NPS discarded a RADIUS request (malformed or exceeded session limits).
Discarded requests may indicate malformed RADIUS packets from exploit tools. Minimal relevance without corroborating events.
Alert: high volume of discarded requests from single source.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 6274 // Network Policy Server discarded the request for a user
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=6274
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Network Policy Server discarded the request for a user — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Network Policy Server discarded the request for a user. NPS discarded a RADIUS request (malformed or exceeded session limits).
Event 6274 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).
Alert: high volume of discarded requests from single source.