Event 6273 with reason code 48 — "The connection request did not match any configured network policy." NPS walked its network policies top to bottom and none of them matched the request's conditions, so the default is to deny. Nothing failed cryptographically; the request simply fell through the policy list.
Reason code 48
NPS 6273 reason 48: no matching network policy
What it means
Common causes
Group condition mismatch — the user or computer is not in the security group the policy requires (machine auth checks the computer account's groups, a frequent surprise).
NAS Port Type condition does not match (e.g. policy requires Wireless while the switch sends Ethernet, or vice versa).
Policies are ordered so a more specific policy never gets evaluated, or the intended policy is disabled.
Domain/authentication source mismatch — the identity resolved but not into the expected groups (nested-group or cross-domain evaluation).
How to fix it
Read the 6273 event fields: Account Name, NAS Port Type and Network Policy Name (often '-' when nothing matched) show exactly what NPS evaluated.
Check the group in the policy condition contains the authenticating identity — for machine auth, add the computer account or a group like Domain Computers, not user groups.
Verify policy order and enabled state in NPS console > Policies > Network Policies; put more specific policies above general ones.
Recent group additions require a fresh Kerberos/identity evaluation — reboot the client or wait for group membership to be re-read; NPS reads groups at auth time from AD, so replication delays also apply.
Frequently asked
The user is in the right group — why still reason 48?
If the device authenticates as computer (machine auth), NPS checks the computer account's groups, not the user's. Also check NAS Port Type conditions and AD replication if the group change was recent.