The NAP Agent service collects and manages health information on the client computer. NAP Agent also processes SoHs from all installed SHAs and reports client health to enforcement clients. NAP Agent must be operational to enable client computers to request or receive health certificates.

To verify the NAP Agent service is started

1. Click Start, click Control Panel, click System and Maintenance, click Administrative Tools, and then double-click Services.

2. In the list of services, under Name, double-click Network Access Protection Agent.

3. Verify that the Service status is Started, and Startup type is set to Automatic.

4. If the service is not started, choose Automatic next to Startup type, and then click Start.

5. Click OK to close the Network Access Protection Properties dialog box.

6. Close the Services console.

	Note
	Restarting the NAP Agent service will automatically reinitialize SHAs and the computer will attempt to acquire a new health certificate. This can be useful when troubleshooting NAP.

The NAP IPsec enforcement client must be installed and enabled on client computers. The NAP enforcement client requests access to a network, and communicates a client computer's health status to other components of the NAP client architecture. The NAP IPsec enforcement client restricts access to IPsec-protected networks by interacting with the certificate store on a client computer.

To verify the NAP IPsec enforcement client is initialized

1. Click Start, point to All Programs, click Accessories, and then click Command Prompt.

2. At the command prompt, type netsh nap client show state, and press ENTER. This command displays the NAP status of the client computer.

3. In the command output, under Enforcement client state, verify that the IPsec Relying Party status is Initialized = Yes.

You do not need to modify the default request policy settings on NAP client computers. If these settings are changed, then it is important to verify that similar settings are enabled on your NAP servers. By default, a NAP-capable client computer initiates a negotiation process with a NAP server by using a mutually acceptable default security mechanism for encrypting communication. We recommend that you use the default request policy settings.

To view request policy settings

1. Click Start, point to All Programs, click Accessories, and then click Command Prompt.

2. If Group Policy is used to deploy NAP client settings, at the command prompt, type netsh nap client show group, and then press ENTER. If local policy is used to deploy NAP client settings, at the command prompt, type netsh nap client show config, and then press ENTER. These commands display the Group Policy and local policy NAP configuration settings on client computers.

3. In the command output, verify that the Cryptographic service provider (CSP) and Hash algorithm settings correspond to the settings configured on HRA. The default cryptographic service provider is Microsoft RSA SChannel Cryptographic Provider, keylength = 2048. The default hash algorithm is sha1RSA (1.3.14.3.2.29).

Trusted server groups are configured within client health registration settings so that NAP client computers can contact Web sites that are used by HRA to process health certificate requests. If trusted server groups are not configured or are configured incorrectly, NAP client computers will fail to acquire health certificates.

To verify the configuration of trusted server groups

1. Click Start, point to All Programs, click Accessories, and then click Command Prompt.

2. If Group Policy is used to deploy NAP client settings, at the command prompt, type netsh nap client show group, and then press ENTER. If local policy is used to deploy NAP client settings, at the command prompt, type netsh nap client show config, and then press ENTER. These commands display the Group Policy and local policy NAP configuration settings on client computers.

3. In the command output, under Trusted server group configuration, verify that the configuration is correct for entries next to Processing order, Group, Require Https, and URL.

	Note
	A NAP client computer will attempt to obtain a health certificate from the first URL in all configured trusted server groups unless that server has been marked as unavailable. For more information, see Verify IIS Configuration and Understanding HRA Authentication Requirements.