How to Configure a RADIUS Server on Windows Server 2019 (2026 Guide)

Network security remains one of the most pressing concerns for every organisation, and centralised authentication is still the single biggest win you can deliver to a medium-sized network. One of the most effective ways to enforce it is to implement a RADIUS server. Windows Server 2019 includes the Network Policy Server (NPS) role, which acts as a fully featured RADIUS server, allowing you to authenticate VPN connections, wireless clients and wired 802.1X devices against Active Directory. In this guide we will walk through every step of the process, from installing the role to testing your first authentication request.

RADIUS authentication flow with NPS on Windows Server 2019

What Is RADIUS and Why Use It?

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralised authentication, authorisation and accounting (AAA). Instead of each switch, access point or VPN concentrator holding its own local user database, every device simply forwards the login request to the RADIUS server, which checks the credentials against a central directory and returns an accept or reject response. The benefits are significant: a single point of policy enforcement, consistent password standards, simpler auditing and the ability to disable a user in one place and have that change propagate across the entire estate instantly.

Prerequisites

  • A running Windows Server 2019 Standard installation joined to the domain.
  • Active Directory Domain Services fully configured and healthy.
  • An Active Directory security group containing the users who will authenticate (for example VPN-Users or WiFi-Staff).
  • A valid server certificate from an internal or public CA if you plan to use PEAP or EAP-TLS.
  • Administrative access to the switches, access points or VPN appliances you wish to protect.

Step 1: Install the NPS Role

Open Server Manager > Add Roles and Features. Select Network Policy and Access Services and complete the wizard, accepting the default management tools. Installation takes only a minute or two and does not require a reboot. After it finishes, open the Network Policy Server console from the Tools menu.

Step 2: Register NPS in Active Directory

Right-click the NPS (Local) node at the top of the console and select Register server in Active Directory. This action adds the server to the built-in RAS and IAS Servers group, which grants NPS permission to read user account dial-in properties. Without this step, every authentication attempt will fail with a generic error, even though the credentials are correct.

Step 3: Add RADIUS Clients

Under RADIUS Clients and Servers > RADIUS Clients, add each network device (access point, VPN gateway, managed switch) that will forward authentication requests. Provide a friendly name, the device's IP address and a strong shared secret of at least 22 random characters. Store the shared secrets in your password manager; they are the only thing preventing a rogue device from pretending to be a legitimate authenticator.

Step 4: Create a Connection Request Policy

Connection request policies determine whether NPS processes a request locally or forwards it to a remote RADIUS server. For most single-site deployments the default policy is fine, but if you federate with another domain or use a RADIUS proxy you will need a custom rule here.

Step 5: Create a Network Policy

Navigate to Policies > Network Policies and create a new policy. Set the conditions (for example Windows Groups: VPN-Users combined with NAS Port Type: Virtual (VPN)), grant access on the next screen and configure the authentication method. PEAP-MSCHAPv2 remains the most common choice for password-based Wi-Fi and VPN, while EAP-TLS with client certificates is the gold standard for zero-trust environments.

Step 6: Test the Configuration

From a client device, initiate a connection through the RADIUS-protected service. Check the NPS event log under Event Viewer > Custom Views > Server Roles > Network Policy and Access Services to confirm a successful authentication (event ID 6272) or to diagnose a rejection (event ID 6273, which always includes a reason code). For a broader hardening checklist once RADIUS is live, see our guide on best security practices for Windows Servers.

Common Pitfalls to Avoid

  • Firewall rules: UDP 1812 (authentication) and 1813 (accounting) must be open between clients and the NPS server.
  • Certificate trust: clients must trust the CA that issued the NPS server certificate, otherwise PEAP will fail silently.
  • Time skew: Kerberos underpins AD lookups, so keep all devices within five minutes of domain time.

Looking Ahead: 2019, 2022 and Beyond

Windows Server 2019 remains fully supported for mainstream production workloads in 2026, but many organisations are now evaluating newer platforms. If you are weighing an upgrade, our comparison of Windows Server 2019 vs 2022 and the overview of Windows Server 2022 key features are a good next read. You may also find our piece on Windows Server vs Windows 10 helpful when explaining the architecture to non-technical stakeholders.

Get Your Licence

Licendi offers genuine Windows Server 2019 Standard licences with instant digital delivery, lifetime validity and friendly technical support. Browse our full range of Windows Server and CAL licences to find the edition that fits your infrastructure.

Best regards,
The Licendi Team