SCCM - VPN Profile

[CHiLL]

I have created a VPN profile within SCCM's compliance, which is fine. I can deploy it to user collections and the test user will see the VPN. However, when deploying to the machine collection, the test machine doesn't receive it. Ideally I'd like it so that all staff laptops receive the VPN connection, so when they take their laptops off-site, then can connect to the VPN from the login screen and then they can log in with their domain credentials, instead of a local account on the laptop (if that is actually possible).

 

Otherwise, if I have the VPN connection pushed to a collection containing DomainUser1...and they are off site using the account LocalUser1...how are they going to connect to the VPN from home? I'm assuming that the user would need to log on as DomainUser1, but they cannot as they aren't on the domain?

[Geoff]

What version of Windows is the client running?

[CHiLL]

What version of Windows is the client running?

Windows 10 Education 1709 x64.

[Geoff]

Ok. You still need to deploy the VPN profile the users rather than the machines in that case, you just don't need to bother deploying the client msi.

 

I assume these non-domain machines are SCCM managed?

[CHiLL]

Ok. You still need to deploy the VPN profile the users rather than the machines in that case, you just don't need to bother deploying the client msi.

 

I assume these non-domain machines are SCCM managed?

They are domain-joined machines, just with local accounts created on them for use off-site. They are also SCCM managed.

[Geoff]

You will have to create a user collection with all the local users listed (in the form of machinename\username) and deploy your VPN settings to that collection.

 

An alternative to this messiness is to use Always On VPN.

 

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy-overview

[CHiLL]

You will have to create a user collection with all the local users listed (in the form of machinename\username) and deploy your VPN settings to that collection.

 

An alternative to this messiness is to use Always On VPN.

 

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy-overview

It is Always-On VPN that I am testing. I configured it all, following Microsoft's documentation and now it's a case of pushing those settings to the clients. This can be done using SCCM's compliance settings according to Microsoft, which is what prompted me to create this thread.

[Geoff]

That's not going to work unless they login with a domain account as a local account has no access to the domain.

[CHiLL]

That's not going to work unless they login with a domain account as a local account has no access to the domain.

That's why I'm stuck - how do I get the laptop to connect to our VPN from home, using Always-On VPN?

[Geoff]

You should of provisioned it before it left site. We do it in our SCCM OSD build process.

[CHiLL]

You should of provisioned it before it left site. We do it in our SCCM OSD build process.

Can you clarify that? I don't know what you mean by provisioned it.

 

We deploy the TS which installs/configures Windows and software, which is what I understand of provisioning.

Edited December 22, 2017 by CHiLL

[Geoff]

As part of our OSD procedure first line follows the technician tests the laptop by logging in as the user who will be getting it. This obviously applies all the settings including the VPN profile.

[CHiLL]

As part of our OSD procedure first line follows the technician tests the laptop by logging in as the user who will be getting it. This obviously applies all the settings including the VPN profile.

That would be fine - except we have a (tempremental) GPO that prevents users from logging on with domain credentials when the domain is not present. So I could log the laptop on with their account before handing them the laptop - however it wouldn't work for other accounts on that laptop.

[Geoff]

I don't see how you can support mobile working properly with that GPO setting.

[free780]

i can see why you have that GPO. Particularly if you expire passwords in domain accounts. Telling users they have 1 password to login to the laptop which will change when reconnected back to your network is confusing. Either you setup direct access which is a VPN over https so when your offste you have access to everything you would din your network. Though you do need a PKI setup. Or you have laptops non domain joined and managed through intune etc.

[unexus]

Usually Windows caches the profile of the last user who logged on so that user can still login even if they are off the domain. Do you have a GPO that prevents profile caching ?