NPS and CA question. Server 2016

---

Hello,

once again I would love to participate from your knowledge.

I inherited an old 2008R2 DC with a CA and NPS running on it which serves as an RADIUS Server for a firewall/ wifi management. All NPS settings are a bit messy as there are old, unused settings in it as well and on top no ones knows the private key passphrase for the CA.

This is my last 2008R2 DC and I want to get rid of it and use the opportunity to clean up the mess.

My plan is to build up a new server which only purpose shall be to be a NPS/ Radius Server as I like to have my DCs clean of any other services. That server will be a domain member.

The NPS part is actually straight forward for me and I watched your 2012 videos about it which look like they transfer pretty well to 2016. But one question bugs me..

At "Policies - Connection Request Policies - Use Windows authentication for all users - Properties - Settings - Authentication" it says "Authenticate requests on this server".. Does this mean, that all authentication requests are only checked against the local user information or, as it is a domain member server, requests are checked against the domain user database? Or does this mean there always has to be a NPS on a domain controller? I am a bit confused by this…

I addition I have a question about the CA stuff.

I plan to build a new, local CA on the new server. So when users authenticate against the NPS they do need the cert of that NPS server, right? That is the cert I have to deploy so that no one gets an error message?!

Thanks!

Shifty,

I hope all is well. So.... NPS, Radius and CA's … Oh My... :)

Let's see what we can do to simply this for you.

First, let's start with a basic bit of information, but a VERY IMPORTANT piece:

When you are planning the user accounts database, you need to consider the following:

By default, if you join the server running NPS to an Active Directory domain, NPS performs authentication and authorization using the AD DS user accounts database. In some cases, such as with large networks that use NPS as a RADIUS proxy to forward connection requests to other RADIUS servers, you might want to install NPS on a non-domain member computer.

So, depending on the choice that you make, we would wind up with EITHER authentication against the domain we are a member of, or against a different domain that the Remote Radius server is a member of, based on the use of Remote Radius Server Groups.

Take a look at the following, and read through it carefully:

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-top

Specific to the CA / certs question. the short answer is YES.

Take a look at the following, as it will walk you through what you need and how to do it:

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-cert-requirements

Please let me know if you have additional questions as you work through your deployment.

Good Luck !!!

Cheers,

Adam

@Adam-Gordon I looked in all of this and I think I now have a good enough understanding on what to to! Thanks a lot.

Shifty,

Great !! If you need anything else, or have any other questions, just let us know.

Cheers,

Adam