6274 Security log · Network Policy Server info severity low volume

Windows Event ID 6274 — Network Policy Server discarded the request for a user

NPS discarded a RADIUS request (malformed or exceeded session limits).

Why event 6274 matters

Discarded requests may indicate malformed RADIUS packets from exploit tools. Minimal relevance without corroborating events.

How to detect it

Alert: high volume of discarded requests from single source.

Log source
Security
Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 6274   // Network Policy Server discarded the request for a user
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=6274
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Network Policy Server discarded the request for a user — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 6274 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Network Policy Server events

6272 Network Policy Server granted access to a user 6273 Network Policy Server denied access to a user 6278 Network Policy Server granted full access to a user because the host met the defined health policy 6279 Network Policy Server locked the user account due to repeated failed authentication attempts 6280 Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy

Frequently asked questions

What is Windows Event ID 6274?

Network Policy Server discarded the request for a user. NPS discarded a RADIUS request (malformed or exceeded session limits).

Which log records event 6274?

Event 6274 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).

How do you detect activity around event 6274?

Alert: high volume of discarded requests from single source.