Network Policy Server 2022: Unresolved Credential Expiry Handling in Least-Privilege Authentication

When configuring Network Policy Server (NPS) 2022 for least‑privilege access, administrators expect that a user’s expired password will immediately cause authentication to fail and that no cached token will be accepted. However, some deployments report intermittent failures, suggesting that NPS does not always propagate password‑expiry events to downstream services.

The goal is to ensure that expired credentials are handled consistently across the authentication pipeline, preventing unauthorized access while avoiding legitimate user lockout. Constraints include the need to keep the NPS configuration simple and to avoid custom scripting that could introduce new attack vectors.

Key uncertainty lies in whether NPS automatically rejects authentication for expired passwords, logs the appropriate event IDs, and signals downstream applications to terminate sessions.

Unresolved questions:

• Does NPS 2022 reject authentication attempts when a user’s password has expired, or does it allow cached tokens to succeed?
• When an expiration is detected, does NPS log Event ID 6273/6274 and notify downstream applications to terminate the session?
• What configuration changes, if any, are required to enforce immediate session termination upon credential expiry?