Event 6273 with reason code 23 — "An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors." This is NPS saying the EAP conversation blew up rather than being cleanly rejected — a bucket for TLS handshake failures, certificate loading problems and protocol errors.
Reason code 23
NPS 6273 reason 23: unexpected EAP error
What it means
Common causes
NPS server certificate problems: expired, missing private key, or unreadable by the NPS service.
TLS handshake failures mid-EAP (client disconnects, protocol version problems, fragmentation issues on the wireless side).
A malformed or truncated EAP conversation caused by NAS/controller issues (retransmits, RADIUS packet size/fragmentation with large certificate chains).
How to fix it
Check the computer certificate NPS uses: valid dates, Server Authentication EKU, private key present, and selected in the policy's EAP settings.
Enable Schannel/EAP diagnostics or capture with
netsh ras set tracing * enabled(logs under %windir%\tracing) to see where the handshake stops.If failures correlate with large certificate chains, check for RADIUS fragmentation problems between NAS and NPS (UDP fragments dropped by firewalls) — allow fragments or shorten the chain.
Test with a known-good client close to the NPS server to separate infrastructure problems from client problems.