Onboarding Microsoft NPS logs

Microsoft Network Policy Server (NPS) is Microsoft’s implementation and extension of the RADIUS specifications. NPS allows you to manage and enforce organization-wide network access policies for connection requests.

Many RADIUS implementations store user credentials in clear text, making the server an attack vector and exposing the entire network to compromise. Hardening security and integrating these RADIUS servers with an external LDAP service requires considerable effort.

In comparison, NPS natively supports validating authentication requests with the local user accounts database (Security Accounts Manager (SAM)) and Microsoft Active Directory domain services. When NPS is part of an AD domain, it is possible to implement a single sign-on process where the same AD credentials are used for network authentication. Such an integrated solution is more secure, easier to manage, and one less set of credentials for users to remember. That’s really cool if you ask me!

As we already discussed, NPS is all about user authentication and authorization. We all know that authentication logs are the cornerstone of IT security, so there is no doubt that NPS/RADIUS logs should be on our collect list. These logs help us detect and respond to brute-force attacks, irregular login requests outside office hours, suspicious logins accessing critical resources, and so on. In addition, real-time security and threat management, threat-hunting, and meeting compliance mandates all require us to establish authentication logs collection and management.

You could also use NPS logs to automate network tasks. For instance, let’s say you have a wireless endpoint integrated with NPS to authenticate users and are tasked with granting IP-based network access through several firewalls as soon as the user authenticates successfully. With automatic log analysis, you can trigger a job to enable access according to the assigned IP address in the logs.

According to Microsoft, NPS creates two types of essential logs:

So, how do you collect all those logs and make sense of the data?

NPS supports RADIUS accounting logs, such as user authentication and accounting requests, in three formats:

The IAS and DTS Compliant log formats are the most commonly used, and Microsoft recommends the latter. The newer DTS Compliant XML format consists of complex records like the following:

Multiline logs like the one above are relatively complex to parse with many of the log collectors on the market.

In contrast, NXLog Enterprise Edition version 6.3 and newer support collecting and parsing all three log formats with the dedicated xm_nps extension. It allows you to collect NPS logs out of the box and convert them to another log format, such as JSON:

With NXLog Enterprise Edition, routing your NPS logs to a SIEM or long-term storage like Amazon S3 buckets, meeting compliance, and triggering automated network configuration and management tasks based on log data is easy. Give it a try, and get in touch with us if you need help building a solution for your use case!