# Trace local and forwarded requests through ordered NPS policies

> How does a mixed-role NPS choose between local processing and proxy forwarding?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:14:00+00:00
- Modified: 2026-09-08T18:26:32+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

How does a mixed-role NPS choose between local processing and proxy forwarding?

## Potentially affected

Administrators configuring NPS connection request policies for local and remote processing.

## DSE recommendation

Build a small decision table containing a request that should be forwarded, one that should stay local, and one that should match neither policy.

## Article

## Source facts

Microsoft documents an NPS instance acting as both a RADIUS server and a proxy through connection request policies. In its mixed-role example, the forwarding policy is evaluated before the default local-processing policy. A request matching the first policy is forwarded; one matching only the default is processed locally; a request matching neither is discarded. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies).

## Applicability

Identify each intended request population and its destination before editing policy order. Separate the decision about where a request is processed from the downstream decision about whether access is authorized. Include the actual access devices and identity formats in the review.

## DSE recommendation

Build a small decision table containing a request that should be forwarded, one that should stay local, and one that should match neither policy. Record the policy order and the expected processing location for each. Have the local and remote RADIUS owners agree on these results before the change. Preserve the original ordering and conditions so an unexpected routing result can be reversed.

## Verification

Send the approved test requests and correlate the chosen policy with the server that handled them. Confirm the unmatched case receives the intended outcome and does not reach an unintended destination. Record authorization results separately from routing results so a successful login cannot conceal a request processed on the wrong server.

## Official references

[Microsoft Learn: Connection Request Policies](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies). Source reviewed September 8, 2026.

## Primary reference

- Name: Connection Request Policies
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-crpolicies
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Trace local and forwarded requests through ordered NPS policies,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-191-trace-local-and-forwarded-requests-through-ordered-nps-policies/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.