Migrating NPS is generally a very straigh forward process – just a couple of PowerShell commands and change the RADIUS IP address of connecting devices (APs and switches)…

 

On the NPS server being decommissioned / replaced, open an elevated PowerShell session and execute:

Export-NpsConfiguration -Path <filename>

An example would be:

Export-NpsConfiguration -Path "C:\Temp\NPS-Export.xml"

NOTE: Exports and the subsequent imports CAN fail if the backup is saved in any format other than .xml

Copy the file to the new NPS server

On the new server, launch Server Manager, click Add roles and features, and in Server Roles, add Network Policy and Access Services

Now launch an elevated PowerShell session on the new NPS server, and import the copied config file:

Import-NpsConfiguration -Path <filename>

Example:

Import-NpsConfiguration -Path "C:\Temp\NPS-Export.xml"

On the new NPS server, launch the Network Policy Server servelette from Administrative Tools

We first need to Authorise the new NPS server in Active Directory, in the NPS window, right-click the NPS (local) in the top left of the tree and in the context menu, select Register server in Active Directory

Now right-click again, Stop the NPS service, wait 30 seconds, right-click again and Start the NPS service

Check & compare the configuration between the old and new servers to ensure NPS looks like its all the same

Check Remote RADIUS Server for RADIUS servers and server groups

Add in the new server, ideally, using the same RADIUS password if you know what it is (if not known, and using UniFi – get it from the controller – see further down).

Check through all the active Connection Request Polices for Authentication servers in the Settings tab of each policy – what you’re looking to check is that each policy is set to authenticate to the new server or to the server group that the new server is a member of:

Now we need to ensure Windows Firewall will allow incoming requests to the NPS

Create a new Inbound rule and select Predefined > Network Policy Server

Check all the boxes:

Final page: Allow the connection and click Finish

 

Finally, now you can go through to all network devices using the NPS and update the server / IP to point to the new host.

In the case of the UniFi controller, click the Settings gear > Profiles > RADIUS

Click the EDIT link next to the Radius profile

Change the IP address for both authentication and accounting where applicable

Hint: you can click the  icon next to the password fields to reveal the password / shared secret in case this is required in earlier steps when adding in the new server to NPS.

Done!

 

 

More information can be found here: https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-export