Checklist: Configure NPS as a RADIUS Proxy

Applies To: Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2

The following checklist provides the tasks required to configure Network Policy Server (NPS) as a Remote Authentication Dial-In User Service (RADIUS) proxy that forwards connection requests to other RADIUS servers for authentication and authorization.


Client computers, such as wireless portable computers and other computers running client operating systems, are not RADIUS clients. RADIUS clients are network access servers—such as wireless access points, 802.1X-capable switches, virtual private network (VPN) servers, and dial-up servers—because they use the RADIUS protocol to communicate with RADIUS servers such as Network Policy Server (NPS) servers.

Task Reference

Configure network access servers as RADIUS clients in NPS.

Add a New RADIUS Client; RADIUS Client

On the NPS proxy server, use the New Remote RADIUS Server Group Wizard to create a remote server group with one or more RADIUS servers to which RADIUS messages are forwarded. Configure RADIUS ports and shared secrets that are common to both the NPS proxy server and the RADIUS servers (to which requests are forwarded).

Add a Remote RADIUS Server Group and Remote RADIUS Server Groups

On the NPS proxy server, use the New Connection Request Policy Wizard to create a connection request policy to forward connection requests and accounting information to the remote RADIUS server group.

Add a Connection Request Policy and Connection Request Policies

Configure logging methods for user authentication and accounting requests.

RADIUS Accounting and Configure Log File Properties

Register the NPS proxy servers in Active Directory® Domain Services (AD DS) domains.

Register the NPS Server in Active Directory Domain Services

Configure the NPS proxy servers as RADIUS clients on the RADIUS servers (to which requests are forwarded).

Add a New RADIUS Client and your hardware documentation