Tools for Troubleshooting NAP

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2

This topic provides a list of tools and procedures that you can use to obtain detailed information about Network Access Protection (NAP) problems.

NAP diagnostic tools

Use the following tools to diagnose NAP problems:

• Netsh commands for NAP client

• Log files

• NAP event logs

• NAP events and errors documentation

• Microsoft Management Console

• MMC snap-ins

Netsh commands for NAP client

The following Netsh commands for NAP client are useful for troubleshooting:

• netsh NAP client show state

  This command provides the current status of a NAP client computer, including the restriction state, status of enforcement clients, status of installed system health agents (SHAs), and any trusted server groups that have been configured.

• netsh NAP client show config

  This command shows the local configuration settings on a NAP client computer, including the cryptographic settings, enforcement client settings, trusted server groups settings, and client tracing settings that have been configured.

• netsh NAP client show group

  This command shows the Group Policy configuration settings on a NAP client computer, including the cryptographic settings, enforcement client settings, trusted server groups settings, and client tracing settings that have been configured.

For more information, see Netsh Commands for Network Access Protection (NAP) Client (https://go.microsoft.com/fwlink/?LinkID=128797) and Netsh Commands for Health Registration Authority (https://go.microsoft.com/fwlink/?LinkId=136627).

Membership in the local Administrators group, or equivalent, is the minimum required to run commands that change configuration settings on the client computer. Commands that only display configuration status do not require these permissions. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

The following is an example of output from the netsh NAP client show state command.

Client state: 
---------------------------------------------------- 
Name                   = Network Access Protection Client 
Description            = Microsoft Network Access Protection Client 
Protocol version       = 1.0 
Status                 = Enabled 
Restriction state      = Not restricted 
Troubleshooting URL    =  
Restriction start time =  
Extended state         =  

Enforcement client state: 
---------------------------------------------------- 
Id                     = 79617 
Name                   = DHCP Quarantine Enforcement Client 
Description            = Provides DHCP based enforcement for NAP 
Version                = 1.0 
Vendor name            = Microsoft Corporation 
Registration date      =  
Initialized            = No 

Id                     = 79618 
Name                   = Remote Access Quarantine Enforcement Client 
Description            = Provides the quarantine enforcement for RAS Client 
Version                = 1.0 
Vendor name            = Microsoft Corporation 
Registration date      =  
Initialized            = No 

Id                     = 79619 
Name                   = IPSec Relying Party 
Description            = Provides IPSec based enforcement for Network Access Protection 
Version                = 1.0 
Vendor name            = Microsoft Corporation 
Registration date      =  
Initialized            = No 

Id                     = 79621 
Name                   = TS Gateway Quarantine Enforcement Client 
Description            = Provides TS Gateway enforcement for NAP 
Version                = 1.0 
Vendor name            = Microsoft Corporation 
Registration date      =  
Initialized            = No 

Id                     = 79623 
Name                   = EAP Quarantine Enforcement Client 
Description            = Provides EAP based enforcement for NAP 
Version                = 1.0 
Vendor name            = Microsoft Corporation 
Registration date      =  
Initialized            = Yes 

System health agent (SHA) state: 
---------------------------------------------------- 
Id                     = 79744 
Name                   = Windows Security Health Agent
 
Description            = The Windows Security Health Agent checks the compliance of a computer with an administrator-defined policy.
 
Version                = 1.0
 
Vendor name            = Microsoft Corporation
 
Registration date      =  
Initialized            = Yes 
Failure category       = None 
Remediation state      = Success 
Remediation percentage = 0 
Fixup Message          = (3237937214) - The Windows Security Health Agent has finished updating its security state.
 
Compliance results     = (0x00000000) - 
                         (0x00000000) - 
                         (0x00000000) - 
                         (0x00000000) - 
                         (0x00000000) - 
                         (0x00000000) - 
                         (0x00000000) - 
                         (0x00000000) - 

Remediation results    = 

Ok.

In this example, the EAP enforcement client is initialized, and the computer has been granted full network access.

In this example, the compliance results shows output that contains zeros. This output indicates the following system health components configured in Windows Security Center and monitored by the Windows System Health Agent (WSHA) are in compliance with requirements of the Windows System Health Validator (WSHV):

1. Firewall is on.

2. Antivirus is installed and running.

3. The antivirus signature is up to date.

4. Antispyware is installed and running.

5. The antispyware signature is up to date.

6. Automatic updates are enabled.

7. Security updates are enabled.

8. Security updates are installed for the security level and source specified.

Log files

You can use log files on servers running Network Policy Server (NPS) and NAP client computers to help troubleshoot NAP problems. Log files can provide the detailed information required for troubleshooting complex problems.

The following log files are useful for troubleshooting.

• NPS accounting log files

  By default, NPS accounting logs are located in %windir%\system32\logfiles. For information about the format of NPS accounting log files, see Interpret NPS Database Format Log Files (https://go.microsoft.com/fwlink/?LinkId=136631).

• NPS trace logging files

  You can capture detailed information in log files on servers running NPS by enabling remote access tracing. The Remote Access service does not need to be installed or running to use remote access tracing. When you enable tracing on a server running NPS, several log files are created in %windir%\tracing.

  The following log files contain helpful information about NAP:

  • IASNAP.LOG: Contains detailed information about NAP processes, NPS authentication, and NPS authorization.

  • IASSAM.LOG: Contains detailed information about user authentication and authorization.

  Membership in the local Administrators group, or equivalent, is the minimum required to enable tracing. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

  To create tracing log files on a server running NPS

  1. Open a command line as an administrator.

  2. Type netsh ras set tr * en.

  3. Reproduce the scenario that you are troubleshooting.

  4. Type netsh ras set tr * dis.

  5. Close the command prompt window.

• NAP client tracing log files

  You can enable NAP client tracing by using the command line. On computers running Windows Vista®, you can enable tracing by using the NAP Client Configuration console. NAP client tracing files are written in Event Trace Log (ETL) format. These are binary files representing trace data that must be decoded by Microsoft support personnel. Use the –o option to specify the directory to which they are written. In the following example, files are written to %systemroot%\tracing\nap. For more information, see Logman (https://go.microsoft.com/fwlink/?LinkId=143549).

  To create NAP event trace log files on a client computer

  1. Open a command line as an administrator.

  2. Type logman start QAgentRt -p {b0278a28-76f1-4e15-b1df-14b209a12613} 0xFFFFFFFF 9 -o %systemroot%\tracing\nap\QAgentRt.etl –ets.

3.  Reproduce the scenario that you are troubleshooting.

4.  Type **logman stop QAgentRt -ets**.

5.  Close the command prompt window.

• DHCP client tracing log files

  If the DHCP NAP enforcement client is enabled on a client computer, NAP events are also logged when you enable DHCP client tracing. When you enable DHCP client tracing, log files are written to %windir%\System32\LogFiles\WMI.

  To create DHCP event trace log files on a client computer

  1. Open a command line as an administrator.

  2. Type netsh dhcp tr en.

  3. Reproduce the scenario that you are troubleshooting.

  4. Type netsh dhcp tr dis.

  5. Close the command prompt window.

• Authenticator EAPHost tracing log files

  EAPHost trace logs contain debugging information that can help you find the root causes of issues that occur during the EAP authentication process. The debugging information can include application programming interface (API) calls performed, internal function calls performed, and state transitions performed. EAPHost tracing files are written in ETL format. These are binary files representing trace data that must be decoded by Microsoft support personnel. Use the –o option to specify the directory to which the files are written. In the following example, files are written to the current directory. For more information, see Logman (https://go.microsoft.com/fwlink/?LinkId=143549).

  To create authenticator EAPHost trace log files on a server running NPS

  1. Open a command line as an administrator.

  2. Type logman start trace EapHostAuthr -o .\EapHostAuthr.etl -p {F6578502-DF4E-4a67-9661-E3A2F05D1D9B} 0x4000ffff 0 -ets.

  3. Reproduce the scenario that you are troubleshooting.

  4. Type logman stop EapHostAuthr -ets.

  5. Close the command prompt window.

• Client EAPHost tracing log files

  EAPHost trace logs can also be created on the client to use for debugging client-side EAP authentication processes. EAPHost tracing files are written in ETL format. These are binary files representing trace data that must be decoded by Microsoft support personnel. Use the –o option to specify the directory to which the files are written. In the following example, files are written to the current directory. For more information, see Logman (https://go.microsoft.com/fwlink/?LinkId=143549).

  To create client EAPHost trace log files on a server running NPS

  1. Open a command line as an administrator.

  2. Type logman start trace EapHostPeer -o .\EapHostPeer.etl -p {5F31090B-D990-4e91-B16D-46121D0255AA} 0x4000ffff 0 -ets.

  3. Reproduce the scenario that you are troubleshooting.

  4. Type logman stop EapHostAuthr -ets.

  5. Close the command prompt window.

• HCAP tracing log files

  HCAP trace logs contain debugging information that can help you find the root causes of issues that occur with a server running HCAP. HCAP tracing files are written in ETL format. These are binary files representing trace data that must be decoded by Microsoft support personnel. Use the –o option to specify the directory to which the files are written. In the following example, files are written to the current directory. For more information, see Logman (https://go.microsoft.com/fwlink/?LinkId=143549).

  To create HCAP trace log files on a server running HCAP

  1. Open a command line as an administrator.

  2. Type logman start HCAPEXT -o .\hcap.etl -p {af000c3b-46c7-4166-89ab-de51df2701ee} 0xFFFFFFFF 9 -ets.

  3. Reproduce the scenario that you are troubleshooting.

  4. Type logman stop HCAPEXT -ets.

  5. Close the command prompt window.

• HRA server tracing log files

  HRA trace logs contain debugging information that can help you find the root causes of issues that occur with a server running HRA. HRA tracing files are written in ETL format. These are binary files representing trace data that must be decoded by Microsoft support personnel. Use the –o option to specify the directory to which the files are written. In the following example, files are written to the current directory. For more information, see Logman (https://go.microsoft.com/fwlink/?LinkId=143549).

  To create HRA trace log files on a server running HRA

  1. Open a command line as an administrator.

  2. Type logman start HRAEXT -o .\hra.etl -p {3BEEDE59-FC7D-5057-CE28-BABAD0B27181} 0xFFFFFFFF 9 -ets.

  3. Reproduce the scenario that you are troubleshooting.

  4. Type logman stop HRAEXT -ets.

  5. Close the command prompt window.

• NAP server tracing log files

  NAP server trace logs contain debugging information that can help you find the root causes of issues that occur with a NAP health policy server. NAP server tracing files are written in ETL format. These are binary files representing trace data that must be decoded by Microsoft support personnel. Use the –o option to specify the directory to which the files are written. In the following example, files are written to the current directory. For more information, see Logman (https://go.microsoft.com/fwlink/?LinkId=143549).

  To create NAP server trace log files on a server running NPS

  1. Open a command line as an administrator.

  2. Type logman start QSHVHOST -o .\shvhost.etl -p {06BB9E87-F689-4ec5-9E1E-44E1D471F21F} 0xFFFFFFFF 9 -ets.

  3. Reproduce the scenario that you are troubleshooting.

  4. Type logman stop QSHVHOST -ets.

  5. Close the command prompt window.

NAP event logs

Event logs are one of the most useful tools for troubleshooting NAP problems. You can review event logs for NAP on NAP client computers and on servers running NPS and HRA. NAP client events and HRA events are displayed in the NAP events and errors documentation section of this topic.

The following events on servers running NPS display detailed information about NAP client access request processing:

• Event ID 6272: Network Policy Server granted access to a user.

  This event occurs when a NAP client computer is successfully authenticated and, depending on its health state, obtains full or restricted access to the network.

• Event ID 6273: Network Policy Server denied access to a user.

  This event occurs when there is a problem with authentication or authorization and is associated with a reason code. For more information, see NPS Reason Codes (https://go.microsoft.com/fwlink/?LinkId=136640).

• Event ID 6274: Network Policy Server discarded the request for a user.

  This event occurs if there is a configuration problem. It can occur if RADIUS client settings are incorrect or if NPS cannot create accounting logs.

• Event ID 6276: Network Policy Server quarantined a user.

  This event occurs when the client access request matches a network policy that is configured with a NAP enforcement setting of Allow limited access. It can also occur if you have configured a setting of Allow full network access for a limited time and the specified date is in the past.

• Event ID 6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.

  This event occurs when the client access request matches a network policy that is configured with a NAP enforcement setting of Allow full network access for a limited time when the date specified in the policy has passed.

• Event ID 6278: Network Policy Server granted full access to a user because the host met the defined health policy.

  This event occurs when the client access request matches a network policy that is configured with a NAP enforcement setting of Allow full network access.

For more information about NPS events, see Network Policy Server Infrastructure.

To view NAP-related event logs on a server running NPS or HRA

1. Click Start, click Run, type eventvwr.msc, and then press ENTER.

2. Open Custom Views\Server Roles\Network Policy and Access Services.

To view NAP-related event logs on client computers

1. Click Start, click Run, type eventvwr.msc, and then press ENTER.

   • If the computer is running Windows 7 or Windows Vista, open Applications and Services Logs\Microsoft\Windows\Network Access Protection\Operational.

   • If the computer is running Windows XP with Service Pack 3, open the System log.

NAP events and errors documentation

NAP events and errors documentation provides helpful information for troubleshooting NAP-related operating system events. The following tables list the events that can be generated by NAP client computers and Health Registration Authority (HRA) servers. Click the event ID for step-by-step troubleshooting procedures for that event.

NAP client events

HRA events

Microsoft Management Console

You can review settings for important NAP-related services using the following consoles:

• NPS console

  You can use the NPS console to review RADIUS client settings, NPS policy settings, SHV settings, remediation server group settings, and accounting settings.

  Membership in the local Administrators group, or equivalent, is the minimum required to complete these procedures. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

  To troubleshoot NAP using the NPS console

  1. Click Start, click Run, type nps.msc, and then press ENTER.

  2. Open RADIUS Clients and Servers, and review settings for RADIUS Clients and Remote RADIUS Server Groups.

  3. Open Policies, and review settings for Connection Request Policies, Network Policies, and Health Policies.

  4. Open Network Access Protection, and review settings for System Health Validators and Remediation Server Groups.

  5. Open Accounting, and review settings for Local File Logging and SQL Server Logging.

• NAP Client Configuration console

  You can use the NAP Client Configuration console to review NAP client settings on the local computer. The NAP client configuration console is not available on computers running Windows XP.

## To troubleshoot NAP using the NAP Client Configuration console
1.  Click **Start**, click **Run**, type **napclcfg.msc**, and then press ENTER.

2.  Open **Enforcement Clients**, and review settings for NAP enforcement clients.

3.  Open **User Interface Settings**, and review settings for NAP notifications.

4.  Open **Health Registration Settings**, and review cryptographic settings and trusted server group settings.

• Certification Authority console

  You can use the Certification Authority console to troubleshoot certificate permission and issuing problems.

  To troubleshoot NAP using the Certification Authority console

  1. Click Start, click Run, type certsrv.msc, and then press ENTER.

  2. Open the console tree and review certificates in Issued Certificates, Pending Requests, Failed Requests, and Certificate Templates.

  3. Right-click the name of the CA, and then click Properties.

  4. In the CA properties window, review settings on the Policy Module tab and the Security tab.

• Certificate Templates console

  If you are using an enterprise CA, you can use the Certificate Templates console to review permissions and settings on NAP health certificate templates.

  To troubleshoot NAP using the Certificate Templates console

  1. Click Start, click Run, type certtmpl.msc, and then press ENTER.

  2. In the details pane, right-click System Health Authentication, and review settings on the Subject Name tab, the Extensions tab, and the Security tab.

MMC snap-ins

You can use MMC snap-ins to review NAP settings and monitor NAP activity.

• HRA snap-in

  Use the HRA snap-in to troubleshoot CA settings and cryptographic settings.

  Membership in the local Administrators group, or equivalent, is the minimum required to complete these procedures. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

  To troubleshoot NAP using the HRA snap-in

  1. Click Start, click Run, type mmc, and then press ENTER.

  2. Click File, click Add/Remove Snap-in, click Health Registration Authority, click Add, and then click OK twice.

  3. Click Certification Authority, and review the list of CAs.

  4. Right-click Certification Authority, and then click Properties.

  5. In Certification Authorities, review the settings for CA availability, certificate validity period, CA type, and CA templates.

• Certificates snap-in

  You can use the Certificates snap-in to review certificates that have been issued to the NAP client computer and NAP servers.

  To troubleshoot NAP using the Certificates snap-in

  1. Click Start, click Run, type mmc, and then press ENTER.

  2. Click File, click Add/Remove Snap-in, click Certificates, click Add, select Computer account, click Next, click Finish, and then click OK.

  3. Open Personal\Certificates, and review the certificates.

  4. Open Trusted Root Certification Authorities\Certificates, and review the certificates.

• IP Security Monitor snap-in

  You can use the IP Security Monitor snap-in to review IPsec security associations (SAs) on NAP client computers and server components that are part of a NAP with IPsec enforcement infrastructure.

  To troubleshoot NAP using the IP Security Monitor snap-in

  1. Click Start, click Run, type mmc, and then press ENTER.

  2. Click File, click Add/Remove Snap-in, click IP Security Monitor, click Add, and then click OK.

  3. Open Main Mode\Security Associations, and review the associations.

  4. Open Quick Mode\Security Associations, and review the associations.

See Also

Concepts

Quick Fixes for NAP
Troubleshooting NAP Problems