Network Policy and Access Services Overview

Applies To: Windows Server 2012 R2, Windows Server 2012

This topic provides an overview of Network Policy and Access Services in Windows Server® 2012, including the specific role services of Network Policy Server (NPS), Health Registration Authority (HRA), and Host Credential Authorization Protocol (HCAP). Use the Network Policy and Access Services server role to deploy and configure Network Access Protection (NAP), secure wired and wireless access points, and RADIUS servers and proxies.

Did you mean…

• NAP Client Configuration Overview

• Network Policy and Access Services Overview for Windows Server 2008 R2

Role description

Network Policy and Access Services provides the following network connectivity solutions:

New and changed functionality

The following table lists the primary differences in the Network Policy and Access Services server role by operating system:

Support for Windows PowerShell

You can now use Windows PowerShell to automate the installation of the Network Policy and Access Services server role. You can also deploy and configure some aspects of Network Policy Server by using Windows PowerShell. For more information, see Windows PowerShell for Network Policy and Access Services.

Removed functionality

In Windows Server® 2008 R2 and Windows Server® 2008, Network Policy and Access Services included the Routing and Remote Access Service (RRAS) role service. In Windows Server 2012, RRAS is now a role service in the Remote Access server role.

Deprecated functionality

With the release of Windows Server 2012 R2, NAP is deprecated. NAP is fully supported in Windows Server 2012 R2 and Windows 8.1. For more information about support lifecycles, see Microsoft Support Lifecycle.

For the health policy creation, enforcement, and remediation features provided by NAP, as well as for monitoring, consider using System Center Configuration Manager to replace and enhance NAP’s monitoring functionality:

• Windows Update status—System Center Configuration Manager integrates with Windows Server Update Services (WSUS) and has its own software updates feature. See Software Updates in Configuration Manager, in particular Monitor software updates.

• Windows Firewall settings—System Center Endpoint Protection can be used to manage Windows Firewall, see Endpoint Protection in Configuration Manager, in particular How to Create and Deploy Windows Firewall Policies for Endpoint Protection in Configuration Manager.

• Computer settings: registry settings, files, custom scripts—System Center Configuration Manager can help assess, track, and remediate the configuration compliance of client computers in the enterprise, see Compliance Settings in Configuration Manager.

• Reporting—System Center Configuration Manager also provides a set of tools and resources that help you use the advanced reporting capabilities of Microsoft SQL Server Reporting Services in the Configuration Manager console. See Reporting in Configuration Manager.

• Bitlocker—Microsoft BitLocker Administration and Monitoring (MBAM) lets you manage Bitlocker drive encryption throughout your enterprise, see Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide.

• Managing mobile devices. See How to Manage Mobile Devices by Using Configuration Manager and Windows Intune and How to Manage Mobile Devices by Using Configuration Manager and Exchange.

To provide an always managed and always compliant experience for remote devices, you can use Remote Access, see Manage DirectAccess Clients Remotely. This way you can ensure the clients are always healthy, not only when they try to access resources in the corporate network.

NAP enables you to provide full internal network access to your users. However, if you only require the ability to provide access to specific applications and services in your internal network, you can use Web Application Proxy. Web Application Proxy enables you to provide this type of specific access to end users with domain-joined laptops or using their own devices; home computers, tablets, or personal smartphones. See Web Application Proxy Walkthrough Guide.

Server Manager information

The following role services can be installed with this role.

Running Network Policy and Access Services

How do I deploy and configure Network Policy and Access Services using Windows PowerShell?

You can use to deploy and configure some aspects of Network Policy and Access Services. For more information about Windows PowerShell® cmdlets and scripts that you can use to deploy and manage Network Policy and Access Services, see Windows PowerShell for Network Policy and Access Services.

How do I deploy and configure this role in a multi-server environment?

You can deploy NPS servers for different functions. For example, you can deploy one NPS server as a RADIUS server for authentication, another as a RADIUS proxy, in order to distribute policy evaluation between servers with different roles, and another as a NAP policy server. For more information about multi-server management of Network Policy and Access Services, see Network Policy Server Overview.

Can I run this role on virtual machines?

Yes, you can run Network Policy and Access Services on Hyper-V virtual machines.

Can I run this role in a clustered environment?

No, Network Policy and Access Services cannot be run in a server cluster.

Special considerations for managing this role remotely

You can manage Network Policy and Access Services remotely. For more information about running Network Policy and Access Services from a remote computer, see Administer NPS by Using Tools.

Special considerations for managing the role on the Server Core installation option

You cannot install or run Network Policy and Access Services on the Server Core installation option of Windows Server 2012.

See also

The following table provides links to more content about Network Policy and Access Services.