NPS granted restricted access (probation) — device failed health check.
Indicates non-compliant device on network. May be a compromised or unmanaged endpoint. Correlate with other events from same device to assess threat.
Alert: known-managed devices placed in probation (unexpected non-compliance = possible compromise). Alert: new unknown devices in probation.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 6280 // Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=6280
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy. NPS granted restricted access (probation) — device failed health check.
Event 6280 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Network Policy Server' subcategory (Success and/or Failure).
Alert: known-managed devices placed in probation (unexpected non-compliance = possible compromise). Alert: new unknown devices in probation.