NPS: Override User-Name and User Identity Attribute

Question

After configuring NPS and using http://technet.microsoft.com/en-us/library/dd197535%28WS.10%29.aspx it's possible to authenticate based on MAC Addresses.
Is it by design that all authentication requests handled, are changed to MAC Address Authentication?
We want to have three Network Access Policies, two based on Active Directory Account, one based on MAC Address.
After entering the registry values and rebooting the server, it's only possible to authenticate based on MAC Address.
Do we need seperate NPS servers, one for MAC based authentication and one for A.D. account authentication?
Thank you in advance.

Answer 1

Hi GerardVU4,
Thank you for your post.
Is it by design that all authentication requests handled, are changed to MAC Address Authentication?
To always use the MAC address as the user identity, on the NPS server set the Override User-Name registry value to 1.
If you set Override User-Name to 1 and the User Identity Attribute to 31, the authenticating server can perform
only Automatic Number Identification/Calling Line Identification (ANI/CLI)-based authentication. Normal authentication by using authentication protocols, such as Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) and Extensible
Authentication Protocol (EAP), is disabled.
So please remove Override User-Name registry entry on your NPS server first.
Do we need separate NPS servers, one for MAC based authentication and one for A.D. account authentication?
No, you could set up three Network Access Policies on same NPS server.
Network Access Policies based on MAC Address, just select Authentication Methods PAP in policy Constraints TAB.
Network Access Policies based on Active Directory Account, Keep the default Authentication Methods MS-CHAP-v2& MS-CHAP.
If there are more inquiries on this issue, please feel free to let us know.
Regards,
Rick Tan