NPS and RRAS VPN logs: where to find them and who is connected

Your Windows VPN runs on Routing and Remote Access (RRAS), and the logins are checked by the Network Policy Server (NPS). The answers to who logged in, who failed, and who is on right now are spread over several places. Here is where to look.

1. NPS accounting logs (the log files)

NPS can write every authentication and accounting request to a text file. Open the Network Policy Server console (nps.msc) › Accounting › Change Log File Properties to see or change:

• the folder: by default %SystemRoot%\System32\LogFiles;
• the format: DTS Compliant (XML-like, easier to read) or one of the legacy formats;
• how often a new file starts (daily, weekly, monthly, or by size). The files are named IN plus the date, e.g. IN2610.log for a monthly file.

If the folder has no IN*.log files, accounting may be switched off or set to write to SQL Server instead: check Accounting › Configure Accounting. If RRAS sends its logins to a separate RADIUS server, the logs are on that server, not on the VPN server.

The log files grow and are not deleted by themselves. Keep an eye on the disk, and on how long you must keep them.

2. NPS in Event Viewer: Events 6272 and 6273

The easiest place to read NPS decisions is the Security log:

Event ID	Meaning
6272	Network Policy Server granted access to a user.
6273	Network Policy Server denied access to a user.

Each event names the user, the calling station (often the client's public address), the NAS (your VPN server), the network policy that matched, the authentication type and, for 6273, a Reason Code with a reason text. Two you will see often: 16 = the user name or password was wrong, 48 = the connection did not match any network policy.

When NPS is installed, Event Viewer also has a ready-made view: Custom Views › Server Roles › Network Policy and Access Services.

No 6272 / 6273 at all? Auditing for NPS may be off. Switch it on (as administrator):

auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

On a non-English Windows the subcategory name is translated; auditpol /list /subcategory:* shows the local name. A Group Policy with audit settings can also overwrite it.

The failed VPN logins of the last 24 hours, by user and caller:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6273; StartTime=(Get-Date).AddHours(-24)} |
  Select-Object TimeCreated, @{n='Text';e={($_.Message -split "`n" | Select-String 'Account Name|Calling Station|Reason:') -join ' | '}}

This reads the English event text; on other languages, look at the event's fields in Event Viewer instead.

3. RRAS logs

• System log, source RemoteAccess: errors and warnings of the VPN service itself, and failed connection attempts. What is written is set in the Routing and Remote Access console (rrasmgmt.msc) › server › Properties › Logging.
• Authentication and accounting: when RRAS uses Windows Authentication and Windows Accounting (server Properties › Security), the logins are checked by the local NPS policies and logged as in sections 1 and 2. With RADIUS, they are logged on the RADIUS server.
• Detailed tracing for troubleshooting: the Logging tab offers Log additional Routing and Remote Access information, which writes trace files to %windir%\tracing. Switch it off again afterwards; the files grow fast.

4. Who is connected right now?

1. Routing and Remote Access console › server › Remote Access Clients: one line per connected user, with duration. Right-click a user for Status (addresses, bytes) or Disconnect.
2. PowerShell (as administrator, on the VPN server):

   Get-RemoteAccessConnectionStatistics
   Get-RemoteAccessConnectionStatistics | Format-List *

   The first line lists the current connections; the second shows every detail Windows has for them.
3. Remote Access Management console › Remote Client Status, if the Remote Access management tools are installed.

None of these tell you the country a user connects from, or whether that is new for this user. And none of them list who may connect: for that you have to check the Network Access Permission on the Dial-in tab of every Active Directory account, plus the groups in your network policies.

5. See your VPN at a glance: Coinetic

Doing this by hand means: NPS log files in one place, 6272 / 6273 in the Security log, RRAS events in the System log, a console for the current connections, and every account's Dial-in tab for who may connect. Looking up countries yourself. And failed VPN logins from the internet are logged, but Windows does not block the address; the guessing just goes on.

Coinetic puts it together on your Windows VPN server (VPN features are in the Pro plan):

• Who is connected now, at any time: the VPN Users page shows every connected user with the address, owner and country they come from, their VPN address, device, login method and how long they have been on. Open it whenever you want; it is not a one-time report.
• Who may connect: the same page lists the Active Directory accounts that are allowed to connect, including unused and disabled ones, so old VPN access does not go unnoticed.
• A VPN logon from a new country for that user can raise an alert by e-mail or script.
• Failed VPN logins are banned automatically: Coinetic reads the RRAS and NPS / RADIUS failures, shows them in Failed Logins with address, country, user name and what it did, and bans the address in the Windows Firewall at the limit you choose.
• Your own people stay in: addresses from your own network and whitelisted addresses are shown, but never banned.
• Works on any Windows language, because events are read by number and field, not by translated text.
• Your AI security analyst (Pro + AI): right-click any line, ban, port or connection and choose Ask AI, e.g. “Who is on the VPN right now, and is any logon unusual?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

More guides: all Coinetic guides.

Frequently asked

Where is the NPS log location?

By default %SystemRoot%\System32\LogFiles (usually C:\Windows\System32\LogFiles), files IN*.log. The folder can be changed in the NPS console › Accounting › Change Log File Properties, so check there first.

Why do I see no Event 6272 or 6273?

Auditing of the Network Policy Server subcategory is off, or the logins are checked on another (RADIUS) server. Switch on success and failure auditing with auditpol, or look on the RADIUS server.

What does Reason Code 16 in Event 6273 mean?

Authentication failed because the user name or password was wrong. Many of them from one internet address, with changing user names, is password guessing on your VPN.

Can I see the country a VPN user connects from?

Windows shows the address, not the country; you have to look it up. Coinetic's VPN Users page shows the country next to every connected user.