{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/", "slug": "dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry", "url": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/" }, "title": "Distinguish NPS revocation exceptions before changing the registry", "summary": "Which NPS setting bypasses all client revocation checks versus an unavailable CRL service?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:13:22+00:00", "modified_at": "2026-09-08T18:29:34+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 215, "potentially_affected": "Administrators reviewing EAP-TLS revocation-check exceptions on NPS.", "dse_recommendation": "Ask the identity and PKI owners to document the reason for any exception, its scope, and the plan to repair the underlying validation path.", "primary_source": { "name": "Configure Network Policy Server Certificate Revocation List registry settings for Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/network-policy-server-certificate-revocation-list-check-registry-settings", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents separate registry controls for different NPS certificate-revocation conditions. Enabling NoRevocationCheck prevents EAP-TLS from checking the client certificate for revocation. Enabling IgnoreRevocationOffline allows EAP-TLS clients to connect when the network server holding the CRL is unavailable. Microsoft Learn.

\n

Applicability

\n

Inventory the effective exception values and the actual certificate-validation failure before proposing a change. Separate a revoked credential from a failure to reach revocation information. Review the source definition of the selected value rather than inferring behavior from a similar registry name.

\n

DSE recommendation

\n

Ask the identity and PKI owners to document the reason for any exception, its scope, and the plan to repair the underlying validation path. Preserve the initial settings and relevant authentication events. Use a controlled test with a dedicated certificate set before changing production behavior. Keep any exception time-bounded and assigned to an owner who can remove it after repair.

\n

Verification

\n

Test valid, revoked, and unavailable-CRL conditions according to the approved laboratory plan. Compare NPS decisions with the intended exception semantics and record each outcome separately. Verify that repairing CRL access permits removal of the exception. Do not treat a newly successful connection as evidence that revocation validation remains intact.

\n

Official references

\n

Microsoft Learn: Configure Network Policy Server Certificate Revocation List registry settings for Windows Server. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft documents separate registry controls for different NPS certificate-revocation conditions. Enabling NoRevocationCheck prevents EAP-TLS from checking the client certificate for revocation. Enabling IgnoreRevocationOffline allows EAP-TLS clients to connect when the network server holding the CRL is unavailable. Microsoft Learn.\nApplicability\nInventory the effective exception values and the actual certificate-validation failure before proposing a change. Separate a revoked credential from a failure to reach revocation information. Review the source definition of the selected value rather than inferring behavior from a similar registry name.\nDSE recommendation\nAsk the identity and PKI owners to document the reason for any exception, its scope, and the plan to repair the underlying validation path. Preserve the initial settings and relevant authentication events. Use a controlled test with a dedicated certificate set before changing production behavior. Keep any exception time-bounded and assigned to an owner who can remove it after repair.\nVerification\nTest valid, revoked, and unavailable-CRL conditions according to the approved laboratory plan. Compare NPS decisions with the intended exception semantics and record each outcome separately. Verify that repairing CRL access permits removal of the exception. Do not treat a newly successful connection as evidence that revocation validation remains intact.\nOfficial references\nMicrosoft Learn: Configure Network Policy Server Certificate Revocation List registry settings for Windows Server. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents separate registry controls for different NPS certificate-revocation conditions. Enabling NoRevocationCheck prevents EAP-TLS from checking the client certificate for revocation. Enabling IgnoreRevocationOffline allows EAP-TLS clients to connect when the network server holding the CRL is unavailable. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/network-policy-server-certificate-revocation-list-check-registry-settings).\n\n## Applicability\n\nInventory the effective exception values and the actual certificate-validation failure before proposing a change. Separate a revoked credential from a failure to reach revocation information. Review the source definition of the selected value rather than inferring behavior from a similar registry name.\n\n## DSE recommendation\n\nAsk the identity and PKI owners to document the reason for any exception, its scope, and the plan to repair the underlying validation path. Preserve the initial settings and relevant authentication events. Use a controlled test with a dedicated certificate set before changing production behavior. Keep any exception time-bounded and assigned to an owner who can remove it after repair.\n\n## Verification\n\nTest valid, revoked, and unavailable-CRL conditions according to the approved laboratory plan. Compare NPS decisions with the intended exception semantics and record each outcome separately. Verify that repairing CRL access permits removal of the exception. Do not treat a newly successful connection as evidence that revocation validation remains intact.\n\n## Official references\n\n[Microsoft Learn: Configure Network Policy Server Certificate Revocation List registry settings for Windows Server](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/network-policy-server-certificate-revocation-list-check-registry-settings). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/", "url": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish NPS revocation exceptions before changing the registry", "item": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/", "url": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/", "headline": "Distinguish NPS revocation exceptions before changing the registry", "description": "Which NPS setting bypasses all client revocation checks versus an unavailable CRL service?", "abstract": "Which NPS setting bypasses all client revocation checks versus an unavailable CRL service?", "articleBody": "Source facts\nMicrosoft documents separate registry controls for different NPS certificate-revocation conditions. Enabling NoRevocationCheck prevents EAP-TLS from checking the client certificate for revocation. Enabling IgnoreRevocationOffline allows EAP-TLS clients to connect when the network server holding the CRL is unavailable. Microsoft Learn.\nApplicability\nInventory the effective exception values and the actual certificate-validation failure before proposing a change. Separate a revoked credential from a failure to reach revocation information. Review the source definition of the selected value rather than inferring behavior from a similar registry name.\nDSE recommendation\nAsk the identity and PKI owners to document the reason for any exception, its scope, and the plan to repair the underlying validation path. Preserve the initial settings and relevant authentication events. Use a controlled test with a dedicated certificate set before changing production behavior. Keep any exception time-bounded and assigned to an owner who can remove it after repair.\nVerification\nTest valid, revoked, and unavailable-CRL conditions according to the approved laboratory plan. Compare NPS decisions with the intended exception semantics and record each outcome separately. Verify that repairing CRL access permits removal of the exception. Do not treat a newly successful connection as evidence that revocation validation remains intact.\nOfficial references\nMicrosoft Learn: Configure Network Policy Server Certificate Revocation List registry settings for Windows Server. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:13:22+00:00", "dateModified": "2026-09-08T18:29:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-229-distinguish-nps-revocation-exceptions-before-changing-the-registry/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish NPS revocation exceptions before changing the registry" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 215, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Network Policy Server Certificate Revocation List registry settings for Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/network-policy-server-certificate-revocation-list-check-registry-settings" } } ] } }