RADIUS & NPS error library
Each page explains one failure signature the way a colleague would: what it actually means, why it happens, and the exact next thing to check.
Windows NPS reason codes
A reference to Windows NPS Event 6273 reason codes — the numbers in the Network Policy Server log when authentication is rejected. Each code below links to what it actually means and the first thing to check.
- NPS Event 6273 Reason Code 7 — 'the specified domain does not exist'
Why NPS says the domain does not exist: usernames with the wrong realm, personal email addresses typed as identities, NetBIOS vs DNS domain names, and DC locator failures.
- NPS Event 6273 Reason Code 8 — 'user account does not exist' (it does)
Why Windows NPS says the specified user account does not exist even when you can see it in AD: username format mismatches, host/ machine identities, and cross-domain lookups.
- NPS Event 6273 Reason Code 16 — often not the password
What 'Authentication failed due to a user credentials mismatch' actually means in Windows NPS, the three causes that produce it, and the exact fields in the event that tell you which one you have.
- NPS Event 6273 Reason Code 22 — 'EAP type cannot be processed'
Why NPS rejects clients with 'the EAP type cannot be processed by the server' — expired NPS certificates, PEAP vs EAP-TLS mismatches, and corrupted EAP policy config.
- NPS Event 6273 Reason Code 23 — EAP error = your NPS certificate
Decoding NPS Reason Code 23: why 'check EAP log files' almost always means the NPS server's own certificate is expired, missing its private key, or failing revocation checks.
- NPS Event 6273 Reason Code 36 — account locked out by the Wi-Fi
Why NPS rejects with 'the account is locked out', how a stale cached Wi-Fi password causes the lockout loop, and the neighboring reason codes 34, 35, 37, 38 for disabled/expired accounts.
- NPS Event 6273 Reason Code 48 — no network policy matched
Why 'The connection request did not match any configured network policy' happens even when the user and password are right: group scoping, computer vs user objects, NAS Port Type conditions, and policy ordering.
- NPS Event 6273 Reason Code 49 — no connection request policy
What it means when a RADIUS request fails to match any NPS connection request policy: deleted default CRPs, day/time and NAS conditions, and proxy realm rules.
- NPS Event 6273 Reason Code 65 — denied by dial-in permission
Why one user gets rejected by NPS while everyone else connects: the AD account's Dial-in tab set to Deny access, the msNPAllowDialin attribute, and the policy checkbox that overrides it.
- NPS Event 6273 Reason Code 66 — auth method not enabled
Decoding 'the user attempted to use an authentication method that is not enabled on the matching network policy': EAP mismatches mid-migration, non-EAP fallbacks, and requests matching the wrong policy.
- NPS Event 6273 Reason Code 262 — 'signature not verified' = secret
Why 'The supplied message is incomplete. The signature was not verified' in Windows NPS is a shared secret mismatch, and how to find which RADIUS client entry is at fault.
- NPS Event 6274 'discarded the request' — not a reject
The difference between NPS event 6273 (denied) and 6274 (discarded), and the causes of discards: unverifiable packets, malformed requests, and accounting problems.
- NPS Reason Code 48 vs 49 — which policy layer rejected you
The two 'no policy matched' rejects in Windows NPS compared: connection request policies vs network policies, how to tell them apart in seconds, and which console tab to open for each.
FreeRADIUS: EAP, TLS & certificates
A FreeRADIUS error reference for the EAP-TLS handshake: the certificate, TLS-alert, and EAP-fragmentation failures you see in radiusd -X output, with the exact log line and how to read it.
- FreeRADIUS 'certificate expired' TLS alert — server or client cert?
Diagnosing expired-certificate failures in radiusd -X: everyone failing at once means the server certificate; one device means a client cert or its clock. Commands to check both.
- FreeRADIUS 'TLS Alert unknown CA' — client distrusts your cert
What the unknown CA alert in radiusd -X debug output means, why the client (not the server) is rejecting the handshake, and the three trust problems that cause it.
- FreeRADIUS EAP stalls mid-handshake — the fragment-size fix
Why 802.1X authentications hang partway through the TLS handshake: oversized RADIUS packets carrying certificate fragments get dropped, the NAS retransmits, and the client never answers. Diagnosis and the fragment_size fix.
- FreeRADIUS TLS version mismatch — tls_min_version & old devices
Diagnosing generic TLS handshake failures in radiusd -X: printers and embedded devices stuck on TLS 1.0/1.1 against servers enforcing TLS 1.2+, cipher mismatches, and users cancelling trust prompts.
FreeRADIUS: authentication & clients
FreeRADIUS authentication and client errors — rejected logins, MSCHAP mismatches, LDAP bind failures, and unknown-client messages — explained with the concrete next check for each.
- FreeRADIUS 'invalid Message-Authenticator' — shared secret
Why FreeRADIUS drops packets with an invalid Message-Authenticator, how to find which clients.conf entry is actually being used, and the NAT trap that keeps this error alive after you've fixed the secret.
- FreeRADIUS 'Login incorrect' — find the real reason in radiusd -X
'Login incorrect' is the summary line, not the diagnosis. How to walk a FreeRADIUS debug log backwards from the reject to the module that actually failed, with the patterns to grep for.
- FreeRADIUS 'MS-CHAP2-Response is incorrect' — the real causes
What the mschap FAILED error in radiusd -X really means: the TLS tunnel is fine, and the inner MSCHAPv2 check failed — because of the password, the stored hash format, or the AD account state.
- FreeRADIUS 'No known good password' — nothing to check against
What 'Failed to find known good password' in radiusd -X means: no authorize module supplied a password, the stored hash is incompatible with the auth method, or the lookup silently missed.
- FreeRADIUS 'unknown client' — why the NAS times out, not fails
What it means when radiusd -X shows 'Ignoring request to auth address from unknown client': the missing clients.conf entry, multi-homed NAS source IPs, and why the client side only sees timeouts.
- FreeRADIUS rlm_ldap bind failed — admin bind vs user bind
Troubleshooting 'LDAP bind failed' errors in FreeRADIUS: wrong bind DN credentials, LDAPS/StartTLS certificate trust, unreachable directory, and the difference between the service bind and per-user authentication binds.
Authorization, VLANs & enforcement
The failures that happen after the login succeeds: the Access-Accept was returned, but the VLAN, ACL, role, or session keys didn't take. Dynamic VLAN not applied, Filter-Id ignored, MAC Auth Bypass not matching, and MPPE keys stripped in transit — why an authenticated device still can't get on the network.
- EAP succeeds but Wi-Fi won't connect — MPPE keys stripped by the proxy
The RADIUS log shows a clean EAP success, yet the client never associates on WPA2-Enterprise. The access point never got the session keys — a RADIUS proxy dropped the MS-MPPE-Send/Recv-Key VSAs, or a shared-secret mismatch corrupted them.
- MAC Authentication Bypass not working — why MAB is rejected
A printer or camera on MAB gets rejected or mis-VLANed while 802.1X users work. Usually the MAC-address format doesn't match your allow-list, or the policy keys on the wrong Service-Type — MAB arrives as Call-Check, not a normal user login.
- RADIUS dynamic VLAN not working — device lands on the default VLAN
802.1X authenticates but the device stays on the native/default VLAN. The usual cause is the RADIUS policy returning only Tunnel-Private-Group-Id without the two companion attributes — plus the VLAN-doesn't-exist and wrong-type traps.
- RADIUS Filter-Id not applied — the ACL name the NAS quietly ignores
The Access-Accept carries Filter-Id (or a Cisco-AVPair/Aruba role) but the ACL never takes effect. Almost always the named filter doesn't exist on the NAS, or the name doesn't match exactly — RADIUS sends the label, not the rules.
Connectivity & timeouts
When the RADIUS server never logs the request at all: timeouts and silent failures in the network path between the client and the server, and how to prove where the packets are dying.
- RADIUS server not responding — silent failures, in likelihood order
When the NAS reports RADIUS timeouts instead of rejects: silent drops from unknown clients and bad secrets, dropped UDP fragments mid-EAP, dead services, and firewalled or wrong ports — with the checks for each.
Guides
Longer-form guides for the migrations and design decisions behind these failures — the background that turns a one-off fix into a change that holds.
- PEAP-MSCHAPv2 to EAP-TLS migration without breaking Wi-Fi
A staged migration plan from password-based PEAP to certificate-based EAP-TLS: why NTLM hardening is forcing the move, the dual-policy transition pattern, and the reason codes you'll see when a device is mid-migration.
Staring at a log right now?
Skip the reading — paste it into the analyzer and get the diagnosis for your specific log in seconds. It runs in your browser; nothing is uploaded.