Windows RADIUS question

[tantony]

This is not a Meraki question.  So I'm using RADIUS for VPN authentication.  Users are authenticated using their Active Directory account.  My question is, where in the Windows server NPS role can I see the login request for each user?  I'm assuming I need to go to some where in event viewer?

[BrechtSchamp · Accepted solution]

I think the combination of these links will help you:

https://www.mikenowak.org/nps-authentication-events-not-showing-event-log/

https://social.technet.microsoft.com/Forums/windows/en-US/45aa3000-c32b-483b-8d6e-565b56b163fc/how-t...

[tantony]

Thanks, the second link helped me. 

[PhilipDAth]

Typically I look in the "Security" log in Windows Event Viewer.  This will typically have so many entries it is also unusable.  Filter on these two event IDs "6272, 6273".  Now you can easily see what you want.

I'm also a big fan of "ADAudit Plus".  It has a nice GUI and will tell you when your users logged on and off - but also what things they accessed on your network.  All in a nice chronological order.

https://www.manageengine.com/products/active-directory-audit/