We use radius – Network Policy Server (NPS) to authenticate wireless clients and wanted to create a custom view for NPS in Event Viewer in Windows Server.
Sucessful and failed events are logged into the Windows Security Log, howevere there are other events logged in here which can make it time consuming to search through for just NPS events.
Searching the internet gave a few interesting pointers but the problem seemed to be filtering by task category was not as straightforward as you would think.
Within Event Viewer there is the ability to create Custom Views…..
View
Right Click on Custom Views and select Create Custom View…..
Create Custom View
You can then filter by many different criteria, however to get the correct Task Category for NPS you first of all need to select the By Source drop down list and select Microsoft Windows Security Auditing.This then enables the Task Category drop down list from which you can select Network Policy Server.You could then add further filter within the Event ID’s field, for example;
6273 for Network Policy Server denied access to a user6272 for Network Policy Server granted access to a user
Custom View Filter
You can also click the XML tab and enter the criteria manually…..
Custom View XML
Here is the XML for NPS events…..
<QueryList>
<Query Id=”0″ Path=”Security”>
<Select Path=”Security”>*[System[Provider[@Name=’Microsoft-Windows-Security-Auditing’] and Task = 12552]]</Select>
</Query>
</QueryList>
I hope this information is of assistance to someone.
Good luck.