NAP Client Configuration

Network Access Protection (NAP), a new feature in this version of Windows and Windows Server® 2008, allows you to define and enforce client computer health policies so that unhealthy computers are less likely to access your network. To implement NAP, you must configure NAP settings on both servers and client computers.

There are three tools that you can use to configure NAP client settings:

  • The NAP Client Configuration snap-in provides a graphical user interface with which you can configure NAP client settings on the local computer or in a configuration file that you can save and apply to other computers.

  • The Netsh commands for NAP client provide a command-line tool that you can use to configure client computers or to create a configuration file that you can save and apply to other computers.

  • If you want to manage NAP client settings on domain member client computers, you can use the Group Policy Management Console and the NAP Client Configuration snap-in to configure the NAP client configuration Group Policy settings. When you configure NAP client settings in Group Policy, these settings are automatically configured on NAP-capable domain member client computers when Group Policy is refreshed.

For an overview of managing client computers that are NAP-capable, see NAP Client Configuration Overview.

For a list of steps that guide you through the NAP client configuration process, see NAP Client Configuration Checklist.

To enable and disable NAP enforcement clients, see Configure NAP Enforcement Clients.

To specify branding text and graphics for the NAP user interface, see Configure the NAP Client User Interface.

To specify the health registration authority (HRA) servers with which a client computer communicates and to specify the cryptographic mechanism that client computers use to communicate with HRA servers, see Configure Health Registration Settings.

To configure NAP tracing, see Configure NAP Tracing.

To create and manage configuration files that contain NAP settings, see Use NAP Client Configuration Files.


NAP Client Configuration Overview

Before you can use Network Access Protection (NAP) to enforce health policies on client computers, you need to configure NAP settings on your client computers. NAP Client Configuration, a Microsoft Management Console (MMC) snap-in released with this version of Windows and Windows Server® 2008, provides a graphical user interface for configuring NAP client settings.

Why do I need to manage NAP settings on client computers?

NAP relies on both server and client components. To make the server components and client components work together, you must configure NAP settings on both the servers and the client computers.

The server components are responsible for validating the health of client computers and specifying which network resources are available to client computers.

The client components are responsible for compiling health status statements on client computers, maintaining a client computer's health state, and communicating a client computer's health state to the server components.

Specifically, the NAP Client Configuration snap-in helps you configure NAP user interface settings, NAP enforcement client settings, and health registration authority (HRA) settings on your client computers. A NAP enforcement client is responsible for enforcing network access restrictions.

For most NAP scenarios, you need to configure NAP enforcement client settings and NAP user interface settings only; you do not need to configure NAP health registration authority settings unless you deploy IPsec-based enforcement. By default, the built-in NAP enforcement clients are disabled. To enforce health policies on a client computer, you must enable at least one NAP enforcement client.

What can I do with NAP Client Configuration?

You can use the NAP Client Configuration snap-in to perform the following tasks on your client computers:

  • Enable and disable NAP enforcement clients, including the built-in NAP enforcement clients that are provided with the NAP platform and any non-Microsoft NAP enforcement clients.

  • Configure branding text and graphics for the NAP user interface that appears on client computers.

  • Specify with which HRA servers you want client computers to communicate.

  • Specify the cryptographic mechanism that you want client computers to use when communicating with HRA servers.

In addition, you can use NAP Client Configuration to enable and disable NAP tracing, specify the level of detail you want to capture in a tracing log file, and import and export NAP client settings using an .xml-based configuration file.

When should I use NAP Client Configuration?

NAP Client Configuration is one of three tools you can use to configure NAP settings on your client computers. In addition to NAP Client Configuration, you can configure NAP settings on local client computers by using the Netsh commands for NAP client, or you can use the Group Policy Management Console (GPMC) to configure the NAP Client Configuration Group Policy settings. When you configure NAP client settings in Group Policy, these settings are automatically configured on NAP-capable domain member client computers when Group Policy is refreshed.

You should use NAP Client Configuration on a local computer when any of the following are true:

  • You want to use a graphical user interface to configure NAP settings on a local computer instead of using the Netsh commands for NAP client.

  • Your organization uses Group Policy to manage domain member client computers and you want to create an .xml configuration file that you can use to configure the NAP Group Policy settings.

  • You have a small number of computers that require custom configuration settings and you want to configure each computer individually.

  • You want to configure all of your client computers in exactly the same way but you cannot automate or manage the configuration process by using scripts or Group Policy.

You should use NAP Client Configuration through Group Policy when your organization uses Group Policy to manage client computers and you want NAP Group Policy settings applied to client computers when Group Policy settings are applied.

NAP Client Configuration can be used to configure NAP-capable computers only. A computer is NAP-capable if it has the NAP components installed and it can verify its health by creating a statement of health. Computers running this version of Windows and Windows Server 2008 are NAP-capable. Computers running other operating systems might be NAP-capable if an update that installs the NAP components is available and has been run on the computer. You cannot use NAP Client Configuration to manage a NAP-upgradeable computer until you install the NAP components. Also, you cannot use NAP Client Configuration to manage a NAP-ineligible computer. NAP-ineligible computers cannot be upgraded with the NAP components and cannot verify health with a statement of health.

Note

You cannot use NAP Client Configuration to configure NAP settings on a remote computer. NAP Client Configuration can be used only to configure NAP settings on a local computer or to create an .xml configuration file on a local computer.

Additional references

Use NAP Client Configuration Files

Configure NAP Enforcement Clients

Configure the NAP Client User Interface

Configure Health Registration Settings

Configure NAP Tracing


NAP Client Configuration Checklist

Use the following checklist to help ensure that you correctly configure NAP settings on client computers.

Step | Reference
Review NAP Client Configuration Concepts. (Optional) | NAP Client Configuration Overview
Determine whether you want to import a configuration file. (Optional) | Import NAP Client Configuration Settings
Enable one or more NAP enforcement clients. (Required) | Configure NAP Enforcement Clients
Specify branding text and graphics for the NAP user interface. (Optional) | Configure NAP Client Request Policy
Specify the health registration authority (HRA) servers with which a client computer will communicate. (Optional) | Configure Trusted Server Groups for NAP Clients
Specify the cryptographic mechanism that client computers use to communicate with HRA servers. (Optional) | Configure NAP Client Request Policy
Configure NAP tracing and the level of detail you want to record in a tracing log file. (Optional) | Configure NAP Tracing
Determine whether you want to save NAP settings to a configuration file. (Optional) | Export NAP Client Configuration Settings


Use NAP Client Configuration Files

You can use the NAP Client Configuration snap-in to import NAP client settings from an *.xml format configuration file or to export NAP client settings to an *.xml format configuration file. This allows you to create a configuration file on one computer and then import the configuration to multiple computers, reducing the administrative overhead of manually configuring every computer.

You can also use a configuration file to configure NAP Group Policy settings by importing an existing configuration file into the NAP Client Configuration Group Policy extension. The NAP Client Configuration Group Policy extension is located within the Group Policy Management Console. If you configure NAP client settings in Group Policy, these settings are applied to all NAP-capable domain member computers when Group Policy is applied.

When to perform this task

You should export your settings to a configuration file when:

  • You want to apply the same NAP settings to multiple computers using the NAP Client Configuration snap-in.

  • You want to configure NAP Group Policy settings by importing the configuration file into the Group Policy Management Console.

To complete this task, perform the following procedures:

Export NAP Client Configuration Settings

Import NAP Client Configuration Settings

Additional references

NAP Client Configuration Overview

NAP Client Configuration Checklist


Export NAP Client Configuration Settings

Exporting settings to a configuration file

  • Using the Windows interface

  • Using a command line

To export settings to a configuration file by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, right-click NAP Client Configuration, and then click Export.

  3. In the Export NAP Configuration dialog box, in Save in, click the location where you want to save the file.

  4. In File name, type a file name for the configuration file.

  5. Click Save.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To export settings to a configuration file by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client export filename = <filename>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<filename> | Any string. | The path and file name for the configuration file.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Import NAP Client Configuration Settings

Command-line syntax notation


Import NAP Client Configuration Settings

Importing settings from a configuration file

  • Using the Windows interface

  • Using a command line

To import settings from a configuration file by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, right-click NAP Client Management, and then click Import.

  3. In the Import NAP Configuration dialog box, in Look in, click the location where the configuration file is stored.

  4. In File name, type the file name for the configuration file.

  5. Click Open.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To import settings from a configuration file by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client import filename = <filename>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<filename> | Any string. | The path and file name for the configuration file.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Export NAP Client Configuration Settings

Command-line syntax notation


Configure NAP Enforcement Clients

You can use the NAP Client Configuration snap-in to enable, disable, add, and delete Network Access Protection (NAP) enforcement clients. A NAP enforcement client is responsible for requesting access to a network, communicating a client computer's health status to the NAP server that is authorizing the network access, and communicating the connection status of the client computer to other components of the NAP client architecture.

In this version of Windows, there are five built-in enforcement clients corresponding to the following network access mechanisms:

Enforcement client | Description
Dynamic Host Configuration Protocol (DHCP) | Enforces health policies when a client computer attempts to obtain an IP address from a DHCP server.
Extensible Authentication Protocol (EAP) | Enforces health policies when a client computer attempts to access a network through an 802.1X wireless connection or an authenticating switch connection.
Remote access | Enforces health policies when a client computer attempts to gain access to the network through a virtual private network (VPN) connection.
Internet Protocol security (IPsec) | Enforces health policies when a client computer attempts to communicate with another computer using IPsec.
Terminal Services Gateway (TS Gateway) | Enforces health policies on a computer attempting to access a terminal server.

In addition to the built-in enforcement clients, there might also be one or more additional enforcement clients present on a client computer. You can also use the NAP Client Configuration snap-in to enable, disable, add, and delete enforcement clients that are not provided with the operating system.

When to perform this task

To implement NAP in your organization, you must enable at least one NAP enforcement client on client computers. You might also need to enable additional enforcement clients as your network health requirements change and you want to enforce health policies through other network access mechanisms.

You might need to disable enforcement clients when you are troubleshooting network access problems or when your health requirements change and you want to enforce health policies by using other enforcement clients.

You might need to add or remove enforcement clients when you install or uninstall Microsoft enforcement clients.

To complete this task, perform the following procedures:

Enable and Disable the DHCP Enforcement Client

Enable and Disable the Remote Access Enforcement Client

Enable and Disable the IPsec Enforcement Client

Enable and Disable the EAP Enforcement Client

Enable and Disable the TS Gateway Enforcement Client

Additional references

NAP Client Configuration Overview

NAP Client Configuration Checklist


Enable and Disable the DHCP Enforcement Client

Enabling and disabling the DHCP enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the DHCP enforcement client by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click Enforcement Clients.

  3. Right-click DHCP Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable and disable the DHCP enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. To enable or disable the DHCP enforcement client, do one of the following:

    1. To enable the DHCP enforcement client, type: netsh nap client set enforcement ID = 79617 ADMIN = "ENABLE"

    2. To disable the DHCP enforcement client, type: netsh nap client set enforcement ID = 79617 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure NAP Enforcement Clients


Enable and Disable the IPsec Enforcement Client

Enabling and disabling the IPsec enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the IPsec enforcement client by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click Enforcement Clients.

  3. Right-click IPsec Relying Party, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • You must have Internet Protocol security (IPsec) policies and domain isolation deployed in your organization to enforce network access restriction with the IPsec enforcement client.

To enable and disable the IPsec enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. To enable or disable the IPsec enforcement client, do one of the following:

    1. To enable the IPsec enforcement client, type: netsh nap client set enforcement ID = 79619 ADMIN = "ENABLE"

    2. To disable the IPsec enforcement client, type: netsh nap client set enforcement ID = 79619 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • You must have IPsec policies and domain isolation deployed in your organization to enforce network access restriction with the IPsec enforcement client.

Additional references

Configure NAP Enforcement Clients


Enable and Disable the EAP Enforcement Client

Enabling and disabling the EAP enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the EAP enforcement client by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click Enforcement Clients.

  3. Right-click EAP Quarantine Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable and disable the EAP enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. To enable or disable the EAP enforcement client, do one of the following:

    1. To enable the EAP enforcement client, type: netsh nap client set enforcement ID = 79623 ADMIN = "ENABLE"

    2. To disable the EAP enforcement client, type: netsh nap client set enforcement ID = 79623 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure NAP Enforcement Clients


Enable and Disable the Remote Access Enforcement Client

Enabling and disabling the remote access enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the remote access enforcement client by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click Enforcement Clients.

  3. Right-click Remote Access Quarantine Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable or disable the remote access enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. To enable or disable the remote access enforcement client, do one of the following:

    1. To enable the remote access enforcement client, type: netsh nap client set enforcement ID = 79618 ADMIN = "ENABLE"

    2. To disable the remote access enforcement client, type: netsh nap client set enforcement ID = 79618 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure NAP Enforcement Clients


Enable and Disable the TS Gateway Enforcement Client

Enabling and disabling the TS gateway enforcement client

  • Using the Windows interface

  • Using a command line

To enable and disable the TS gateway enforcement client by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click Enforcement Clients.

  3. Right-click TS Gateway Quarantine Enforcement Client, and then click Enable or Disable.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable or disable the TS gateway enforcement client by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. To enable or disable the TS Gateway enforcement client, do one of the following:

    1. To enable the TS Gateway enforcement client, type: netsh nap client set enforcement ID = 79621 ADMIN = "ENABLE"

    2. To disable the TS Gateway enforcement client, type: netsh nap client set enforcement ID = 79621 ADMIN = "DISABLE"

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure NAP Enforcement Clients


Configure the NAP Client User Interface

You can use the NAP Client Configuration snap-in to configure the Network Access Protection (NAP) Status user interface that appears on a client computer. The NAP Status user interface consists of one dialog box and provides information about the NAP agents that are enabled on the computer, network enforcement status, and remediation status.

By default, the NAP dialog box contains no branding information. Adding branding information is optional.

You should customize the NAP user interface when:

  • You want users to have a clear understanding that their network access is being controlled by your organization.

  • You want to provide contact information for your IT department so that users can get assistance when a computer has limited network access.

You can customize the following user interface elements:

Element | Details
Title | This appears as a banner at the top of the NAP Status dialog box and is usually the name of your organization or the name of your organization's IT department.
Description | This appears below the title and is usually the slogan for your organization or the slogan for your organization's IT department. The description can also contain contact information for your organization's Help desk or your organization's IT department.
Image | This appears beside the title and is usually the logo of your organization or the logo of your organization's IT department. The image you specify must be one of the following file types: .jpg, .bmp, or .gif.

Additional references

Specify Title Text for the NAP Client User Interface

Specify Description Text for the NAP Client User Interface

Specify an Image for the NAP Client User Interface

NAP Client Configuration Overview

NAP Client Configuration Checklist


Specify Title Text for the NAP Client User Interface

Specifying title text for the NAP client user interface

  • Using the Windows interface

  • Using a command line

To specify title text for the NAP client user interface by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click User Interface Settings.

  3. Right-click UI Settings, and then click Properties.

  4. In the UI Settings Properties dialog box, in Title, type the title text that you want to appear in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify title text for the NAP client user interface by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client set userinterface title = <title>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<title> | Any string. | The title that you want to display in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure the NAP Client User Interface

Command-line syntax notation


Specify Description Text for the NAP Client User Interface

Specifying description text for the NAP client user interface

  • Using the Windows interface

  • Using a command line

To specify the description text for the NAP client user interface by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click User Interface Settings.

  3. Right-click UI Settings, and then click Properties.

  4. In the UI Settings Properties dialog box, in Description, type the description text that you want to appear in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify the description text for the NAP client user interface by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client set userinterface text = <text>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<text> | Any string. | The description that you want to display in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure the NAP Client User Interface

Command-line syntax notation


Specify an Image for the NAP Client User Interface

Specifying an image for the NAP client user interface

  • Using the Windows interface

  • Using a command line

To specify an image for the NAP client user interface by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, click User Interface Settings.

  3. Right-click UI Settings, and then click Properties.

  4. In the UI Settings Properties dialog box, click Browse, and select the image that you want to appear in the NAP client user interface.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify an image for the NAP client user interface by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client set userinterface image = <image>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<image> | The path to an image that is saved in the following file formats: .jpg, bmp, and .gif. | The image that you want to display in the NAP client user interface.
Note

To concurrently specify the NAP client user interface title, description, and image, type: netsh nap client set userinterface title = <title> text = <text> image = <image>

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure the NAP Client User Interface

Command-line syntax notation


Configure Health Registration Settings

You can use the NAP Client Configuration snap-in to specify the security mechanisms that a client computer uses to communicate with health registration authority (HRA) servers. In addition, you can use the NAP Client Configuration snap-in to specify the HRA servers with which a client computer can communicate. A client computer must communicate with an HRA server to obtain a health certificate. A health certificate is required for NAP with IPsec-based enforcement.

To specify which security mechanism a client uses to communicate with an HRA server, you must configure the request policy. The request policy specifies the asymmetric key algorithm, hash algorithm, and cryptographic service provider a client computer uses when it initiates communication with an HRA server. You can specify only one asymmetric key algorithm, hash algorithm, and cryptographic service provider on a client computer.

When you configure an asymmetric key algorithm, hash algorithm, or cryptographic service provider on the client, you must configure exactly the same request policy on the HRA server. For example, if you configure your clients to encrypt communication using only the Rivest-Shamir-Adelman (RSA) asymmetric key algorithm with a minimum key length of 128, then you must configure your HRA servers to accept communication that is encrypted with exactly the same asymmetric key algorithm and exactly the same minimum key length. If your HRA servers and client computers are not configured to use the same request policy, then your HRA servers will not be able to communicate with your client computers and your client computers could be deemed unhealthy and could have limited network connectivity. If you do not configure request policy settings on a client computer, the client computer initiates a negotiation process with the HRA using the default security mechanism for encrypting communication.

Important

You should not modify request policy settings unless you have thoroughly tested your request policy settings in a secure test environment. Altering request policy settings can cause your client computers to lose network connectivity.

To specify which HRA servers you want a client computer to communicate with, you must configure a trusted server group. A trusted server group consists of one or more HRA servers. If you have more than one HRA server in a trusted server group, you can specify the order in which client computers attempt to contact the servers. This is useful if you have several HRA servers in different network segments or domains and you want to prioritize which servers a client attempts to access first. You must configure at least one trusted server group; otherwise, a client computer will not know how to contact an HRA server to obtain a certificate of health.

Configure NAP Client Request Policy

Configure Trusted Server Groups for NAP Clients

Additional references

NAP Client Configuration Overview

NAP Client Configuration Checklist


Configure NAP Client Request Policy

You can use the NAP Client Configuration snap-in to specify the security mechanisms a client computer uses to communicate with Health Registration Authority (HRA) servers. These settings, known as request policy settings, determine which hash algorithm and cryptographic service provider (CSP) a client computer uses to encrypt communication with HRA servers. You can only specify one hash algorithm and CSP on a client computer. When specified, the client computer will use only that security mechanism to communicate with HRA servers.

You do not need to configure request policy settings on your client computers. By default, a NAP-capable client computer initiates a negotiation process with an HRA server using a mutually acceptable default security mechanism for encrypting communication. It is recommended that you use the default request policy settings.

Important

You should not modify request policy settings unless you have thoroughly tested your request policy settings in a secure test environment. Altering request policy settings can cause your client computers to lose network connectivity.

If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same hash algorithm and CSP as your client computers, then your HRA servers will not be able to communicate with client computers and client computers might be deemed unhealthy, resulting in limited network connectivity.

Specify a Hash Algorithm

Specify a Cryptographic Service Provider

Additional references

Configure Health Registration Settings


Specify a Hash Algorithm

Specifying a hash algorithm

  • Using the Windows interface

  • Using a command line

To specify a hash algorithm by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, open Health Registration Settings, and click Request Policy.

  3. Right-click Hash algorithms, and then click Properties.

  4. In the Hash algorithms Properties dialog box, click Specific, and then click the hash algorithm you want to use.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers could be deemed unhealthy and could have limited network connectivity.

To specify a hash algorithm by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type the following to obtain a list of the hash algorithms that are supported on the client computer: netsh nap client show hashes

  3. Type: netsh nap client set hash oid = <oid>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<oid> | The object identifier (OID) of any supported hash algorithm. | The object identifier of the hash algorithm you want to use to encrypt communication between a client computer and an HRA server. The default is 1.3.14.3.2.29 (sha1RSA).

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers could be deemed unhealthy and could have limited network connectivity.

Additional references

Configure NAP Client Request Policy

Configure Health Registration Settings

Command-line syntax notation


Specify a Cryptographic Service Provider

Specifying a cryptographic service provider

  • Using the Windows interface

  • Using a command line

To specify a cryptographic service provider by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, open Health Registration Settings, and click Request Policy.

  3. Right-click Cryptographic Service Providers, and then click Properties.

  4. In the Cryptographic Service Providers Properties dialog box, click Specific, and then click the cryptographic service provider you want to use.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash key algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers could be deemed unhealthy and could have limited network connectivity.

To specify a cryptographic service provider by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type the following to obtain a list of the cryptographic service providers that are supported on the client computer: netsh nap client show csps

  3. Type: netsh nap client set csp name = <name> keylength = <keylength>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<name> | Any supported cryptographic service provider. | The name of the cryptographic service provider you want to use to encrypt communication between a client computer and an HRA server.
<keylength> | Any integer. (Optional) | Specifies the length of the asymmetric key. The default is 2048.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • If you configure request policy settings on your client computers, you must configure identical request policy settings on your HRA servers. If your HRA servers are not configured to use exactly the same asymmetric key algorithm, hash key algorithm, and cryptographic service provider as your client computers, then your HRA servers will not be able to communicate with your client computers. Your client computers could be deemed unhealthy and could have limited network connectivity.

Additional references

Configure NAP Client Request Policy

Configure Health Registration Settings

Command-line syntax notation


Configure Trusted Server Groups for NAP Clients

You can use the NAP Client Configuration snap-in to specify the health registration authority (HRA) servers that a client computer uses to obtain a health certificate. To do this you must create a trusted server group, which is an ordered list of one or more HRA servers. If there is more than one HRA server listed in a trusted server group, a client computer attempts to contact each HRA server in the order specified until an available server is found.

You must configure a trusted server group only if you are using the Internet Protocol security (IPsec) enforcement client to enforce health policies. The IPsec enforcement client relies on health certificates and HRA servers to enforce health policies.

Important

You do not need to configure trusted server groups if you are using the Dynamic Host Configuration Protocol (DHCP) enforcement client, the Extensible Authentication Protocol (EAP) enforcement client, or the remote access enforcement client.

Create a Trusted Server Group

Delete a Trusted Server Group

Add an HRA Server to a Trusted Server Group

Remove an HRA Server from a Trusted Server Group

Change the Name of a Trusted Server Group

Change the Order of the HRA Servers in a Trusted Server Group

Change the URL of an HRA Server in a Trusted Server Group

Additional references

Configure Health Registration Settings


Create a Trusted Server Group

Creating a trusted server group

  • Using the Windows interface

  • Using a command line

To create a trusted server group by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, double-click Health Registration Settings.

  3. Right-click Trusted Server Groups, and then click New.

  4. In the Group Name page of the New Trusted Server Group wizard, type the name of the new trusted server group, and then click Next.

  5. In the Add Servers page of the New Trusted Server Group wizard, type the URL of an HRA server you want to add to the trusted server group, and then click Add. If your HRA server does not use server verification, then you must clear the Require server verification (https:) for all servers in this group check box before clicking Add.

  6. Repeat step 5 until you had added all of the HRA servers that you want to add to the trusted server group.

  7. Click Next to review the group name and the URLs of trusted servers, and then click Finish.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To create a trusted server group by using the command prompt

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client add trustedservergroup name = <group> requirehttps = <requirehttps>

  3. Type: netsh nap client add server group = <group> url = <url> processingorder = <processingorder>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are creating.
<requirehttps> | ENABLE, DISABLE (Optional) | If set to DISABLE, then server verification (HTTPS) is not required. If no value is entered or requirehttps is set to ENABLE, then HTTPS is required.
<url> | Any valid URL, UNC path, or IP address. If requirehttps is set to ENABLED, the URL must use the https:// prefix. (Required) | The URL of the HRA server that you want to add to the trusted server group. To add multiple URLs, reuse the same server group name.
<processingorder> | Any integer less than or equal to the total number of trusted server groups. Cannot be zero (0). (Optional) | The processing priority you wish to assign to this trusted server group.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure Trusted Server Groups for NAP Clients

Command-line syntax notation


Delete a Trusted Server Group

Deleting a trusted server group

  • Using the Windows interface

  • Using a command line

To delete a trusted server group by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, right-click the name of your trusted server group, and then click Delete.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To delete a trusted server group by using the command prompt

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client delete trustedservergroup name = <name>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<name> | Any text string. (Required) | The name of the trusted server group that you are deleting.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure Trusted Server Groups for NAP Clients

Command-line syntax notation


Add an HRA Server to a Trusted Server Group

Adding an HRA server to a trusted server group

  • Using the Windows interface

  • Using a command line

To add an HRA server to a trusted server group by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the trusted server group properties dialog box, type the URL of a trusted server that you want to add, and then click Add.

  5. Click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To add an HRA server to a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client add server group = <group> url = <url> processingorder = <processingorder>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are modifying.
<url> | Any valid URL, UNC path, or IP address. (Required) | The HRA server that you want to add to the trusted server group.
<processingorder> | Any integer. Cannot be zero (0). (Optional) | The processing priority you wish to assign to this HRA server.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure Trusted Server Groups for NAP Clients

Command-line syntax notation


Remove an HRA Server from a Trusted Server Group

Removing an HRA server from a trusted server group

  • Using the Windows interface

  • Using a command line

To remove an HRA server from a trusted server group by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the trusted server group properties dialog box, click the URL of a trusted server that you want to remove, and then click Remove.

  5. Click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To remove an HRA server from a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client delete server group = <group> url = <url>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are changing.
<url> | Any text string. (Required) | The URL of the HRA server that you want to remove from the trusted server group.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure Trusted Server Groups for NAP Clients

Command-line syntax notation


Change the Name of a Trusted Server Group

Changing the name of a trusted server group

  • Using the Windows interface

  • Using a command line

To change the name of a trusted server group by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, right-click the name of your trusted server group, and then click Rename.

  4. Type the name of the trusted server group, and then press ENTER.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To change the name of a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client rename trustedservergroup name = <name> newname = <newname>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<name> | Any text string. (Required) | The name of the trusted server group that you are changing.
<newname> | Any text string. (Required) | The new name of the trusted server group.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure Trusted Server Groups for NAP Clients

Command-line syntax notation


Change the Order of the HRA Servers in a Trusted Server Group

Changing the order of the HRA servers in a trusted server group

  • Using the Windows interface

  • Using a command line

To change the order of the HRA servers in a trusted server group by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the trusted server group properties dialog box, click the URL of a trusted server that you want to move up or down in the list, and then click Move Up or Move Down.

  5. Click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To change the order of the HRA servers in a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client set server group = <group> url = <url> processingorder = <processingorder>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are modifying.
<url> | Any valid URL, UNC path, or IP address. (Required) | The URL of the HRA server that you want to move up or down in the trusted server group.
<processingorder> | Any integer. Cannot be zero (0). (Required) | The processing priority you wish to assign to this HRA server.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure Trusted Server Groups for NAP Clients

Command-line syntax notation


Change the URL of an HRA Server in a Trusted Server Group

Changing the URL of an HRA server in a trusted server group

  • Using the Windows interface

  • Using a command line

To change the URL of an HRA server in a trusted server group by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, double-click Health Registration Settings, and then click Trusted Server Groups.

  3. In the middle pane, double-click the name of your trusted server group.

  4. In the trusted server group properties dialog box, click the URL of a trusted server that you want to change, and then click Edit.

  5. In the Edit URL dialog box, type the URL of the trusted server, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To change the URL of an HRA server in a trusted server group by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. Type: netsh nap client rename server group = <group> url = <url> newurl = <newurl>

The following table provides a guideline for the placeholder text in the Netsh command.

Placeholder | Possible Values | Description
<group> | Any text string. (Required) | The name of the trusted server group that you are modifying.
<url> | Any text string. (Required) | The URL of the HRA server that you want to change.
<newurl> | Any text string. (Required) | The new URL of the HRA server.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure Trusted Server Groups for NAP Clients

Command-line syntax notation


Configure NAP Tracing

You can use the NAP Client Configuration snap-in to configure Network Access Protection (NAP) tracing. Tracing records NAP events in a log file and is useful for troubleshooting and maintenance. You can also use tracing logs to evaluate the health and security of your network. You can configure three levels of tracing: Basic, Advanced, and Debug.

By default, NAP tracing is disabled, which means that no NAP events are recorded in the NAP tracing log files.

When to perform this task

You should enable NAP tracing when:

  • You are troubleshooting NAP problems.

  • You want to evaluate the overall health and security of the computers in your organization.

To complete this task, perform the following procedures:

Enable and Disable NAP Tracing

Specify Level of Detail in the NAP Trace Log

Additional references

NAP Client Configuration

NAP Client Configuration Checklist


Enable and Disable NAP Tracing

Enabling and disabling NAP tracing

  • Using the Windows interface

  • Using a command line

To enable or disable NAP tracing by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, right-click NAP Client Configuration(Local Computer), and click Properties.

  3. In the NAP Client Configuration(Local Computer) Properties dialog box, choose Enabled or Disabled.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To enable or disable NAP tracing by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. To enable or disable NAP tracing, do one of the following:

    1. To enable NAP tracing, type: netsh nap client set tracing state = enable

    2. To disable NAP tracing, type: netsh nap client set tracing state = disable

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure NAP Tracing


Specify Level of Detail in the NAP Trace Log

Specifying the detail that is recorded in the NAP trace log

  • Using the Windows interface

  • Using a command line

To specify the detail that is recorded in the NAP trace log by using the Windows interface

  1. To open the NAP client configuration console, click Start, click All Programs, click Accessories, click Run, type NAPCLCFG.MSC, and click OK.

  2. In the console tree, right-click NAP Client Configuration(Local Computer), and click Properties.

  3. In the NAP Client Configuration(Local Computer) Properties dialog box, confirm that Enabled is chosen.

  4. Under Specify the level of detail at which the tracing logs are written, select Basic, Advanced, or Debug.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

To specify the detail that is recorded in the NAP trace log by using a command line

  1. To open a command prompt, click Start, click All Programs, click Accessories, and click Command Prompt.

  2. To configure NAP tracing, do one of the following:

    1. To configure NAP tracing so that basic information is recorded, type: netsh nap client set tracing state = enable level = basic

    2. To configure NAP tracing so that advanced information is recorded, type: netsh nap client set tracing state = enable level = advanced

    3. To configure NAP tracing so that debug information is recorded, type: netsh nap client set tracing state = enable level = verbose

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Additional references

Configure NAP Tracing


Command-line syntax notation

The following table describes the notation used to indicate command-line syntax.

Notation | Description
Text without brackets or braces | Items you must type as shown
<Text inside angle brackets> | Placeholder for which you must supply a value
[Text inside square brackets] | Optional items
{Text inside braces} | Set of required items; choose one
Vertical bar (|) | Separator for mutually exclusive items; choose one
Ellipsis (…) | Items that can be repeated