6278 Security log · Network Policy Server info severity low volume

Windows Event ID 6278 — Network Policy Server granted full access to a user because the host met the defined health policy

NPS granted full network access after NAP (Network Access Protection) health check passed.

Why event 6278 matters

If NAP is in use, compromised endpoints that fail health checks may generate 6280 instead. An infected endpoint bypassing NAP is a concern.

How to detect it

Monitor for 6280 (restricted access) followed by 6278 (full access) without obvious remediation — possible NAP bypass.

Log source
Security
Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 6278   // Network Policy Server granted full access to a user because the host met the defined health policy
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=6278
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Network Policy Server granted full access to a user because the host met the defined health policy — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 6278 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Network Policy Server events

6272 Network Policy Server granted access to a user 6273 Network Policy Server denied access to a user 6274 Network Policy Server discarded the request for a user 6279 Network Policy Server locked the user account due to repeated failed authentication attempts 6280 Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy

Frequently asked questions

What is Windows Event ID 6278?

Network Policy Server granted full access to a user because the host met the defined health policy. NPS granted full network access after NAP (Network Access Protection) health check passed.

Which log records event 6278?

Event 6278 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).

How do you detect activity around event 6278?

Monitor for 6280 (restricted access) followed by 6278 (full access) without obvious remediation — possible NAP bypass.