NPS policy not matching unless domain admin

[UrbanizedJam]

I have come across an issue where a Windows NPS policy is not being matched unless a user is in the domain admin group. A simple test of a user who is in the domain admins group can log onto a network device, but as soon as I remove them from the domain admin group, they can not log on. The policy does not have domain admin as part of the policy. The server had been hardened via group policy with the settings specified in the ACSC windows 10 gardening guide https://www.cyber.gov.au/sites/defa... Microsoft Windows 10 version 21H1 Workstatio

Continue reading...