NAP on windows 2012 throwing up same errors

Question

HI Team
I am getting the error while deploying NAP in our another branch. i have copied the same configuration and setting from our exisiting server which is running on windows server 2008. the error logs are as foolowing
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          11/18/2014 9:26:54 AM
Event ID:      6273
Task Category: Network Policy Server
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      xxxxxxx.xxx.com.pk
Description:
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
 Security ID:   NULL SID
 Account Name:   28-80-23-01-0f-4a
 Account Domain:   xxxx
 Fully Qualified Account Name: xxxxx\28-80-23-01-0f-4a
Client Machine:
 Security ID:   NULL SID
 Account Name:   -
 Fully Qualified Account Name: -
 OS-Version:   -
 Called Station Identifier:  ec-9a-74-a0-89-de
 Calling Station Identifier:  28-80-23-01-0f-4a
NAS:
 NAS IPv4 Address:  172.18.0.38
 NAS IPv6 Address:  -
 NAS Identifier:   Sui-IT-ROOM
 NAS Port-Type:   Ethernet
 NAS Port:   2
RADIUS Client:
 Client Friendly Name:  Sui Switches
 Client IP Address:   172.18.0.38
Authentication Details:
 Connection Request Policy Name: Secure Wired (Ethernet) Connections
 Network Policy Name:  -
 Authentication Provider:  Windows
 Authentication Server:  xxxxxxxxx.xxx.com.pk
 Authentication Type:  MD5-CHAP
 EAP Type:   -
 Account Session Identifier:  -
 Logging Results:   Accounting information was written to the local log file.
 Reason Code:   16
 Reason:    Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.
Event Xml:
<Event xmlns=http://schemas.microsoft.com/win/2004/08/events/event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>6273</EventID>
    <Version>1</Version>
    <Level>0</Level>
    <Task>12552</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2014-11-18T04:26:54.273019700Z" />
    <EventRecordID>228596</EventRecordID>
    <Correlation />
    <Execution ProcessID="648" ThreadID="7252" />
    <Channel>Security</Channel>
    <Computer>xxxxxxxxx.xxx.com.pk</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-0-0</Data>
    <Data Name="SubjectUserName">28-80-23-01-0f-4a</Data>
    <Data Name="SubjectDomainName">xxxxxx</Data>
    <Data Name="FullyQualifiedSubjectUserName">xxxxx\28-80-23-01-0f-4a</Data>
    <Data Name="SubjectMachineSID">S-1-0-0</Data>
    <Data Name="SubjectMachineName">-</Data>
    <Data Name="FullyQualifiedSubjectMachineName">-</Data>
    <Data Name="MachineInventory">-</Data>
    <Data Name="CalledStationID">ec-9a-74-a0-89-de</Data>
    <Data Name="CallingStationID">28-80-23-01-0f-4a</Data>
    <Data Name="NASIPv4Address">172.18.0.38</Data>
    <Data Name="NASIPv6Address">-</Data>
    <Data Name="NASIdentifier">Sui-IT-ROOM</Data>
    <Data Name="NASPortType">Ethernet</Data>
    <Data Name="NASPort">2</Data>
    <Data Name="ClientName">Sui Switches</Data>
    <Data Name="ClientIPAddress">172.18.0.38</Data>
    <Data Name="ProxyPolicyName">Secure Wired (Ethernet) Connections</Data>
    <Data Name="NetworkPolicyName">-</Data>
    <Data Name="AuthenticationProvider">Windows</Data>
    <Data Name="AuthenticationServer">xxxxxxx.xxx.com.pk</Data>
    <Data Name="AuthenticationType">MD5-CHAP</Data>
    <Data Name="EAPType">-</Data>
    <Data Name="AccountSessionIdentifier">-</Data>
    <Data Name="ReasonCode">16</Data>
    <Data Name="Reason">Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.</Data>
    <Data Name="LoggingResult">Accounting information was written to the local log file.</Data>
  </EventData>
</Event>

Answer 1

Hi Asad,
Based on the reason code, the user does not have valid credentials. And you are deploying NAP enforcement for 802.1x wired network.
In the event log, the Authentication Type is MD5-CHAP. If you choose CHAP to authenticate users, then in the event log, the Authentication Type is MD5-CHAP.
For NAP enforcement for 802.1x and NAP enforcement for VPN, in the process of configuring NPS as a NAP health policy server, we need to configure an Authentication Method. PEAP is the authentication method used with wireless access points and authentication
switches.
To configure PEAP, we must select a server certificate on the NPS server and we must configure an authentication type. There are two EAP types which you could choose,
Secure Password(PEAP-MS-CHAP v2) and Smart Card or other certificate(EAP-TLS).
If we configured Secure Password, we will see PEAP in the
Authentication Type of event log.
I have a test about configuring NAP enforcement for VPN. After all configurations was completed, I choose CHAP as authentication methods. Then connect to the VPN server. I encountered the same error, event 6273 with reason code 16. So please check the configuration
of the NAP client at first.
For more details to troubleshoot this issue and check all configurations about NAP enforcement, please refer to the articles below,
Event ID 6273 — NPS Authentication Status
http://technet.microsoft.com/en-us/library/cc735399(v=WS.10).aspx
Checklist: Configure NAP Enforcement for 802.1X Wired
http://technet.microsoft.com/en-us/library/cc730926(v=WS.10).aspx
Best Regards,
Tina