess-Mgmt -IncludeManagementTools
  • Services EapHost, RasMan and IAS are present and running.
  • Registry keys are missing:
    • HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Methods\13 does not exist.
    • HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 does not exist.
  Expected result:
  EAP-TLS (method 13) should be registered and available as “Microsoft: Smart Card or other certificate” inside NPS → Network Policy → Constraints → Authentication Methods → EAP Types. Actual result:
  Method 13 is not present and cannot be selected. Goal:
  Enable EAP-TLS for 802.1X Wi-Fi authentication using computer certificates issued via Intune Cloud PKI. Environment details:
  • OS: Windows Server 2022 Datacenter - Azure Edition
  • Build: 20348.4171
  • VM size: Standard B2ms
  • Network: Private IP only, no public IP
  • NPS and EAP roles installed
  • Azure Bastion used for management access

Answer 1

Hello William,

From your description, the certificate setup looks solid, and the presence of rastls.dll confirms that the EAP-TLS module is available. However, the absence of registry keys under EapHost\Methods\13 and RasMan\PPP\EAP\13 suggests that EAP-TLS is not properly registered on the system.

This can happen if the EAP-TLS component wasn’t installed correctly or was skipped during the initial setup. To resolve this, try running the following command to explicitly register EAP-TLS:

powershell:

regsvr32 rastls.dll

After registration, restart the EapHost and IAS services, then recheck the EAP Types list in NPS. You should see the missing option appear. If not, verify that the system has the EAP-TLS Authentication Method installed via the Add Roles and Features Wizard, or manually add the registry entries if needed.

Also, ensure that the server has access to the full set of Windows updates—some EAP modules are updated or patched via servicing channels, especially in Azure Edition builds.

I hope this helps you move forward with your deployment. If this guidance gets things working, feel free to hit “Accept Answer”—always great to know when the solution lands well 😊

T&B, Harry.