{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/", "slug": "dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm", "url": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/" }, "title": "Trace how NPS interprets and rewrites a user realm", "summary": "Which realm does NPS use before processing or forwarding a RADIUS request?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:23+00:00", "modified_at": "2026-09-08T18:26:31+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 227, "potentially_affected": "Administrators reviewing realm handling in Network Policy Server connection request policies.", "dse_recommendation": "For each approved format, write the expected realm and any transformation explicitly.", "primary_source": { "name": "Realm Names", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-realm-names", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A RADIUS User-Name commonly carries both an account name and its account location, which Microsoft calls the realm. NPS can rewrite User-Name using regular-expression attribute rules before handling the request locally or forwarding it. Microsoft explicitly excludes PEAP from realm manipulation support. When a supplied user name has no domain, NPS ordinarily supplies the domain to which the NPS computer belongs. Microsoft Learn.

\n

Applicability

\n

Confirm the authentication method first; do not plan realm rewriting for PEAP. Collect the user-name formats expected from each access device, using sanitized examples. Separate the name entered by the user from the names received by NPS and presented to the destination server.

\n

DSE recommendation

\n

For each approved format, write the expected realm and any transformation explicitly. Ask the identity and network-access owners to approve the mapping together. Include an unqualified name and a deliberately unexpected realm in the test set. Keep rules narrow, preserve their order and previous expressions, and avoid treating a successful request from one format as proof that all formats route correctly.

\n

Verification

\n

Trace representative requests through the applicable connection request policy. Compare the received and forwarded identities with the approved mapping and record the selected destination. Investigate unexpected defaults, truncation, or changed user names before expanding the rule. Store only sanitized identity examples in ordinary change records.

\n

Official references

\n

Microsoft Learn: Realm Names. Source reviewed September 8, 2026.

", "content_text": "Source facts\nA RADIUS User-Name commonly carries both an account name and its account location, which Microsoft calls the realm. NPS can rewrite User-Name using regular-expression attribute rules before handling the request locally or forwarding it. Microsoft explicitly excludes PEAP from realm manipulation support. When a supplied user name has no domain, NPS ordinarily supplies the domain to which the NPS computer belongs. Microsoft Learn.\nApplicability\nConfirm the authentication method first; do not plan realm rewriting for PEAP. Collect the user-name formats expected from each access device, using sanitized examples. Separate the name entered by the user from the names received by NPS and presented to the destination server.\nDSE recommendation\nFor each approved format, write the expected realm and any transformation explicitly. Ask the identity and network-access owners to approve the mapping together. Include an unqualified name and a deliberately unexpected realm in the test set. Keep rules narrow, preserve their order and previous expressions, and avoid treating a successful request from one format as proof that all formats route correctly.\nVerification\nTrace representative requests through the applicable connection request policy. Compare the received and forwarded identities with the approved mapping and record the selected destination. Investigate unexpected defaults, truncation, or changed user names before expanding the rule. Store only sanitized identity examples in ordinary change records.\nOfficial references\nMicrosoft Learn: Realm Names. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nA RADIUS User-Name commonly carries both an account name and its account location, which Microsoft calls the realm. NPS can rewrite User-Name using regular-expression attribute rules before handling the request locally or forwarding it. Microsoft explicitly excludes PEAP from realm manipulation support. When a supplied user name has no domain, NPS ordinarily supplies the domain to which the NPS computer belongs. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-realm-names).\n\n## Applicability\n\nConfirm the authentication method first; do not plan realm rewriting for PEAP. Collect the user-name formats expected from each access device, using sanitized examples. Separate the name entered by the user from the names received by NPS and presented to the destination server.\n\n## DSE recommendation\n\nFor each approved format, write the expected realm and any transformation explicitly. Ask the identity and network-access owners to approve the mapping together. Include an unqualified name and a deliberately unexpected realm in the test set. Keep rules narrow, preserve their order and previous expressions, and avoid treating a successful request from one format as proof that all formats route correctly.\n\n## Verification\n\nTrace representative requests through the applicable connection request policy. Compare the received and forwarded identities with the approved mapping and record the selected destination. Investigate unexpected defaults, truncation, or changed user names before expanding the rule. Store only sanitized identity examples in ordinary change records.\n\n## Official references\n\n[Microsoft Learn: Realm Names](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-realm-names). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/", "url": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Trace how NPS interprets and rewrites a user realm", "item": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/", "url": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/", "headline": "Trace how NPS interprets and rewrites a user realm", "description": "Which realm does NPS use before processing or forwarding a RADIUS request?", "abstract": "Which realm does NPS use before processing or forwarding a RADIUS request?", "articleBody": "Source facts\nA RADIUS User-Name commonly carries both an account name and its account location, which Microsoft calls the realm. NPS can rewrite User-Name using regular-expression attribute rules before handling the request locally or forwarding it. Microsoft explicitly excludes PEAP from realm manipulation support. When a supplied user name has no domain, NPS ordinarily supplies the domain to which the NPS computer belongs. Microsoft Learn.\nApplicability\nConfirm the authentication method first; do not plan realm rewriting for PEAP. Collect the user-name formats expected from each access device, using sanitized examples. Separate the name entered by the user from the names received by NPS and presented to the destination server.\nDSE recommendation\nFor each approved format, write the expected realm and any transformation explicitly. Ask the identity and network-access owners to approve the mapping together. Include an unqualified name and a deliberately unexpected realm in the test set. Keep rules narrow, preserve their order and previous expressions, and avoid treating a successful request from one format as proof that all formats route correctly.\nVerification\nTrace representative requests through the applicable connection request policy. Compare the received and forwarded identities with the approved mapping and record the selected destination. Investigate unexpected defaults, truncation, or changed user names before expanding the rule. Store only sanitized identity examples in ordinary change records.\nOfficial references\nMicrosoft Learn: Realm Names. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:23+00:00", "dateModified": "2026-09-08T18:26:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-168-trace-how-nps-interprets-and-rewrites-a-user-realm/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Trace how NPS interprets and rewrites a user realm" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 227, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Realm Names", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-realm-names" } } ] } }