Skip to content
Docs sslbrain sslbrain.com

Network Policy Server (NPS)

Copy link to the page “Network Policy Server (NPS)”

← All integrations

Windows · Identity and remote access

Renews the certificate NPS uses for PEAP and EAP-TLS in the network policies you select, restarting only IAS.

The service agent on the server fetches the task from the appliance over outbound HTTPS on port 443 and installs the certificate locally on the server. The appliance never connects to the server.

What happens

  1. The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
  2. The Windows basics first import the certificate into the Windows certificate store (LocalMachine\My).
  3. Before anything changes, every selected policy and the certificate are checked. Each policy must reference exactly one certificate. The certificate must be RSA 2048, 3072 or 4096 bits with a private key that signs on the server, a Subject with a value, Server Authentication and a validity period that covers now. If it fails: Nothing changes. The result names the policy or the requirement, without the configuration contents and without shared secrets.
  4. Scheduled tasks the package takes over are disabled and their running instances stopped. The configuration is saved as a restore point, only the selected policies are written with netsh nps set np, a new export proves the change, and only the IAS service is restarted. RADIUS authentication pauses while IAS restarts. If it fails: The previous values are written back and proven by a new export, IAS runs again, and the tasks the package disabled are enabled again. Later, rollback puts the previous certificate back in the policies that still hold what the deploy wrote.
  5. Verification: the package exports the configuration and checks that the selected policies reference only the new certificate, that it is in LocalMachine\My with a usable private key, and that IAS runs. RADIUS and EAP run over UDP without a TLS listener of their own, so there is no TLS handshake to check. A fresh EAP login is your own check.

Technical details

Connection
The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
You need
The service agent installed on the server. The agent runs on the NPS server itself with local administrator rights. The Windows basics (windows-cert-install) import the certificate into LocalMachine\My in the same task and hand its thumbprint to the NPS package.
Platform
Windows Server 2012 to 2025 with the Network Policy and Access Services role (Desktop Experience)
Actions
Discovery, Installation, Verification, Rollback
Packages
windows-nps 1.0.0
Note
  • Discovery lists every network policy with its EAP types and the thumbprint of the certificate it uses, the LocalMachine\My certificates the policies reference, the IAS service with the running services that depend on it, and scheduled tasks that also change NPS. Each policy and task has a ready selectionValue. Put the selectionValue of the policies to renew in PolicyNames, separated by commas, at most 1000 characters. Inside a name, the characters , % ; | ` $ < > and control characters are written as %XX; selectionValue already does this. A name that matches no policy or two, or a policy that uses no certificate or more than one, changes nothing. TakeOverTasks is only for a task that also renews another service, and takes its selectionValue in the same form.
  • Selecting the policies is the choice to take them over: a scheduled task that changes only NPS, for a selected policy or without naming a policy, is disabled and its running instance stopped before the change, with no extra setting. That includes an ACME client renewal task (for example Posh-ACME or Certify) whose only installation step that discovery sees is NPS, and a task that runs scripts that could not all be read (scripts on a network share included). The result names both. The package waits up to 60 seconds for no instance to run, or changes nothing. A task that also installs certificates in another service (IIS, HTTP.sys, Remote Desktop, Exchange) can only be disabled as a whole by Windows, which stops those renewals too. While such a task, for a selected policy or without naming a policy, is enabled or running, the deploy changes nothing and the message names the task. Remove its NPS step, or name it in TakeOverTasks with the selectionValue the message gives, and the whole task is disabled. Tasks are never deleted or started, and rollback enables the ones the deploy disabled. Discovery finds NPS commands in the task's command line and in the local script files it runs, and lists the ACME client tasks it finds. Commands loaded from a PowerShell module and an NPS step kept in an ACME client's own renewal settings are not seen. Remove such a step in the client.
  • Certificate autoenrollment is reported and left unchanged. Once the policy references the new certificate, NPS no longer follows the autoenrolled one.
  • Only IAS is restarted, with Stop-Service without -Force. If other running services depend on IAS, Windows refuses to stop it. The package then writes the previous configuration back, stops no other service and reports ias_restart_refused. If IAS was stopped before the deploy, the policies are changed and IAS stays stopped. NPS uses the certificate when IAS starts.
  • An NPS export contains the RADIUS clients' shared secrets in plain text. Exports are written to a folder only SYSTEM and Administrators can open and are deleted before the result. The secrets never appear in a result or log. The restore point of each change is kept in %ProgramData%\sslbrain-windows-nps, which only SYSTEM and Administrators can open, and the newest 10 are kept. If another account owns that folder, it is not used and nothing changes. Protect copies of that folder as you protect the shared secrets. If the previous values cannot be written back, the package imports its own restore point, but only when nothing outside the selected policies changed in the meantime. An export does not contain SQL Server logging, so check it after such an import. One change runs at a time per server. An interrupted run is picked up by the next: it restarts IAS, and scheduled tasks the interrupted run disabled are named in the result and enabled again by a rollback or a failure.
  • Rollback needs the previous certificate still in LocalMachine\My with a usable private key. It changes only policies that still hold what the deploy wrote. If a policy has changed since, rollback is refused, nothing changes, and the result names the tasks the deploy disabled, which stay disabled.
  • Clients check the new certificate as they checked the old one. A client that trusts the server through a thumbprint in its Wi-Fi or VPN profile, for example after a user accepted a prompt, asks again or refuses to connect. A profile that names trusted root CAs or server names must include the new certificate's root and a name the certificate has. Update the profiles through Group Policy or MDM before you switch to a certificate from another CA.
  • Verification proves the configuration, the certificate with its private key and the IAS service on the server. Whether a client completes EAP with the new certificate shows in a real login: eapol_test against the NPS server from a test host you add in NPS as a RADIUS client, or a Windows client that has forgotten the network. Clients keep NPS's TLS handle for 10 hours by default (Windows 10 and Windows Server 2016), so a connected client can reconnect without full authentication and see the new certificate only later.

Certificate requirements

The agent accepts RSA 2048, 3072 and 4096 bits. Microsoft's example for the NPS server certificate is an RSA key of at least 2048 bits with SHA-256. ECDSA is not documented for the NPS server certificate, so the agent does not accept it. Microsoft states no maximum key size; 4096 is the largest the agent accepts.

The Subject must contain a value: NPS does not offer a certificate with an empty Subject. Microsoft does not say Common Name (CN). A public DV certificate carries at most the CN in its Subject, so a profile without a CN (Let's Encrypt tlsserver and shortlived, Google Trust Services minimal) gives an empty Subject. The agent therefore requires a CN, and sslbrain orders with the CA's default profile, which carries one. At Let's Encrypt the first DNS name must be shorter than 65 characters to become the CN. The CN requirement is sslbrain's inference from the Subject rule.

The certificate needs the Server Authentication extended key usage (1.3.6.1.5.5.7.3.1). Client Authentication is required of client certificates in EAP-TLS, not of the NPS server certificate. Microsoft states no key usage requirement, such as keyEncipherment, for the server certificate.

If the certificate has a Subject Alternative Name (SAN), it must contain the NPS server's DNS name. Clients that validate the server name must have a name from the certificate in their profile. The agent reports it, without refusing, when the SAN lacks the server's name. Microsoft documents no rule for IP addresses in SAN (IP-SAN) or for the number of SAN entries.

Wildcard: Windows 11 supports a wildcard DNS name in SAN as earlier Windows versions do, and no longer rejects a wildcard in the CN outright, as earlier Windows did. Microsoft recommends the DNS name in SAN. The agent reports a wildcard name without refusing it.

windows-nps imports nothing: the Windows basics (windows-cert-install) import the PFX or other format into LocalMachine\My and hand over the thumbprint, and NPS selects the certificate by thumbprint. PFX encryption (3DES or AES), chain order and whether the root is included belong to that import, not to NPS. NPS has no friendly name rule.

The chain must lead to a root CA the clients trust, and where the client profile lists trusted roots, that root must be among them. The agent reports it when the server cannot build the chain.

Microsoft documents no minimum or maximum lifetime for the NPS server certificate. It must be valid now. When the certificate a policy uses expires, that policy's clients cannot authenticate until it references a valid certificate.

Versions: NPS does not support TLS 1.3, so PEAP and EAP-TLS use TLS 1.2 with NPS. Windows 11 21H2 compares the server name case-sensitively, 22H2 and later do not. The agent exports with Export-NpsConfiguration and uses netsh nps export on servers without that cmdlet.

Get started