NPS stopped working after May 2022 updates

Grt893 21 Reputation points
2022-05-12T08:31:13.247+00:00

Hello,

after installing the latest patch tuesday (May 2022) updates and restarting the servers the domain computers (Win 10) are not able to join to company's local network via ethernet or Wifi anymore. Both connection methods are using NPS with EAP and certificate based authentication.

Before installing the updates everything was working fine. This problem appeared right after installing the updates and rebooting the servers. No change in any settings regarding NPS or certificates were made before the problem started.

After installing the updates the NPS log stopped logging new events despite it seemed to be still enabled for both success and failure. I disabled and then re-enabled the logging and now it seems to log properly.

auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

Now the log event for every computer trying to join the company's local network seem to be this:

Event ID: 6273

Keyword: Audit Failure

Reason Code: 16

Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

What could be the causing this problem?

Thank you in advance!

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
11,163 questions
Accepted answer
  1. Vasyl Klyuyev 81 Reputation points
    2022-05-12T14:25:46.32+00:00

    For us the workaround was to add reg key here:
    HKLM\System\CurrentControlSet\Control\SecurityProviders\Schannel\

    value: CertificateMappingMethods
    Data Type: DWORD
    Data: 0x1F

    according to
    https://support.microsoft.com/en-gb/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16#bkmk_certmap

15 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Intranomics 116 Reputation points
    2022-07-08T14:02:22.28+00:00

    This can be resolved by making a copy of the domain CA "Computer" cert template with the right options and redeploying it to endpoints.

    We also created a new RAS IAS cert with new OID + Mappings for the NPS server.

    Subject Name Tab: Subject name format set to Common name, DNS name and SPN boxes are checked.

    219642-image.png

  2. Sebastian Cerazy 286 Reputation points
    2023-01-03T09:40:14.397+00:00

    I get these same errors AGAIN for Windows 11 clients (Windows 10 clients that have identical policy applied, connect fine) after December 2022 KB5021249 update on all NPS & DCs - all are Windows Server 2022

    The registry entry is already set (since May 22) to

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel

    with CertificateMappingMethods = 0x1F

    Authentication Details:  
 Connection Request Policy Name: NAP 802.1X (Wireless) - SP-WiFi  
 Network Policy Name: SP-WiFi - VLAN 110 Certificate Based Authentication (Staff)  
 Authentication Provider: Windows  
 Authentication Server: SP-V-NPS.domain.local  
 Authentication Type: EAP  
 EAP Type: Microsoft: Smart Card or other certificate  
 Account Session Identifier: 37373245413632423138353837323737  
 Logging Results: Accounting information was written to the local log file.  
 Reason Code: 16  
 Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.
    0 comments
  3. Sebastian Cerazy 286 Reputation points
    2023-01-03T12:34:22.08+00:00

    Turned out that needed to get NPS server(s) to do TSL 1.2 as per this:

    https://warlord0blog.wordpress.com/2017/02/09/tls-and-nps/
    https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-for-microsoft-eap-implementation-that-enables-the-use-of-tls-october-14-2014-d9ba4b83-b4e9-2c01-83a7-e42706e671af

    No idea why default for NPS on Server 2022 is not that already

    After NPS server reboot I get Windows 11 clients to connect again as nothing ever happened: Network Policy Server granted access to a user.

    0 comments