Event 6273 with reason code 269 — "The client and server cannot communicate, because they do not possess a common algorithm." This is Schannel's classic message for a TLS negotiation with no overlap: the client and the NPS server could not agree on a TLS protocol version or cipher suite for the EAP-TLS/PEAP tunnel.
Reason code 269
NPS 6273 reason 269: client and server possess no common algorithm
What it means
Common causes
TLS protocol hardening on the NPS server (or via baseline GPOs) disabled versions the clients still use, or vice versa.
Cipher suite order policies that removed suites required by older clients or the certificate's key type.
Very old supplicants (embedded devices, printers) that only speak retired TLS versions.
How to fix it
Inventory both sides: check Schannel protocol settings on the NPS server (registry under
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocolsor the deployed security baseline) against what failing clients support.Check the System event log on the NPS server for Schannel events at the same timestamps — they name the negotiation failure precisely.
For legacy devices that cannot be upgraded, decide deliberately: isolate them on a separate SSID/policy rather than weakening TLS for the whole estate.