Radius: on a DC or separate server?

[techie923]

Hello all,

 

Ok so I have an issuingCA setup and a DC each on their own vm, I installed Radius/NPS on a separate vm also. My question is, should the NPS be separate or running on the DC? Reason I'm asking is bc when I try to register the NPS to active directory is always fails with the 'no permissions ...dial-up error. Both servers see each other and I can see them via piing/nslookup and DNS records are correct so I'm thinking putting the NPS on the DC may eliminate this issue??

 

Just for some context...I'm setting up the Radius to have trusted devices authenticate but block unwanted student devices like cell phones/laptops etc.

 

Thanks,

[StephenPink]

always separate - however since Server 2019, Windows Firewall no longer automatically opens up ports 1812/1813 for RADIUS authentication/accounting when you install the NPS role. Check the firewall - will need to add rules to allow these

[Primus]

This is an odd one when it comes to MS guidance - they say they recommend the NPS role be installed on a DC for performance - we don't however as we split most server roles out to dedicated server VMs.

[3s-gtech]

Mine is on a DC. Due to the low system requirements I lumped it in like DNS and DHCP. It in-place upgrades fine too if you like to play that game.

[dhaughton99]

I had similar issues when I tried to keep NPS on a separate server. Moving it to the DC fixed the permission problems for me. It might be worth a shot in your case too.

[Jcx500]

Dc imo should only be a DC install on a separate box if you have the resources

[DrCheese]

Separate. Treat your servers like cattle, not kings. Have many that do one task & easy to rebuild instead of one all-consuming god-tier server that you dare not look at for fear of it breaking something - Or not being able to reboot to fix an issue with one role

 

Don't put roles on DCs that don't need to be on DCs. They are DCs

They should be replaceable/upgradable at a moment's notice without worrying about the 500 other services you have installed.

Edited February 23, 2025 by DrCheese

[Smokebomb]

There is a caveat to consider which could present an issue if you have multiple sites. If NPS is installed on a standalone server which is then registered with Active Directory, you cannot tell it which DC to use to authenticate requests. This has caused us problems in the past with radius authentication requests from devices at our primary site going to a remote site’s DC. As such, we install NPS on our DCs at each campus and configure our WiFi in such a way that specific NPS instances are used for auth/accounting at that site to localise the authentication.