{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/", "slug": "dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting", "url": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/" }, "title": "Choose parallel or fallback destinations for NPS accounting", "summary": "Should NPS write accounting records to both SQL and text, or use text only after SQL failure?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:26+00:00", "modified_at": "2026-09-08T18:23:26+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 199, "potentially_affected": "Administrators configuring Network Policy Server accounting destinations.", "dse_recommendation": "Have the authentication and database teams agree on the selected mode and ownership of failure alerts.", "primary_source": { "name": "Configure Network Policy Server Accounting", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-accounting-configure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

NPS can record accounting for authentication requests, acceptance and rejection messages, accounting exchanges, and periodic status updates. Microsoft offers text-only and SQL-only destinations, as well as two combined modes. Parallel logging writes to both destinations simultaneously. SQL logging with backup uses the text destination if SQL logging fails. NPS event logging is a separate facility used principally to audit and troubleshoot connection attempts. Microsoft documentation.

\n

Applicability

\n

Identify the accounting consumers, selected destination, database owner, retention requirements, and handling rules. Distinguish a requirement for simultaneous copies from a requirement for a fallback during a database outage.

\n

DSE recommendation

\n

Have the authentication and database teams agree on the selected mode and ownership of failure alerts. Document where operators should look for records during normal operation and during a logging failure. Review destination access and capacity before enabling the chosen accounting path.

\n

Verification

\n

Generate controlled accepted and rejected connection attempts and reconcile their timestamps with the expected records. In an approved test, make the SQL destination unavailable and inspect the documented fallback behavior. Record missing events or ambiguous destination ownership before relying on the accounting collection for investigations.

\n

Official references

\n

Microsoft Learn: Configure Network Policy Server Accounting. Source reviewed September 8, 2026.

", "content_text": "Source facts\nNPS can record accounting for authentication requests, acceptance and rejection messages, accounting exchanges, and periodic status updates. Microsoft offers text-only and SQL-only destinations, as well as two combined modes. Parallel logging writes to both destinations simultaneously. SQL logging with backup uses the text destination if SQL logging fails. NPS event logging is a separate facility used principally to audit and troubleshoot connection attempts. Microsoft documentation.\nApplicability\nIdentify the accounting consumers, selected destination, database owner, retention requirements, and handling rules. Distinguish a requirement for simultaneous copies from a requirement for a fallback during a database outage.\nDSE recommendation\nHave the authentication and database teams agree on the selected mode and ownership of failure alerts. Document where operators should look for records during normal operation and during a logging failure. Review destination access and capacity before enabling the chosen accounting path.\nVerification\nGenerate controlled accepted and rejected connection attempts and reconcile their timestamps with the expected records. In an approved test, make the SQL destination unavailable and inspect the documented fallback behavior. Record missing events or ambiguous destination ownership before relying on the accounting collection for investigations.\nOfficial references\nMicrosoft Learn: Configure Network Policy Server Accounting. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nNPS can record accounting for authentication requests, acceptance and rejection messages, accounting exchanges, and periodic status updates. Microsoft offers text-only and SQL-only destinations, as well as two combined modes. Parallel logging writes to both destinations simultaneously. SQL logging with backup uses the text destination if SQL logging fails. NPS event logging is a separate facility used principally to audit and troubleshoot connection attempts. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-accounting-configure).\n\n## Applicability\n\nIdentify the accounting consumers, selected destination, database owner, retention requirements, and handling rules. Distinguish a requirement for simultaneous copies from a requirement for a fallback during a database outage.\n\n## DSE recommendation\n\nHave the authentication and database teams agree on the selected mode and ownership of failure alerts. Document where operators should look for records during normal operation and during a logging failure. Review destination access and capacity before enabling the chosen accounting path.\n\n## Verification\n\nGenerate controlled accepted and rejected connection attempts and reconcile their timestamps with the expected records. In an approved test, make the SQL destination unavailable and inspect the documented fallback behavior. Record missing events or ambiguous destination ownership before relying on the accounting collection for investigations.\n\n## Official references\n\n[Microsoft Learn: Configure Network Policy Server Accounting](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-accounting-configure). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/", "url": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose parallel or fallback destinations for NPS accounting", "item": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/", "url": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/", "headline": "Choose parallel or fallback destinations for NPS accounting", "description": "Should NPS write accounting records to both SQL and text, or use text only after SQL failure?", "abstract": "Should NPS write accounting records to both SQL and text, or use text only after SQL failure?", "articleBody": "Source facts\nNPS can record accounting for authentication requests, acceptance and rejection messages, accounting exchanges, and periodic status updates. Microsoft offers text-only and SQL-only destinations, as well as two combined modes. Parallel logging writes to both destinations simultaneously. SQL logging with backup uses the text destination if SQL logging fails. NPS event logging is a separate facility used principally to audit and troubleshoot connection attempts. Microsoft documentation.\nApplicability\nIdentify the accounting consumers, selected destination, database owner, retention requirements, and handling rules. Distinguish a requirement for simultaneous copies from a requirement for a fallback during a database outage.\nDSE recommendation\nHave the authentication and database teams agree on the selected mode and ownership of failure alerts. Document where operators should look for records during normal operation and during a logging failure. Review destination access and capacity before enabling the chosen accounting path.\nVerification\nGenerate controlled accepted and rejected connection attempts and reconcile their timestamps with the expected records. In an approved test, make the SQL destination unavailable and inspect the documented fallback behavior. Record missing events or ambiguous destination ownership before relying on the accounting collection for investigations.\nOfficial references\nMicrosoft Learn: Configure Network Policy Server Accounting. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:26+00:00", "dateModified": "2026-09-08T18:23:26+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-105-choose-parallel-or-fallback-destinations-for-nps-accounting/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose parallel or fallback destinations for NPS accounting" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 199, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Network Policy Server Accounting", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-accounting-configure" } } ] } }