--- title: "Set Up NPS RADIUS on Windows Server Without Silent Rejects" description: "Install Windows Server NPS as a RADIUS server for Wi-Fi and VPN, build PEAP and EAP-TLS policies, and decode event 6273 before users complain." canonical: "https://adamtheautomator.com/nps-radius-windows-server-setup/" --- # Set Up NPS RADIUS on Windows Server Without Silent Rejects > Install Windows Server NPS as a RADIUS server for Wi-Fi and VPN, build PEAP and EAP-TLS policies, and decode event 6273 before users complain. Source: https://adamtheautomator.com/nps-radius-windows-server-setup/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Set Up NPS RADIUS on Windows Server Without Silent Rejects](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b815cacb1ece7c7ca9758/edff0257593a62603f4fae3b57f62db3fbe832f8af0bcc7638ea7ebd721274c7.jpg) # Set Up NPS RADIUS on Windows Server Without Silent Rejects [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)21 October 202612 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[Networking](/tag/networking/)[Certificates](/tag/certificates/)[Windows](/tag/windows/) Table of Contents * [Prerequisites for a Server You Will Actually Support](#prerequisites-for-a-server-you-will-actually-support) * [What NPS Sits Between the Access Point and Active Directory](#what-nps-sits-between-the-access-point-and-active-directory) * [RADIUS Clients Are the Network Gear, Not the Laptops](#radius-clients-are-the-network-gear-not-the-laptops) * [Install the Role and Register the Server in Active Directory](#install-the-role-and-register-the-server-in-active-directory) * [The Registration Step People Skip](#the-registration-step-people-skip) * [Register the Wireless Controller and VPN Gateway as RADIUS Clients](#register-the-wireless-controller-and-vpn-gateway-as-radius-clients) * [Build the PEAP-MSCHAPv2 Policy for Wi-Fi Users](#build-the-peap-mschapv2-policy-for-wi-fi-users) * [Settings Carry the VLAN](#settings-carry-the-vlan) * [Add a Certificate-Based Policy That Survives a Password Reset](#add-a-certificate-based-policy-that-survives-a-password-reset) * [Issue the Server Certificate From a Template](#issue-the-server-certificate-from-a-template) * [Autoenroll Client Certificates With Group Policy](#autoenroll-client-certificates-with-group-policy) * [Bind the Policy to the Certificate, Then Rebind It Next Year](#bind-the-policy-to-the-certificate-then-rebind-it-next-year) * [Point the Access Point and the RRAS Gateway at NPS](#point-the-access-point-and-the-rras-gateway-at-nps) * [Read the Events Before You Change the Policy](#read-the-events-before-you-change-the-policy) * [When There Are No Events at All](#when-there-are-no-events-at-all) * [Export the Configuration and Keep Two Servers in Sync](#export-the-configuration-and-keep-two-servers-in-sync) * [Two Servers, One Policy Set](#two-servers-one-policy-set) * [Why MS-CHAPv2 Stopped Working on Windows Server 2025](#why-ms-chapv2-stopped-working-on-windows-server-2025) * [The Failure Table: Symptom, Event, and Fix](#the-failure-table-symptom-event-and-fix) * [What to Keep Watching](#what-to-keep-watching) Do not let an expired certificate be the thing that teaches you how NPS works. The failure arrives without drama. Someone types the right password, the Wi-Fi icon spins, and the access point returns nothing you can act on. On the server, event 6273 has already recorded a reason code nobody reads until the third ticket, and by then the argument has moved to the access point vendor and the health of a domain controller. The cause is usually a date in the local certificate store. This walkthrough builds the service in the order that keeps each failure visible. You install the Network Policy Server (NPS) role and register it in Active Directory, add the wireless controller and VPN gateway as RADIUS clients, then build a password policy and a certificate policy. You finish by proving the chain with NPS event IDs before a user touches it. ## Prerequisites for a Server You Will Actually Support Three requirements decide whether this build works. * A domain-joined Windows Server 2022 or 2025 member server with a static address, kept off a domain controller so enrollment reboots stay easy to schedule. NPS reads dial-in properties from Active Directory, so a server whose own computer account cannot authenticate will reject traffic it has no business rejecting. * Clients must trust your certificate authority, even if you start with passwords, because PEAP-MS-CHAPv2 requires a server certificate every supplicant validates. An enterprise certificate authority is what the template and autoenrollment steps below assume, and a third-party CA your clients trust covers the password policy alone. Microsoft’s [NPS planning guidance](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-server) covers RADIUS client planning, authentication-method selection, network policy design, and fault tolerance across more than one server, though the page has no capacity or sizing numbers. * A network access server: a wireless controller, an access point cluster, or a Windows RRAS gateway. That device is the RADIUS client, and its address plus a shared secret are the two values you enter on both ends. ## What NPS Sits Between the Access Point and Active Directory The [NPS role](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-top) in Windows Server implements Remote Authentication Dial-In User Service (RADIUS), the protocol network gear uses to ask a central server whether a caller may connect. NPS answers who this is, whether they may connect now, and what happened afterward, and it reads the first two from Active Directory rather than a local user list on each controller. The network access server (NAS) sends an `Access-Request` to UDP port 1812 with credentials inside an EAP conversation. NPS checks connection request policies to decide whether to handle the request locally, then network policies to decide whether to grant it. An `Access-Accept` carries a VLAN attribute; an `Access-Reject` carries an EAP failure, and NPS records the reason code for it in Security event 6273. ### RADIUS Clients Are the Network Gear, Not the Laptops A RADIUS client is the access point, controller, or VPN gateway. Laptops and phones are supplicants, and NPS never sees them as clients. That distinction explains the first failure you’ll hit. A wrong address in the client list makes NPS drop the packet before any policy runs, so the controller reports a timeout and the console shows nothing. ## Install the Role and Register the Server in Active Directory The feature name is `NPAS`. Run this from Windows PowerShell 5.1 opened as administrator, which ships with Windows Server 2025 (build 26100) and Windows Server 2022 (build 20348) and loads the NPS module. ```powershell Install-WindowsFeature -Name NPAS -IncludeManagementTools ``` `-IncludeManagementTools` installs the console and the `Nps` module, and without it you get a service with no supported local way to configure it. The command returns `Success` and `RestartNeeded`, so take that restart before enrollment. Confirm the state, because a pending reboot can leave it reporting `InstallPending`. ```powershell Get-WindowsFeature -Name NPAS | Select-Object Name, InstallState ``` ### The Registration Step People Skip Registration isn’t about licensing. Microsoft’s [registration procedure](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-register) states that NPS servers “must be registered in Active Directory so that they have permission to read the dial-in properties of user accounts during the authorization process.” Skip it and every request fails authorization with correct credentials, which sends people hunting through policies that were never the problem. In the console, right-click **NPS (Local)** and choose **Register server in Active Directory**. For a scripted build, register and verify in two commands: ```text netsh nps add registeredserver corp.example.com nps01 net localgroup "RAS and IAS Servers" /domain ``` Registration only adds the computer account to that domain group, so the second command is the real check. Reach for `net localgroup` here. `RAS and IAS Servers` has domain local scope, and `net group` enumerates global groups only, so it answers `The group name could not be found.` for a group that exists in the domain. If `nps01` is missing from the localgroup listing, the flow is broken before any policy runs. ## Register the Wireless Controller and VPN Gateway as RADIUS Clients Adding a client is name, address, and shared secret. Prefer the IP address over the FQDN, because a client resolved by name depends on DNS at request time, and when resolution fails NPS logs Event ID 13 (`RADIUS_E_INVALID_CLIENT`) while the controller reports only a timeout. The [NPS module](https://learn.microsoft.com/en-us/powershell/module/nps/new-npsradiusclient) covers clients from PowerShell. This prompts for the secret so it stays out of your command history: ```powershell $secret = Read-Host "Shared secret for WLC01" New-NpsRadiusClient -Name 'WLC01-Contoso' -Address '10.20.5.10' -SharedSecret $secret Restart-Service -Name ias Get-NpsRadiusClient | Select-Object Name, Address ``` The restart is required. Microsoft’s cmdlet reference says “The NPS Server service must be restarted after you run the New-NpsRadiusClient cmdlet,” and an entry present in configuration but not in the running service produces the same silence as a missing one. ## Build the PEAP-MSCHAPv2 Policy for Wi-Fi Users There’s no `New-NpsNetworkPolicy` cmdlet, so policy work runs in `nps.msc` or through an XML import from another server. Open **Policies**, right-click **Network Policies**, and choose **New Network Policy**. Name it `WiFi-Users-PEAP` and set **Type of network access server** to `Unspecified` if one server handles Wi-Fi and VPN. In **Conditions**, add `NAS Port Type` set to `Wireless - IEEE 802.11` and `Windows Groups` pointing at your Wi-Fi group. Without that group condition the policy admits every account with valid credentials. In **Constraints**, remove `MS-CHAP-v2` and `MS-CHAP` and add `Microsoft: Protected EAP (PEAP)` as the only EAP type. Edit it, select `EAP-MSCHAPv2` as the inner method, and confirm **Certificate issued to** shows the server’s FQDN. An empty field makes the policy unusable, and clients fail at the TLS handshake. ### Settings Carry the VLAN VLAN assignment needs three attributes: `Tunnel-Type` set to `Virtual LANs (VLAN)` (value 13), `Tunnel-Medium-Type` set to `802 (Includes all 802 media plus Ethernet canonical format)` (value 6), and `Tunnel-Pvt-Group-ID` set to the VLAN number. Miss one and the controller ignores the set, which looks like clients landing on the default VLAN while every policy check passes. The diagram below traces one connection through the policy comparison that happens before any attribute comes back. ![802.1X policy flow](https://adamtheautomator.com/wp-content/uploads/publisher/69e6a8364360103d50c374c590ee1a21959d5a611bd05c8dda06a68b73c31ba4.jpg) _Policy comparison flow_ Order matters as much as content. Microsoft’s [network policy documentation](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-np-configure) warns that “If NPS does not find a network policy that matches the connection request, the connection request is rejected unless the dial-in properties on the user account are set to grant access.” Put narrow policies above broad ones, because a catch-all at the top authorizes requests you meant to restrict. ## Add a Certificate-Based Policy That Survives a Password Reset [PEAP-MS-CHAPv2](https://www.anrdoezrs.net/links/7627660/type/dlg/sid/ata-ps-pluralsight-windows-server-security-courses/https://www.pluralsight.com/search?q=Pluralsight%20Windows%20Server%20Security%20Courses) keeps a password inside the TLS tunnel, which is fine for a pilot and wrong as a destination, since the method depends on a credential that can be phished or expired over a holiday. EAP-TLS authenticates the device instead. ### Issue the Server Certificate From a Template Duplicate the built-in **RAS and IAS Server** template as `NPS-Server-2025`. On **Subject Name**, select **Build from this Active Directory information** with a format that includes the DNS name, and on **Extensions** confirm **Server Authentication** is present. On **Security**, grant **Read**, **Enroll**, and **Autoenroll** to **RAS and IAS Servers**. Microsoft’s [certificate requirements](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-cert-requirements) explain the subject rule: “If you issue a certificate to your server running Network Policy Server (NPS) that has a blank Subject name, the certificate isn’t available to authenticate your NPS.” A certificate with the right EKU and a blank subject enrolls cleanly, then never appears in the policy’s certificate list. ### Autoenroll Client Certificates With Group Policy Duplicate the **Computer** template and grant **Read**, **Enroll**, and **Autoenroll** to **Domain Computers**. Enable autoenrollment under **Computer Configuration**, **Policies**, **Windows Settings**, **Security Settings**, **Public Key Policies**, **Certificate Services Client - Auto-Enrollment**, set the model to **Enabled**, and turn on both renewal options. The [autoenrollment walkthrough](https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-server-certificate-auto-enrollment) covers both scopes, and missing the user scope is why a pilot authenticates as machines but not as people. ```powershell gpupdate /force Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter, HasPrivateKey ``` `HasPrivateKey` must read `True`, and `Subject` must name a certificate issued from the Computer template. A machine that shows only the server’s RAS and IAS certificate, or an empty list, has not received the policy yet: re-run `gpupdate /force`, confirm the GPO is linked to the machine’s OU, and check that the Computer template grants Read, Enroll, and Autoenroll to Domain Computers. EAP-TLS rejects that machine on its next connection attempt. ### Bind the Policy to the Certificate, Then Rebind It Next Year Create a second policy, `WiFi-Devices-EAP-TLS`, with the same port type condition and a **Domain Computers** group condition. In **Constraints**, add `Microsoft: Smart Card or other certificate`, select your issuing CA, and require a client certificate. Then read the renewal rule before you need it. Microsoft’s [certificate management guidance](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates) states that a policy using certificate authentication must be edited to select the new certificate, and the service restarted afterwards, when someone replaces that certificate by hand. The same guidance makes autoenrollment the exception: the manual step isn’t required on NPS servers configured for certificate autoenrollment, because NPS continues to use the renewed certificate without administrator intervention. A policy re-point is what you owe a certificate that expires with no autoenrollment behind it. Either way, open the policy afterward and confirm [the thumbprint it holds](https://trk.udemy.com/c/1454808/3281541/39854?u=https%3A%2F%2Fwww.udemy.com%2Fcourses%2Fsearch%2F%3Fq%3Dcertutil%2520windows%2520certificate) matches a certificate the server actually has; a stale binding fails the handshake no matter how the certificate arrived. ## Point the Access Point and the RRAS Gateway at NPS The values are always the same five: server address, shared secret, authentication port 1812, accounting port 1813, and the NAS identifier the device will send. Enter the secret exactly as typed on the NPS side, including case. Microsoft’s [802.1X deployment sequence](https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/wireless/c-wireless-access-deploy-process) configures the access points before the NPS wizard, because the device has to answer on its own address before NPS can be told to trust it. For a Windows RRAS gateway, right-click the server, choose **Properties**, and open **Security**. Set **Authentication provider** to `RADIUS Authentication`, click **Configure**, and add the NPS server with the shared secret. Set **Accounting provider** to `RADIUS Accounting` and point it at the same server. ```powershell Set-RemoteAccessRadius -ServerName 'nps01.corp.example.com' -Purpose Authentication ` -Timeout 60 -Score 30 -SharedSecret 'the-same-secret' -PassThru Get-NetUDPEndpoint -LocalPort 1812, 1813 | Select-Object LocalAddress, LocalPort, OwningProcess ``` `-Purpose Authentication` scopes the entry to VPN authentication, and `-Score` sets priority when more than one server is defined. The second command proves the NPS service holds an endpoint on both RADIUS ports. Expect `LocalPort` 1812 and 1813 with `OwningProcess` set to the `svchost` instance hosting the IAS service, and `LocalAddress` may be a specific IPv4 or IPv6 address instead of a wildcard. No entry at all means the service is stopped. ## Read the Events Before You Change the Policy NPS writes decisions to the Security log and to **Custom Views**, **Server roles**, **Network Policy and Access Services**, but only when the audit subcategory is enabled. ```text auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable ``` Microsoft’s [auditing reference](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-network-policy-server) documents the full set. The four you will use most are 6272 for access granted, 6273 for denied, 6274 for a discarded request, and 6278 for full access granted after a health check passes. Event 6273 carries more than a denial. Read to the bottom for the reason code, then compare it against the policy name, authentication type, EAP type, and RADIUS client name in the same record. Reason code 16 means bad credentials, a locked account, or a user who does not exist. A certificate reason code points at the chain, the EKU, or revocation. ### When There Are No Events at All Silence is a result. If NPS logged no 6272 and no 6273, the request never reached the policy engine, so stop reading policies. Check the shared secret on both sides, UDP 1812 on every hop, and whether the client entry is stored under a name that still resolves. For certificate rejections with no useful detail, set the `EventLogging` DWORD under `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL` to `3`, restart the server, then reproduce the connection. Microsoft requires that reboot before a change to the logging level takes effect, and a value set without one logs nothing new. The extra events are verbose and they are the only place the chain failure appears by name. The flowchart below maps each branch to the cause you can act on. ![Silent reject triage](https://adamtheautomator.com/wp-content/uploads/publisher/2dd18f131d6680257eeaa748f86269f8b62e8a8669c7a68cdc6eafe864d5190d.jpg) _Silent reject triage_ ## Export the Configuration and Keep Two Servers in Sync Export the configuration before the first user connects, and after every policy change. The export writes a file and will not create the folder for it, so make that folder first. ```powershell New-Item -ItemType Directory -Path 'C:\NPS\backup' -Force | Out-Null Export-NpsConfiguration -Path 'C:\NPS\backup\nps01-config.xml' ``` The `netsh` path does the same job and belongs in a scheduled task, because it forces you to acknowledge what you are exporting: ```text netsh nps export filename="C:\NPS\backup\nps01-config.xml" exportPSK=YES ``` Microsoft’s [export and import procedure](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-export) requires that flag because the file contains secrets, and the cmdlet reference is blunt: “The exported file contains unencrypted shared secrets for RADIUS clients and members of remote RADIUS server groups.” Restoring onto a rebuilt or second server uses the same path in the other direction, and it replaces the destination configuration. ```text netsh nps import filename="C:\NPS\backup\nps01-config.xml" ``` * * * _**Warning: an NPS export is a plaintext credential file. Put it in the vault, restrict the folder ACL to administrators, and delete stale copies. Import also overwrites the entire configuration.**_ * * * SQL Server logging settings aren’t included in the export, so a rebuilt server needs that configuration reapplied by hand. ### Two Servers, One Policy Set High availability is a client-side design. Build two NPS servers, register both, keep the policy sets identical through export and import, and configure each controller and gateway with both addresses. The controllers handle failover, so there’s nothing to cluster at the Windows layer. Both servers need policies in the same order, because an import that changes order changes which policy matches first, and each needs a server certificate issued by a CA the clients trust; matching subject or SAN values only matters when the supplicant profile validates a specific server name, and one enterprise CA is the usual way to get there rather than a requirement. Test failover by stopping `ias` on the primary during a maintenance window instead of assuming the secondary entry works because it exists. ## Why MS-CHAPv2 Stopped Working on Windows Server 2025 Windows Server 2025 and Windows 11 version 24H2 removed the NTLMv1 protocol, and what remains is a set of NTLMv1 cryptography paths inside higher-level protocols. MS-CHAPv2 is one of them. When a domain-joined laptop signs a user in automatically, Windows derives an NTLMv1-equivalent credential. Microsoft’s [NTLMv1 change notice](https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/08/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025) documents the `BlockNtlmv1SSO` DWORD under `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0` that controls whether that derivation is allowed: `0` audits the request and lets it succeed, `1` blocks it. The same notice states that the October 2026 security update treats an absent value as enforce on devices where Credential Guard is disabled, and that the update doesn’t create the value. A registry search on a freshly patched laptop therefore returns nothing while the connection still fails. The symptom is specific enough to script a help desk response around. Automatic sign-in fails, the user types the same credentials manually, the connection succeeds, and the password is not saved, so the prompt returns the next morning. Look in **Applications and Services Logs**, **Microsoft**, **Windows**, **NTLM**, **Operational**, where that notice lists event 4024 during auditing and 4025 when a request is blocked. Microsoft’s [Credential Guard guidance](https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues) recommends moving those connections to certificate-based authentication. * * * _**Reality Check: setting BlockNtlmv1SSO back to 0 restores sign-in and restores the weakness the change was written to close. Use it to buy a migration window with a date on it, and treat the 4024 events it produces as your list of devices still to move.**_ * * * ## The Failure Table: Symptom, Event, and Fix Match the symptom to the event and stop there. | What you see | Event | Cause | Fix | | --- | --- | --- | --- | | Users rejected, client unchanged | 6273, reason code 16 | Expired password, locked account, wrong group | Check the AD account first | | Everything rejected after a controller change | No NPS event | Shared secret differs | Re-enter on both ends, restart `ias` | | Requests never arrive | Nothing on NPS or firewall | UDP 1812 or 1813 blocked | Open both ports on every hop | | All requests fail after a rebuild | 6273, or event 13 | Not registered, or client stored by name | Register, switch to an IP | | EAP-TLS fails on new devices | 6273, certificate reason | Client certificate or wrong template | Confirm autoenrollment and permissions | | Valid device rejected after a template change | 6273, Schannel detail | EKU missing Server Authentication, SAN missing DNS name | Reissue from the corrected template | | Revoked device still connects | 6272 | Cached TLS handle | Disable the account | | Wi-Fi SSO fails on Windows 11 24H2 and later | NTLM 4025 | NTLMv1 SSO blocked | Move the profile to EAP-TLS | * Event 6274 means NPS discarded the request instead of evaluating it, usually from a malformed RADIUS message (reason code 3) or an internal error (reason code 1). A source address that matches no configured client never reaches that path; NPS logs System event 13 instead. * Cached TLS handles keep a revoked certificate working until the cache expires, measured in hours. The [802.1X troubleshooting guide](https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/802-1x-authentication-issues-troubleshooting) covers the client side, including supplicant settings that make a healthy server look broken. ## What to Keep Watching A RADIUS deployment is finished when you can answer three questions without opening a console: when the certificate expires, who holds the shared secret for each controller, and which users remain on the password policy because their devices have no certificate. Then keep the policy set honest. Export after every change, keep both servers in sync, and read the 6273 reason codes instead of resetting a password and hoping. Microsoft’s [NPS best practices](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-best-practices) covers logging volume and account lockout, and both matter once auditing is on. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fnps-radius-windows-server-setup%2F&text=Set%20Up%20NPS%20RADIUS%20on%20Windows%20Server%20Without%20Silent%20Rejects)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fnps-radius-windows-server-setup%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fnps-radius-windows-server-setup%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg) ### [Fix Kerberos Clock Skew Logon Failures Using w32tm](/fix-kerberos-clock-skew-w32tm/) Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b81d9ab7cd5dbb6caf044/21b786d67f19d1813150edf9871e36ead78714b63880de8c6161c7fde11a9769.webp) ### [Pktmon: Capture Windows Traffic Without a Third-Party Driver](/pktmon-capture-windows-traffic/) Use the in-box Windows Pktmon tool to capture packets and packet-drop reasons, then convert the ETL to pcapng and text for offline analysis. ![](https://adamtheautomator.com/wp-content/uploads/2023/03/powershell-ip-configuration.jpg) ### [PowerShell IP Configuration: A Beginner’s Guide to Windows Settings](/powershell-ip-configuration/) Master PowerShell IP Configuration: Learn to set up and troubleshoot network IPs on Windows effortlessly. A comprehensive guide for efficient network management. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)