So the next error I want to focus on is the error 812.
So I'm going to launch a VPN connection here.
And here you see using rasdial,
I've initiated a connection for my AlwaysOn VPN user‑based connection.
And by the way, you will only see 812 errors for user‑based connections,
not for device tunnel connections. Here,
it's basically saying that the error 812 means that the connection was
prevented because of a policy configured on your RAS or VPN server.
So to begin troubleshooting our 812 error,
we need to jump over to the NPS server,
and the first thing we're going to do here is open up the event log.
What I like to do here is expand Custom Views and then expand Server Roles
and then highlight Network Policy and Access Services.
And this will yield all the information that is pertinent to the NPS role.
So what I'm looking for here specifically is anything with the event
ID 6273 in the task category Network Policy Server.
And if I take a look at this error message,
you'll see that it indicates that the network policy
server denied access to a user.
What I find helpful here is that if you scroll down in this window, you
will actually see that there's a reason. There's a reason code and a
reason. And specifically it says the reason is the connection request did
not match any configured network policy.
What that means is that the user was not likely a member of the correct group.
Remember, our network policy is tied to a specific user group,
and if the user is not a member of that group,
then this access will fail.
Another common cause for the error 812 is an error in which the
Message‑Authenticator attribute is not valid.
And essentially what this means, what this really translates to in
plain English, is that the shared secret is incorrect.
So this means that the NPS server's RADIUS shared secret is not
matching what the VPN server is providing.
So if you see this event ID 18 from the event source NPS and you
see that an Access‑Request message was received from a client
with an invalid Message‑Authenticator,
you'll know intuitively that that is simply a mismatched shared secret.
And one last thing regarding error 812 messages, and it's really important to
understand that NPS communication failure between the VPN server and the RADIUS
server or NPS server can result in an error 812.
That can be really misleading because the error message specifically
states it's because of a policy on the NPS server.
But here again, if the VPN server is unable to communicate with the NPS server,
so that could mean that it's the firewall is blocking the traffic or that
it doesn't have a route to the NPS server or what have you or maybe even
just configured incorrectly on the VPN server,
all of those things will result in NPS communication
failure, and they will all result in an 812.
So it can be a little bit deceiving, somewhat misleading,
but be mindful of that.
If you're looking in the event logs on the NPS server and you don't
see an allowed or denied message in the event log, it's a good bet the NPS server simply did not receive that request.