Event 6273 with reason code 65 — the connection attempt failed because the Network Access Permission setting on the account's Dial-in tab in Active Directory is set to Deny access. This per-account setting is evaluated on top of your network policies, and a legacy 'deny' there overrides an otherwise-matching allow policy.
Reason code 65
NPS 6273 reason 65: network access permission denied on the account
What it means
Common causes
The user or computer account has Deny access set on the Dial-in tab (sometimes inherited from old remote-access era standards or copied account templates).
Accounts are set to Allow/Deny explicitly instead of 'Control access through NPS Network Policy', creating per-account surprises.
How to fix it
In Active Directory Users and Computers, open the account > Dial-in tab and set Network Access Permission to 'Control access through NPS Network Policy' (recommended) or 'Allow access'.
Bulk-fix with PowerShell:
Set-ADUser <user> -Replace @{msNPAllowDialin=$true}to allow, or clear the attribute (-Clear msNPAllowDialin) to defer to NPS policy.Audit for stragglers: search AD for accounts where
msNPAllowDialinis explicitly false.