6273 Security log · Network Policy Server medium severity medium volume

Windows Event ID 6273 — Network Policy Server denied access to a user

NPS denied network access. Reason code reveals why access was denied.

Why event 6273 matters

VPN brute force or password spray attempts. Multiple denials from same CallingStationId = automated attack. Denials with reason code 16 (authentication failed) = wrong credentials.

How to detect it

Alert: >10 denials from same CallingStationId within 10 minutes. Alert: denials for accounts not normally using VPN.

Log source
Security
Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access Brute Force (T1110)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 6273   // Network Policy Server denied access to a user
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=6273
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Network Policy Server denied access to a user — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 6273 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Network Policy Server events

6272 Network Policy Server granted access to a user 6274 Network Policy Server discarded the request for a user 6278 Network Policy Server granted full access to a user because the host met the defined health policy 6279 Network Policy Server locked the user account due to repeated failed authentication attempts 6280 Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy

Frequently asked questions

What is Windows Event ID 6273?

Network Policy Server denied access to a user. NPS denied network access. Reason code reveals why access was denied.

Which log records event 6273?

Event 6273 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 6273?

Event 6273 is associated with: Brute Force (T1110).

How do you detect activity around event 6273?

Alert: >10 denials from same CallingStationId within 10 minutes. Alert: denials for accounts not normally using VPN.