Event-o-Pedia EventID 6272 - Network Policy Server granted access to a user. [2012 R2 and lower]

	Event Details
	Operating System->Microsoft Windows->Built-in logs->Windows 2008 or higher->Security Log->Logon/Logoff->Network Policy Server->EventID 6272 - Network Policy Server granted access to a user. [2012 R2 and lower]

EventID 6272 - Network Policy Server granted access to a user. [2012 R2 and lower]

Find more information about this event on ultimatewindowssecurity.com.

Sample:

===========================
Description template stored in adtschema.dll:
===========================
Network Policy Server granted access to a user.

User:
	Security ID:			%1
	Account Name:			%2
	Account Domain:			%3
	Fully Qualified Account Name:	%4

Client Machine:
	Security ID:			%5
	Account Name:			%6
	Fully Qualified Account Name:	%7
	OS-Version:			%8
	Called Station Identifier:		%9
	Calling Station Identifier:		%10

NAS:
	NAS IPv4 Address:		%11
	NAS IPv6 Address:		%12
	NAS Identifier:			%13
	NAS Port-Type:			%14
	NAS Port:			%15

RADIUS Client:
	Client Friendly Name:		%16
	Client IP Address:			%17

Authentication Details:
	Connection Request Policy Name:	%18
	Network Policy Name:		%19
	Authentication Provider:		%20
	Authentication Server:		%21
	Authentication Type:		%22
	EAP Type:			%23
	Account Session Identifier:		%24
	Logging Results:			%27

Quarantine Information:
	Result:				%25
	Session Identifier:			%26

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008) Windows 7 (2008 R2) Windows 8 (2012) Windows 8.1 (2012 R2)
Category	Logon/Logoff
Source	Microsoft-Windows-Security-Auditing
TaskCategory	Network Policy Server
EventId	6272

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	Security
Type	Warning, Information, Error, Success, Failure, etc.	Type	Success
User	Domain\Account name of user/service/computer initiating event.	User	RESEARCH\Alebovsky
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	576
Description	The entire unparsed event message.	Description	Special privileges assigned to new logon.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	Security
Task Category	A name for a subclass of events within the same Event Source.	TaskCategory
Level	Warning, Information, Error, etc.	Level
Keywords	Audit Success, Audit Failure, Classic, Connection etc.	Keywords
Category	A name for an aggergative event class, corresponding to the similar ones present in Windows 2003 version.	Category	Account Logon
Object Name		-
Whom		InsertionString1
Object Type		-
Class Name		-
Security ID		InsertionString1
Account Name		InsertionString2
Account Domain		InsertionString3
User: Security ID	Security ID of the account that requested the access. Usually resolved to Domain\Name in home environment.	InsertionString1
User: Account Name	Name of the account that requested the access.	InsertionString2
User: Account Domain	Name of the domain that account requested the access belongs to.	InsertionString3
User: Fully Qualified Account Name	FQDN of the account that requested the access.	InsertionString4
Client Machine: Security ID		InsertionString5
Client Machine: Account Name		InsertionString6
Client Machine: Fully Qualified Account Name		InsertionString7
Client Machine: OS-Version		InsertionString8
Client Machine: Called Station Identifier		InsertionString9
Client Machine: Calling Station Identifier		InsertionString10
NAS: NAS IPv4 Address		InsertionString11
NAS: NAS IPv6 Address		InsertionString12
NAS: NAS Identifier		InsertionString13
NAS: NAS Port-Type		InsertionString14
NAS: NAS Port		InsertionString15
RADIUS Client: Client Friendly Name		InsertionString16
RADIUS Client: Client IP Address		InsertionString17
Authentication Details: Proxy Policy Name		InsertionString18
Authentication Details: Network Policy Name		InsertionString19
Authentication Details: Authentication Provider		InsertionString20
Authentication Details: Authentication Server		InsertionString21
Authentication Details: Authentication Type		InsertionString22
Authentication Details: EAP Type		InsertionString23
Authentication Details: Account Session Identifier		InsertionString24
Quarantine Information: Result		InsertionString25
Quarantine Information: Session Identifier		InsertionString26
Authentication Details: Logging Results:		InsertionString27