Create a Custom View for NPS in Event Viewer in Windows Server

Microsoft Logo

We use radius –  Network Policy Server (NPS) to authenticate wireless clients and wanted to create a custom view for NPS in Event Viewer in Windows Server.
Sucessful and failed events are logged into the Windows Security Log, howevere there are other events logged in here which can make it time consuming to search through for just NPS events.
Searching the internet gave a few interesting pointers but the problem seemed to be filtering by task category was not as straightforward as you would think.

Within Event Viewer there is the ability to create Custom Views…..

View

View

Right Click on Custom Views and select Create Custom View…..

Create Custom View

Create Custom View

You can then filter by many different criteria, however to get the correct Task Category for NPS you first of all need to select the By Source drop down list and select Microsoft Windows Security Auditing.This then enables the Task Category drop down list from which you can select Network Policy Server.You could then add further filter within the Event ID’s field, for example;
6273 for Network Policy Server denied access to a user6272 for Network Policy Server granted access to a user

Custom View Filter

Custom View Filter

 

You can also click the XML tab and enter the criteria manually…..

Custom View XML

Custom View XML

Here is the XML for NPS events…..

<QueryList>
<Query Id=”0″ Path=”Security”>
<Select Path=”Security”>*[System[Provider[@Name=’Microsoft-Windows-Security-Auditing’] and Task = 12552]]</Select>
</Query>
</QueryList>

I hope this information is of assistance to someone.

Good luck.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Post Navigation