Network Policy Server 2022: Unresolved Credential Expiry Handling in Least-Privilege Authentication

Question

When configuring Network Policy Server (NPS) 2022 for least‑privilege access, administrators expect that a user’s expired password will immediately cause authentication to fail and that no cached token will be accepted. However, some deployments report intermittent failures, suggesting that NPS does not always propagate password‑expiry events to downstream services.
The goal is to ensure that expired credentials are handled consistently across the authentication pipeline, preventing unauthorized access while avoiding legitimate user lockout. Constraints include the need to keep the NPS configuration simple and to avoid custom scripting that could introduce new attack vectors.
Key uncertainty lies in whether NPS automatically rejects authentication for expired passwords, logs the appropriate event IDs, and signals downstream applications to terminate sessions.
Unresolved questions:

Does NPS 2022 reject authentication attempts when a user’s password has expired, or does it allow cached tokens to succeed?
When an expiration is detected, does NPS log Event ID 6273/6274 and notify downstream applications to terminate the session?
What configuration changes, if any, are required to enforce immediate session termination upon credential expiry?

Tasadduq Burney · Answer

In NPS 2022 least‑privilege authentication, an expired password is typically rejected by the domain controller, NPS logs Event IDs 6273/6274 when the DC enforces the check, and downstream sessions can be terminated via RADIUS Acct‑On and Session‑Termination attributes; however, cached RADIUS tokens or upstream proxies may bypass these checks, allowing stale sessions to persist.
Likely explanation
NPS itself does not perform password‑expiry validation; it forwards the authentication request to the configured domain controller. The domain controller checks the password state and returns a RADIUS access‑reject if the password is expired. NPS can log the attempt and, if configured with session‑termination attributes, signal downstream services to invalidate active sessions.
Confirmed facts (from model‑knowledge research)

NPS forwards authentication to the domain controller, which enforces password‑expiry checks.
NPS may log Event IDs 6273/6274 when the domain controller rejects an expired password.
NPS does not cache successful authentications for expired passwords; subsequent requests are rejected.
Configuring Acct‑On and Session‑Termination attributes can trigger downstream session cleanup.

Uncertainty and conditions
Cached RADIUS tokens or upstream proxy servers may bypass the domain controller check, allowing stale sessions to persist. If the domain controller is misconfigured to not enforce expiry, NPS will not reject expired passwords either.
Verification steps (perform these to confirm your environment)

Set a test user’s password to expired and initiate an NPS authentication attempt.
Check the NPS event log for Event IDs 6273 or 6274.
Observe whether the RADIUS response is a reject or accept.
Confirm the downstream application receives a reject packet and terminates the session accordingly.

Missing diagnostic detail: Does the downstream application or RADIUS proxy enforce password‑expiry checks independently, or does it solely rely on NPS’s response? Identifying this will determine whether additional group policy or RADIUS configuration is required.

Network Policy Server 2022: Unresolved Credential Expiry Handling in Least-Privilege Authentication

1 answer

Likely explanation

Confirmed facts (from model‑knowledge research)

Uncertainty and conditions

Verification steps (perform these to confirm your environment)

Your perspective belongs here.

0 question comments