Windows Event ID 6272 — Network Policy Server granted access to a user — SecOps Tools

Why event 6272 matters

VPN authentication monitoring. Unusual source IPs, off-hours access, or unknown CallingStationId values may indicate unauthorized VPN access using stolen credentials.

How to detect it

Alert: VPN access from IPs outside expected geographic regions. Alert: first-time CallingStationId for admin accounts. Baseline normal VPN usage patterns.

Log source

Security

Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Initial Access	Valid Accounts (T1078)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 6272   // Network Policy Server granted access to a user
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=6272
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Network Policy Server granted access to a user — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 6272 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Network Policy Server events

6273 Network Policy Server denied access to a user 6274 Network Policy Server discarded the request for a user 6278 Network Policy Server granted full access to a user because the host met the defined health policy 6279 Network Policy Server locked the user account due to repeated failed authentication attempts 6280 Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy

Frequently asked questions

What is Windows Event ID 6272?

Network Policy Server granted access to a user. NPS (RADIUS) granted network access. AccountName, CalledStationId (VPN endpoint), CallingStationId (client) are key.

Which log records event 6272?

Event 6272 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 6272?

Event 6272 is associated with: Valid Accounts (T1078).

How do you detect activity around event 6272?

Alert: VPN access from IPs outside expected geographic regions. Alert: first-time CallingStationId for admin accounts. Baseline normal VPN usage patterns.