Forum Discussion
NPS Logging - matching requests with accepts/rejects
Hi all, I want to monitor my NPS logs to see when VPN connections are made. I can see the requests (packet-type 1) contain the username of the user making the request but the accept and rejec...
DeletedNPS has a custom view in the event logs that shows successful and failed login attempts, complete with the policies that were used. Does this give you the info you need? Which logs are you trying to correlate?
- Thanks for the reply Mark (and sorry for the late response).
I have set NPS to log to an SQL Server database. I have set up a job to notify when a VPN connection is attempted.
Below are the two records created when a successful connection is made:
4215 2020-01-31 09:44:41.283 PACC-FS03 1 [USERNAME] [IP] VPN Users Authentication
4216 2020-01-31 09:44:41.283 PACC-FS03 2 [IP] VPN Users Authentication
Note the first request record contains the username used to authenticate the connection and the IP of the VPN server.
The second record is a connection successful record but has no username. The [IP] is the same for all users who connect.
I don't know whether all requests and success/reject records will have consecutive ID's (first field).
jcHi Deleted
Sorry for delayed reply. It looks like you're using the Accounting logs. Could you use the built in Event Logs to get the information you need?
Thinking rather than correlating events, this might be an easier way to obtain the information you require?