Configure NPS

Open NPS Console

  1. Open Server Manager > Go to Tools > Select Network Policy and Access Services.

Register NPS in Active Directory (if domain-joined)

  1. Right-click “NPS (Local)” > Select “Register server in Active Directory”.

Add RD Gateway as a RADIUS Client

  1. Expand “RADIUS Clients and Servers”.
  2. Right-click “RADIUS Clients” > Click “New”.
  3. Fill in the details:
    • Friendly Name: RD Gateway
    • Address: RD Gateway IP
    • Shared Secret: Define a secret (e.g., rdg-nps-secret123)
  4. Click Apply.

Add FreeRADIUS as a Remote RADIUS Server

  1. Right-click “Remote RADIUS Server Groups” > Click “New”.
  2. Name the group (e.g., FreeRADIUS Servers).
  3. Click “Add” and enter:
    • Address: (FreeRADIUS IP)
    • Authentication Port: 1812
    • Shared Secret: Define a secret (e.g., nps-freeradius-secret123)
  4. Click Apply.

Create a Network Policy

  1. Right-click “Network Policies” > Click “New”.
  2. Name it (e.g., RDP Policy).
  3. Type of network access server: Select Remote Desktop Gateway.
  4. Conditions:
    • Add Windows Groups (e.g., Domain Users/Admins).
  5. Constraints:
    • Enable Microsoft Encrypted Authentication version 2 (MS-CHAP-v2)
    • Enable Microsoft Encrypted Authentication version (MS-CHAP)
    • Allow clients to connect without negotiating an authentication method.
  6. Settings: Keep as default.
  7. Click Finish and enable the policy.

Configure Connection Request Policies

  1. Right-click “Connection Request Policies” > Click “New”.
  2. Name it (e.g., RDP Policy).
  3. Type of network access server: Select Remote Desktop Gateway.
  4. Conditions:
    • Add Client IPv4 Address (IP address of the RD Gateway).
  5. Settings:
    • Under Authentication, select “Forward requests to the following remote RADIUS server group for authentication”.
    • Choose the Remote RADIUS Server Group created earlier.

Enable Logging

  1. Go to “Accounting” > Click “Configure Accounting”.
  2. Select “Log to a text file”.
  3. Check:
    • “Authentication requests”
    • “Periodic status”
  4. Set log location (e.g., C:\Windows\System32\LogFiles).

Table of contents