NPS Logging - matching requests with accepts/rejects

[whatwaht]

Hi all,

I want to monitor my NPS logs to see when VPN connections are made.

I can see the requests (packet-type 1) contain the username of the user making the request but the accept and reject records (packet-types 2 and 3) do not contain a username, nor any other information I could use to match the request to the accept/reject record.

The ID's do appear consecutively, but could I trust this is always the case?  Is there perhaps another setting to enable more information in the logs?

cheers

jc

[#2]

@whatwahtNPS has a custom view in the event logs that shows successful and failed login attempts, complete with the policies that were used. Does this give you the info you need? Which logs are you trying to correlate? 

[#3]

Thanks for the reply Mark (and sorry for the late response).

I have set NPS to log to an SQL Server database. I have set up a job to notify when a VPN connection is attempted.
Below are the two records created when a successful connection is made:

4215 2020-01-31 09:44:41.283 PACC-FS03 1 [USERNAME] [IP] VPN Users Authentication
4216 2020-01-31 09:44:41.283 PACC-FS03 2 [IP] VPN Users Authentication

Note the first request record contains the username used to authenticate the connection and the IP of the VPN server.
The second record is a connection successful record but has no username. The [IP] is the same for all users who connect.

I don't know whether all requests and success/reject records will have consecutive ID's (first field).

jc

[#4]

Hi @whatwaht 

Sorry for delayed reply. It looks like you're using the Accounting logs. Could you use the built in Event Logs to get the information you need?

Thinking rather than correlating events, this might be an easier way to obtain the information you require?