{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/",
        "slug": "dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies",
        "url": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/"
        },
        "title": "Trace local and forwarded requests through ordered NPS policies",
        "summary": "How does a mixed-role NPS choose between local processing and proxy forwarding?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-08T18:14:00+00:00",
        "modified_at": "2026-09-08T18:26:32+00:00",
        "reviewed_on": "2026-09-08",
        "reading_minutes": 2,
        "word_count": 227,
        "potentially_affected": "Administrators configuring NPS connection request policies for local and remote processing.",
        "dse_recommendation": "Build a small decision table containing a request that should be forwarded, one that should stay local, and one that should match neither policy.",
        "primary_source": {
            "name": "Connection Request Policies",
            "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft documents an NPS instance acting as both a RADIUS server and a proxy through connection request policies. In its mixed-role example, the forwarding policy is evaluated before the default local-processing policy. A request matching the first policy is forwarded; one matching only the default is processed locally; a request matching neither is discarded. <a href=\"https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Identify each intended request population and its destination before editing policy order. Separate the decision about where a request is processed from the downstream decision about whether access is authorized. Include the actual access devices and identity formats in the review.</p>\n<h2>DSE recommendation</h2>\n<p>Build a small decision table containing a request that should be forwarded, one that should stay local, and one that should match neither policy. Record the policy order and the expected processing location for each. Have the local and remote RADIUS owners agree on these results before the change. Preserve the original ordering and conditions so an unexpected routing result can be reversed.</p>\n<h2>Verification</h2>\n<p>Send the approved test requests and correlate the chosen policy with the server that handled them. Confirm the unmatched case receives the intended outcome and does not reach an unintended destination. Record authorization results separately from routing results so a successful login cannot conceal a request processed on the wrong server.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Connection Request Policies</a>. Source reviewed September 8, 2026.</p>",
        "content_text": "Source facts\nMicrosoft documents an NPS instance acting as both a RADIUS server and a proxy through connection request policies. In its mixed-role example, the forwarding policy is evaluated before the default local-processing policy. A request matching the first policy is forwarded; one matching only the default is processed locally; a request matching neither is discarded. Microsoft Learn.\nApplicability\nIdentify each intended request population and its destination before editing policy order. Separate the decision about where a request is processed from the downstream decision about whether access is authorized. Include the actual access devices and identity formats in the review.\nDSE recommendation\nBuild a small decision table containing a request that should be forwarded, one that should stay local, and one that should match neither policy. Record the policy order and the expected processing location for each. Have the local and remote RADIUS owners agree on these results before the change. Preserve the original ordering and conditions so an unexpected routing result can be reversed.\nVerification\nSend the approved test requests and correlate the chosen policy with the server that handled them. Confirm the unmatched case receives the intended outcome and does not reach an unintended destination. Record authorization results separately from routing results so a successful login cannot conceal a request processed on the wrong server.\nOfficial references\nMicrosoft Learn: Connection Request Policies. Source reviewed September 8, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft documents an NPS instance acting as both a RADIUS server and a proxy through connection request policies. In its mixed-role example, the forwarding policy is evaluated before the default local-processing policy. A request matching the first policy is forwarded; one matching only the default is processed locally; a request matching neither is discarded. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies).\n\n## Applicability\n\nIdentify each intended request population and its destination before editing policy order. Separate the decision about where a request is processed from the downstream decision about whether access is authorized. Include the actual access devices and identity formats in the review.\n\n## DSE recommendation\n\nBuild a small decision table containing a request that should be forwarded, one that should stay local, and one that should match neither policy. Record the policy order and the expected processing location for each. Have the local and remote RADIUS owners agree on these results before the change. Preserve the original ordering and conditions so an unexpected routing result can be reversed.\n\n## Verification\n\nSend the approved test requests and correlate the chosen policy with the server that handled them. Confirm the unmatched case receives the intended outcome and does not reach an unintended destination. Record authorization results separately from routing results so a successful login cannot conceal a request processed on the wrong server.\n\n## Official references\n\n[Microsoft Learn: Connection Request Policies](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies). Source reviewed September 8, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-08"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Trace local and forwarded requests through ordered NPS policies",
                        "item": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/",
                "headline": "Trace local and forwarded requests through ordered NPS policies",
                "description": "How does a mixed-role NPS choose between local processing and proxy forwarding?",
                "abstract": "How does a mixed-role NPS choose between local processing and proxy forwarding?",
                "articleBody": "Source facts\nMicrosoft documents an NPS instance acting as both a RADIUS server and a proxy through connection request policies. In its mixed-role example, the forwarding policy is evaluated before the default local-processing policy. A request matching the first policy is forwarded; one matching only the default is processed locally; a request matching neither is discarded. Microsoft Learn.\nApplicability\nIdentify each intended request population and its destination before editing policy order. Separate the decision about where a request is processed from the downstream decision about whether access is authorized. Include the actual access devices and identity formats in the review.\nDSE recommendation\nBuild a small decision table containing a request that should be forwarded, one that should stay local, and one that should match neither policy. Record the policy order and the expected processing location for each. Have the local and remote RADIUS owners agree on these results before the change. Preserve the original ordering and conditions so an unexpected routing result can be reversed.\nVerification\nSend the approved test requests and correlate the chosen policy with the server that handled them. Confirm the unmatched case receives the intended outcome and does not reach an unintended destination. Record authorization results separately from routing results so a successful login cannot conceal a request processed on the wrong server.\nOfficial references\nMicrosoft Learn: Connection Request Policies. Source reviewed September 8, 2026.",
                "datePublished": "2026-09-08T18:14:00+00:00",
                "dateModified": "2026-09-08T18:26:32+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Trace local and forwarded requests through ordered NPS policies"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 227,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Connection Request Policies",
                    "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies"
                }
            }
        ]
    }
}