Event ID 6277 – Network Policy Server Granted Access To A User But Put It On Probationr
|Sub-Category||Audit Network Policy Server|
|Description||The network policy server granted access to a user but put it on probation because the host did not meet the defined health policy.|
Events which are audited under the Audit Network Policy Server sub-category are triggered when a user's access request are related to RADIUS (IAS) and Network Access Protection (NAP) activity. The requests are of the following types: Lock, Unlock, Grant, Deny, Discard, and Quarantine.
Every IAS and NAP user access request generates an audit event if the Network Policy Server auditing is configured, and if the NAS and IAS roles are installed on the server.
Example of 6277 log:
0x8000000000000000 message: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.
Contact the Network Policy Server administrator for more information.
Security ID: %1
Account Name: %2
Account Domain: %3
Fully Qualified Account Name: %4
Security ID: %5
Account Name: %6
Fully Qualified Account Name: %7
Called Station Identifier: %9
Calling Station Identifier: %10
NAS IPv4 Address: %11
NAS IPv6 Address: %12
NAS Identifier: %13
NAS Port-Type: %14
NAS Port: %15
Client Friendly Name: %16
Client IP Address: %17
Proxy Policy Name: %18
Network Policy Name: %19
Authentication Provider: %20
Authentication Server: %21
Authentication Type: %22
EAP Type: %23
Account Session Identifier: %24
Session Identifier: %27
Help URL: %28
System Health Validator Result(s): %29
Quarantine Grace Time: %30
Why does event ID 6277 need to be monitored?
On servers that run Network Policy Server (NPS), the event volume ranges from medium to high. NAP events help understand the overall health of the network, and hence must be monitored.
With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks all network policy server events, helping you meet your security, operational, and compliance needs with absolute ease.
Event 6277 applies to the following operating systems:
- Windows Server 2016
- Windows 10
Explore Active Directory auditing and reporting with ADAudit Plus.
- Related Products
- ADManager Plus Active Directory Management & Reporting
- ADAudit Plus Real-time Active Directory Auditing and UBA
- EventLog Analyzer Real-time Log Analysis & Reporting
- ADSelfService Plus Self-Service Password Management
- AD360 Integrated Identity & Access Management
- Log360 Comprehensive SIEM and UEBA
- AD Free Tools Active Directory FREE Tools