The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →“Microsoft Network Access Control” is an umbrella term, not the name of one current Microsoft product. For network access, Microsoft’s main options in this area are Network Policy Server (NPS), a Windows Server RADIUS service, and Microsoft Intune integrations with third-party NAC products. The older Network Access Protection (NAP) platform is historical and is unavailable starting with Windows 10.
Which approach fits depends on whether you need a central RADIUS service to authenticate network connections, want a NAC product to use Intune device-compliance data, or are looking up the discontinued NAP feature.
As an Amazon Associate I earn from qualifying purchases.
What Microsoft means by network access control
Network access control (NAC) is a way to decide whether a device or user may connect to a network, and sometimes whether access should change based on device health or compliance. Microsoft’s documentation covers three distinct things that are easy to confuse:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- NPS: Windows Server’s RADIUS server and proxy. Network devices send authentication requests to it, and it applies configured policies.
- Intune-integrated NAC: Intune supplies enrollment and compliance information to a supported third-party NAC product, which makes or enforces the network-access decision.
- NAP: A legacy Windows platform for checking device health and applying network restrictions. It is not available starting with Windows 10.
These are not interchangeable products. NPS can provide RADIUS-based authentication and authorization; an Intune integration adds device-compliance information to a partner NAC workflow. An organization may use them in a broader design, but the documented roles and prerequisites differ.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
How Windows Server NPS and RADIUS work
NPS is Microsoft’s implementation of a RADIUS server and proxy. RADIUS provides authentication, authorization, and accounting for supported network connections, including wireless, VPN, dial-up, and authenticating-switch scenarios. In a typical arrangement, an access point, VPN server, or 802.1X-capable switch forwards a connection request to NPS. NPS checks the request against its configuration and returns an authorization result.
The RADIUS client in this arrangement is the network access server—such as the access point, switch, or VPN server—not the user’s laptop or phone. Microsoft’s NPS overview describes the server and proxy roles.
What an NPS deployment needs
- A Windows Server deployment and a defined domain or account context for the identities NPS will authenticate.
- Network access servers that support the connection and authentication methods you intend to use. For wired access, the switch must support 802.1X; wireless access points also need to support the required 802.1X and EAP methods.
- Each RADIUS client’s IP address and any required vendor-specific attributes, entered consistently in the network equipment and NPS.
- A matching shared secret configured on NPS and each RADIUS client.
- A choice of authentication method that the access equipment, client devices, and security requirements support.
- Redundancy planning. Microsoft recommends at least two NPS servers for fault tolerance in RADIUS-based authentication and accounting.
Microsoft’s NPS planning guidance covers RADIUS clients, authentication choices, and deployment planning. It applies to Windows Server 2016, 2019, 2022, and 2025 where the page lists those versions.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Choosing an authentication method
There is no universally suitable method; capabilities vary by network access server and client. Microsoft documents, among other choices, EAP-TLS and PEAP-MS-CHAP v2:
| Method | Credential and certificate needs | Operational consideration |
|---|---|---|
| EAP-TLS | Uses client and server certificates. | Requires an organizational public key infrastructure (PKI), which can be complex to deploy and operate. |
| PEAP-MS-CHAP v2 | Uses a server certificate with password-based user credentials. | Does not require deploying a PKI for client certificates. |
Confirm that the access equipment supports the selected EAP method and that its certificate requirements match your identity and security design. The NPS planning page discusses these methods and their prerequisites.
How NPS network policies are evaluated
NPS network policies are ordered rules. NPS evaluates them in order; when a request matches a policy’s conditions, NPS applies that policy’s settings. Conditions identify which requests a policy applies to, while constraints impose additional requirements. If a request matches the conditions but fails a constraint, NPS rejects it and does not continue to later policies. A policy placed too early, or a constraint that a valid user cannot satisfy, can therefore cause unexpected denials. See Microsoft’s network policy guidance.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
How Intune works with a third-party NAC product
In an Intune-integrated NAC design, Intune is the source of device enrollment and compliance information; the partner NAC product is the network decision and enforcement point. When a user attempts to connect through a supported path such as Wi-Fi or VPN, the NAC product can query device state and use it in its access decision. A compliant device may be granted access, while a device that is not enrolled or is noncompliant can be directed to enrollment or remediation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMicrosoft describes registering the NAC partner with Microsoft Entra ID, granting the required delegated permission to the Intune NAC API, and configuring partner-side settings and authentication. The exact setup depends on the product and version. Microsoft says the compliance retrieval service replaced the previous Intune NAC service and was released in July 2021.
Device identification and partner compatibility
For compliance retrieval, Microsoft recommends certificate-based authentication where possible. The documented approach uses the Intune device ID as a certificate subject alternative name. If certificate authentication cannot be used, the service supports lookup by MAC address. A NAC product upgrade may require integration changes, so check both Microsoft and the vendor’s current instructions before deployment.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Microsoft’s integration documentation lists examples including Cisco ISE 3.1 and later; Aruba ClearPass with Microsoft Intune Extension v6 and later; Forescout eyeExtend Microsoft Module v1.0.1 and later; Portnox Cloud; Fortinet FortiNAC 9.4.x and FortiNAC-F 7.x and later; and products from Extreme, Citrix, F5, and Ivanti. This is a documentation snapshot, not a guarantee of continuing support for every listed version. Verify current compatibility with Microsoft and the vendor.
Query throttling to account for
Microsoft says broad, unfiltered requests for all noncompliant devices may be throttled. The guidance advises NAC solutions to submit these queries no more than once every four hours; more frequent requests receive HTTP 503. This is a specific service-query consideration, not a universal limit on NAC checks.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →NPS and Intune-integrated NAC compared
| Decision point | NPS/RADIUS | Intune-integrated NAC |
|---|---|---|
| Where the access decision is made | NPS evaluates the RADIUS request and its network policies; the network access server enforces the result. | The partner NAC product uses Intune device state in its decision and enforces access on supported network paths. |
| Main inputs | Credentials or certificates, account properties, and NPS policy conditions and constraints. | Intune enrollment and compliance state, with device identification through the configured integration. |
| Prerequisites | Windows Server, supported RADIUS clients and authentication methods, shared secrets, and—depending on method—certificates or PKI. | Intune enrollment, supported partner product/version, partner registration and API permissions, plus configured authentication and device identification. |
| Operational focus | RADIUS client configuration, policy order, authentication compatibility, and NPS redundancy. | Partner-version support, certificate or MAC-based identification, and service query behavior. |
| Typical documented scope | Wireless, VPN, dial-up, and authenticating-switch connections through RADIUS clients. | Network paths supported by the partner integration, including Wi-Fi or VPN in Microsoft’s described flow. |
This comparison describes the roles in Microsoft’s documentation; it is not a ranking of NAC vendors or a claim that every product supports every network type.
What happened to Windows Network Access Protection?
Network Access Protection (NAP) was an older Windows platform that could validate device health, restrict network access, direct devices to remediation, and check ongoing compliance. Microsoft states: “The NAP platform is not available starting with Windows 10.” Its legacy overview documents client support for Windows XP SP3, Windows Vista, and Windows Server 2008. Treat NAP as historical; do not plan it as a Windows 10 or Windows 11 feature. See Microsoft’s legacy NAP overview.
Which approach should you choose?
- Choose NPS/RADIUS when your immediate requirement is centralized authentication and authorization for compatible switches, wireless access points, or VPN servers, and you can operate the required Windows Server and network configuration.
- Consider an Intune-integrated NAC product when network access decisions need to use Intune enrollment or compliance state and your NAC vendor supports the required integration and network path.
- Do not choose NAP for a new Windows 10 or Windows 11 deployment. It is a discontinued legacy platform, not the current Microsoft NAC offering.
For wired access using NPS, an 802.1X-managed switch is relevant only if wired authentication is part of the design. Check that the specific model supports 802.1X and RADIUS; buying a switch does not provide NPS or a complete NAC system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
