Copyright: Internet Authentication Services Help © 1997 Microsoft Corporation.  All rights reserved.  Other product and company names mentioned herein may be the trademarks of their respective owners.
Citation: Internet Authentication Services Help © 1997 Microsoft Corporation.  All rights reserved.  Other product and company names mentioned herein may be the trademarks of their respective owners.


Provides a space for you to type the maximum number of concurrent authentications that can occur. Typically, this should be set to 10 for light usage and up to 63 for very heavy usage.


Provides a space for you to type the UDP port on which the server will listen for authentication requests. The standard setting for authentication is 1645. However the most recent Request For Comment (RFC) specifies port 1812. If you are unsure, consult your Network Access Server documentation or network provider for the correct port.


Provides a space for you to type the UDP port on which the server will listen for accounting packets. By convention, this port is set to 1646. However the most recent Request For Comment (RFC) specifies port 1813. If you are unsure, consult your Network Access Server documentation or network provider for the correct port.


Specifies whether malformed packets are saved to the Windows NT event log for debugging purposes.


Specifies whether authentication packets are saved to the Windows NT event log for debugging purposes.


Specifies whether all accounting packets are logged to the Windows NT event log for debugging purposes.


Specifies whether RADIUS accounting messages will be saved in log files at this server.


Specifies whether new accounting files will be opened automatically based on the current date or size of the existing file.


Specifies that a new accounting file is opened daily.


Specifies that a new accounting file is opened weekly.


Specifies that new accounting file is opened monthly.


Specifies that a new accounting file is opened when the file reaches a given size (in megabytes).


Provides a space for you to type the maximum size, in megabytes, that an accounting log file can reach before opening a new file.


Provides a space for you to type the directory path where the log file is stored.


Click this to select the directory where the log file is stored.


Specifies the drive letter where log files are stored.


Specifies the directory where you want to store log files.


Displays the list of clients that can send messages to this server.


Click this to add a new client.


Click this to delete the currently selected client.


Click this to change information about the currently selected client.


Specifies that an IP address is used to identify a client that will be sending authentication and accounting requests.


Provides a space for you to type the IP address of a client that is sending authentication and accounting requests.


Specifies that a DNS-style host name is used to identify a client.


Provides a space for you to type the host DNS name used to verify the source of authentication and accounting requests.


Provides a space for you to type the shared secret that will be used to authenticate the connection between the NAS client and this IAS RADIUS server.


Displays a list of RADIUS profiles that can be sent to terminal servers based on either the user or realm.


Click this to add a RADIUS profile.


Click this to delete a RADIUS profile.


Click this to edit the currently selected RADIUS profile.


Provides a space for you to type the name of the profile.


Displays a list of RADIUS attributes that can be added to the current profile.


Click this to add the currently selected attribute to the current profile.


Click this to remove the currently selected attribute and value from the profile.


Displays the attributes that are associated with the current profile.


Click this to move the selected item up in the list.


Click this to move the selected item down in the list.


Provides a space for you to type the name of the RADIUS attribute that you are including in the profile.


Provides a space for you to type the data that is sent for this attribute.


Select the vendor identifier that will be sent for a vendor-specific attribute. If you are not sure of the vendor ID, consult your Network Access Server documentation.


Provides a space for you to type the attribute type assigned by your vendor. Your Network Access Server assigns attribute types for each vendor-specific attribute that the server supports.


Lists the formats that are available for vendor-specific attributes. Consult your Network Access Server Vendor documentation to determine the format that your equipment expects.


Displays a list of realms you are using for authentication. Realms are used to identify groups of users by assigning a prefix or suffix to their user names. The prefix or suffix is used to authenticate users.


Click this to add a new realm.


Click this to delete the currently selected realm.


Click this to edit the currently selected realm.


Click this to edit the file of users that are stored on this server. The users file contains a list of authenticated users.


Click this to configure the authentication provider that will be used when no realm or local user matches the user name sent to the server.


Provides a space for you to type the name of the realm.


Specifies that the realm is identified by characters in the beginning of the user name, such as BYTECORP/user_name.


Specifies that the realm is identified by characters at the end of the user name, such as someone@microsoft.com.


Provides a space for you to type the identifier used to route requests to the realm authenticator. Include the prefix or suffix separator (for example, / or @) as part of the identifier.


Specifies whether the realm identifier (prefix or suffix) is removed from the user name before authentication and accounting requests are forwarded. For example, if you strip the Realm from someone@microsoft.com, the authenticating server will look up only "someone". If you do not strip realm names, the full name (for example someone@microsoft.com) must be in your authenticating database.


Specifies that accounting requests are not forwarded to the authenticating server. It does not affect logging at this server.


Specifies that accounting packets are not sent anywhere. Accounting records are captured in the accounting log of IAS but will not be sent to the next server in the authentication sequence.


Specifies that the authenticating server does not support RADIUS accounting packets, but does support older LOGOUT packets.


Specifies the local database or remote RADIUS server that can authenticate requests for this realm.


Specifies the RADIUS profile that will be sent to users in this realm.


Displays a list of users that are stored and authenticated on this server.


Click this to add a local user.


Click this to delete the currently selected user.


Click this to edit the currently selected user.


Provides a space for you to type the name of the current user.


Provides a space for you to type the password that the user must use to be authenticated. This password is used for both CHAP and PAP authentication.


Provides a space for you to retype the user’s password to make sure that no typographical errors were made while typing it.


Specifies the RADIUS profile to use for anyone authenticated by the default authentication provider.


Specifies whether the default authentication provider is disabled. If the default provider is disabled, authentication requests that do not match either a realm or local user will be silently discarded.


Lists the authentication databases containing user authentication information.


Click this to configure the currently selected authentication database. Not all database providers support further configuration.


Lists the server groups that are currently available to receive forwarded RADIUS messages. A server group may consist of several physical servers.


Click this to add a new RADIUS server group.


Click this to delete the currently selected RADIUS server group. When you delete the group, all servers within the group will be deleted.


Click this to change the configuration of servers in this server group.


Provides a space for you to type the label you use when attaching this authentication database to either a realm or the default authenticator.


Displays the database type. The database type is always ODBC.


Click this to configure the database provider.


Provides a space for you to type the label that will be used when attaching this server group to either a realm or default authentication.


Displays the servers included in the current RADIUS server group.


Click this to add a server to the current group.


Click this to remove a server from the current group.


Click this to change the configuration of the currently selected RADIUS server.


Specifies that an IP address is used to identify the RADIUS server.


Provides a space for you to type the IP address of the RADIUS server.


Specifies that a DNS-style host name is used to identify the RADIUS server. If the server cannot resolve this name, it will not start.


Provides a space for you to type the DNS name for the RADIUS server you wish to proxy to.


Provides a space for you to type the password (referred to as a shared secret in the RFC) that will be used to encrypt data between this server and the RADIUS server to which you are forwarding messages.


Provides a space for you to type the UDP port to use when forwarding authentication requests to this RADIUS server. By convention, this port is 1645 although the most recent RFC's specify a standard port of 1812.


Provides a space for you to type the UDP port that will be used when forwarding accounting requests to this RADIUS server. By convention, this port is 1646 although the most recent RFC's specify a standard port of 1813.


The Service tab configures the service that performs RADIUS authentication. Whenever you apply changes, you will have to stop and re-start the service for the changes to take effect.

Help is available for each item on this tab. Click [image] at the top of the window, and then click the specific item you want information about.


The Logging tab sets logging for the authentication server. Logging captures RADIUS accounting data to disk. You can specify how often to create new logs and in which directory to put the log files.

Help is available for each item on this tab. Click [image] at the top of the window, and then click the specific item you want information about.


The Clients tab enables you to configure the service to accept authentication and accounting requests from other RADIUS devices. You must explicitly name the servers that can send requests to this service, and passwords (shared secrets) must match exactly for authentication to take place. Some network access servers enable you to configure authentication and accounting passwords separately. This server assumes that the passwords used for authentication and accounting are the same.

Help is available for each item on this tab. Click [image] at the top of the window, and then click the specific item you want information about.


The Profiles tab enables you to create re-usable collections of RADIUS attributes that may be applied to either local users (users defined at this server), Realms, or for the Authentication Provider that is configured as the default.

Help is available for each item on this tab. Click [image] at the top of the window, and then click the specific item you want information about.


The User Authentication tab enables you to determine how authentication will be performed on this server. All authentication requests will be checked first against the realms configured here, and then the local users file. If they do not match user names in these two, they will be authenticated by the default authentication provider. You may configure either realms, local users, or a default authenticator but you must specify at least one for authentication to take place.

Help is available for each item on this tab. Click [image] at the top of the window, and then click the specific item you want information about.


The Authentication Providers tab defines the methods that can be used to authenticate users. Authentication providers may be databases or remote RADIUS servers

Help is available for each item on this tab. Click [image] at the top of the window, and then click the specific item you want information about.


Click this to save changes and close this set of properties. Your changes will not be effective until you click OK on the main window to exit the application, and then stop and restart the authentication service.


Click this to close this set of properties without saving any changes. To close the application without saving any changes you made during this session, click Cancel in the main window to exit the application.


Click this to apply changes to the configuration database. These changes will not be effective until you stop and restart the authentication service.


Click this for online Help about using this set of properties.


Click this to close this set of properties without saving any changes.


Click this to save changes and close this set of properties. Your changes will not be effective until you stop and restart the Internet Authentication Service.


Click this to move the selected item up in the list so that it will be sent to the Network Access Servers sooner. Network Access Servers process items in the order that they are received and their behavior may change depending upon the order in which they are sent.


Click this to move the selected item down in the list so that is will be sent to the Network Access Servers later. Network Access Servers process items in the order that they are received and their behavior may change depending upon the order in which they are sent.


Click this if you will be editing the attribute value in hexadecimal format.


Click this if you want this attribute formatted in accordance with the RADIUS RFC (RFC 2138). For more information on the Radius RFC, see the website for the Internet Engineering Task Force (IETF) Web site at http://www.ietf.org.


Provides a space in which to type the name of the server on which the MCIS Membership database is located.


Provides a space in which to type the name of the MCIS database.


Provides a space in which to type the user name that you will use to log onto the server containing the MCIS database.


Provides a space in which to type the password that you will use to log onto the server containing the MCIS database.