Event ID 18 (NPS)

NPS Event 18: invalid Message-Authenticator attribute

Last reviewed 2026-07-18 by the Just Software engineering team · also seen as nps event 18, message-authenticator attribute that is not valid

What it means

Event ID 18 from the NPS source — "An Access-Request message was received from RADIUS client x with a Message-Authenticator attribute that is not valid." The Message-Authenticator is an HMAC keyed with the shared secret; when validation fails, the secret on the NAS and the secret in the NPS RADIUS client entry do not match, and NPS drops the request. Clients experience timeouts rather than rejections.

Common causes

  1. Shared secret mismatch between the NAS and the NPS RADIUS client entry — by far the most common.

  2. The request matched the wrong RADIUS client entry (overlapping address ranges or NAT), so the wrong secret was used for validation.

  3. Middleboxes altering the packet between NAS and NPS.

How to fix it

  1. Re-enter the shared secret on both the NAS and in NPS console > RADIUS Clients > (client) — do not try to eyeball-compare secrets.

  2. Confirm which RADIUS client entry the source IP matches when entries use address ranges; make entries as specific as possible.

  3. Note that Message-Authenticator enforcement matters for security (RADIUS spoofing mitigations) — keep it required rather than disabling validation on the NAS.

An unhandled error has occurred. Reload 🗙