The last thing I would suggest doing though,
however, is double‑click on this policy that we just created,
and you'll notice here that there is an option to
ignore user account dial‑in properties.
I suggest you check this box.
It is possible to defer to the Active Directory user
account to deny or allow access to the VPN.
There is an option on the Dial‑in properties tab of a user account in
Active Directory that allows you to control it there.
The problem with that is that it obviously doesn't scale very well.
If you want to selectively add and remove users,
you have to go find the user and check the box.
It's best to just create a group, put the users in the group.
If they're not in the group, they don't get access,
and you don't have to worry about it.
Selecting this option will save you some pain in the future if somehow
another administrator inadvertently checked that box,
and now all of a sudden one of your users can't connect,
and it's because we didn't check this box.
So go ahead and check this box and then click OK.
And finally,
we'll enable auditing on the NPS server so that we can
record all of the authentication events,
both success and failure.
So to do that,
we're going to run an auditpol command, the command that you see
there on your screen. I've copied and pasted here.
So the command is an auditpol command. We're going to set the
subcategory of Network Policy Server to enable auditing for
both success and failure events.
Once that's done,
it will help tremendously with our troubleshooting in the
future. If a user is denied access,
we can go into the security event log and find detailed information
about why the authentication request was rejected.
So one last critical bit of information for you.
If you've installed NPS on a Windows Server 2019 server,
there is a bug that exists only in Windows Server 2019 that
prevents NPS from working correctly out of the box.
This is not an issue on Server 2016 and earlier. It is
not an issue in Windows Server 2022.
It only affects Windows Server 2019.
That bug has not been fixed to this day, and so if you're
running NPS on Windows Server 2019,
you will have to run the following command: sc.exe sidtype IAS unrestricted.
And once that's done, you'll need to reboot the server and everything will work according to plan.