Event ID 18 from the NPS source — "An Access-Request message was received from RADIUS client x with a Message-Authenticator attribute that is not valid." The Message-Authenticator is an HMAC keyed with the shared secret; when validation fails, the secret on the NAS and the secret in the NPS RADIUS client entry do not match, and NPS drops the request. Clients experience timeouts rather than rejections.
Event ID 18 (NPS)
NPS Event 18: invalid Message-Authenticator attribute
What it means
Common causes
Shared secret mismatch between the NAS and the NPS RADIUS client entry — by far the most common.
The request matched the wrong RADIUS client entry (overlapping address ranges or NAT), so the wrong secret was used for validation.
Middleboxes altering the packet between NAS and NPS.
How to fix it
Re-enter the shared secret on both the NAS and in NPS console > RADIUS Clients > (client) — do not try to eyeball-compare secrets.
Confirm which RADIUS client entry the source IP matches when entries use address ranges; make entries as specific as possible.
Note that Message-Authenticator enforcement matters for security (RADIUS spoofing mitigations) — keep it required rather than disabling validation on the NAS.