[1709, fcu] Always-On VPN - H: Drive not mapping

[CHiLL]

So after a while of testing, I've finally got Always-On VPN to work. Connecting my testing laptop to a home Wi-Fi and logging on with the domain user allows me to access other mapped drives, such as our staff share. However, our home folder mapping and folder redirection for Documents, Pictures, etc aren't working.

 

We are mapping our home folder via the user's Active Directory account Properties > Profile > Home folder > Connect H: to \\\staffhome$\%username%.

A user policy fairly high up in the AD structure redirects the user's Documents, Pictures, Downloads, etc to the same path defined above.

 

After looking at the event logs - there's only one related entry in the Application log:

Warning - Event ID 510 - Folder Redirection - The folder redirection policy hasn't been applied. It's been delayed until the next sign-in because the group policy sign-in optimisation is in effect.

I have disabled sign-in optimisation for this laptop, but it doesn't fix the issues.

 

When I checked the System logs, I saw a whole bunch of stuff, mainly related to DNS issues. I have saved a custom event log with the selected events in, should anyone want me to send it to them. I'm presuming a lot of those are generated at system boot whilst the VPN is not established.

 

Edit: My gut thinking is that because the user's profile is cached on the laptop...the cached profile is attempting to apply the H:\ drive before the VPN has fully initialised. Though that doesn't explain why Documents, Pictures, etc aren't redirecting, because they're pointed to the FQDN, not the mapped drive.

Edited April 2, 2019 by CHiLL

[mikkydoos]

http://www.edugeek.net/forums/windows-10/205453-might-help-fix-windows-10-vpn-dns-issues-when-connecting-remotely.html

 

 

Posted this yesterday. Works well for me so far with similar issues.

Edited April 2, 2019 by mikkydoos

[FishCustard]

We've had this very occasionally - will try the interface metric fix.

[CHiLL]

http://www.edugeek.net/forums/windows-10/205453-might-help-fix-windows-10-vpn-dns-issues-when-connecting-remotely.html

 

 

Posted this yesterday. Works well for me so far with similar issues.

Cheers. I did see that, but that looks like for those that are having complete issues with DNS. Mine is working - mostly. I can access most DNS stuff via FQDN (including the home folder itself). It's just not mapping, whereas the others are.

 

Just as a test, I applied those settings anyway, but unfortunately it yielded the same results.

[mikkydoos]

I'd say that you would need the DC available for that to map if set from AD properties. Does it connect when on site?

 

I would try setting the drive with a GPO instead and set it to persist.

 

Or a batch file with --> NET USE H: /persist:yes

[FishCustard]

Cheers. I did see that, but that looks like for those that are having complete issues with DNS. Mine is working - mostly. I can access most DNS stuff via FQDN (including the home folder itself). It's just not mapping, whereas the others are.

 

Just as a test, I applied those settings anyway, but unfortunately it yielded the same results.

As a short-term fix, I'd recommend a script on peoples' desktops that re-maps the home drive (if it's causing real problems). I'd be interested to know what the root-cause fix might be...

[CHiLL]

I'd say that you would need the DC available for that to map if set from AD properties. Does it connect when on site?

 

I would try setting the drive with a GPO instead and set it to persist.

 

Or a batch file with --> NET USE H: /persist:yes

It connects without issue every time on-site. It is an issue only when connecting through the VPN.

 

I have just tested applying a GPP to map the H: drive...and it worked! (Though with an approximate 60 second delay AFTER they get to their desktop, so about 90 seconds after they press login) Now...why is this working, but the AD property mapping isn't?

[BKGarry]

Maybe it is worth enabling offline files for your home drive.

 

That way it is synchronised offline, it will be mapped, even without a network connection, and when it makes the network connection, it will go online?

 

Just a suggestion, it may solved your issue.

[CHiLL]

Maybe it is worth enabling offline files for your home drive.

 

That way it is synchronised offline, it will be mapped, even without a network connection, and when it makes the network connection, it will go online?

 

Just a suggestion, it may solved your issue.

Unfortunately I don't have the disk space on our laptops for that. We replaced the HDDs in our staff laptops with 120GB SSDs last year to increase performance and improve BitLocker encryption times.

[mikkydoos]

It connects without issue every time on-site. It is an issue only when connecting through the VPN.

 

I have just tested applying a GPP to map the H: drive...and it worked! (Though with an approximate 60 second delay AFTER they get to their desktop, so about 90 seconds after they press login) Now...why is this working, but the AD property mapping isn't?

 

 

Because the DC most likely needs to be available tell the machine to map the drive each time the user logs in.

 

A home folder connection musn't be persistent whereas folder redirection is.

 

EDIT: Shouldn't be any delay. Do a gpupdate or you may have DNS issues there.

 

EDIT2: Now to the metric value change on your wifi and TAP adapters. That may remove the delay. Sounds like it can't resolve.

Edited April 2, 2019 by mikkydoos

[BKGarry]

Yeah, something is weird here, it is as if you are actually logging in before the VPN has fully connected, or something like that, so maps all the other drives after it has connected.

[bald_pig]

Sounds like asynchronous gpo processing to me.

[bald_pig]

Administrative Templates\System\Logon. -> Always wait for the network at computer startup and logon

[mikkydoos]

Administrative Templates\System\Logon. -> Always wait for the network at computer startup and logon

 

 

That may cause the machine to sit for a while before it gets to the login screen. Its offsite waiting for a VPN. There is no network.

 

 

EDIT:

 

@CHiLL ... You didn't say what OS this is ?

Edited April 2, 2019 by mikkydoos

[CHiLL]

Sounds like asynchronous gpo processing to me.

Is that the merge processing option?

 

Administrative Templates\System\Logon. -> Always wait for the network at computer startup and logon

Would't that cause the laptop to hang before displaying the login screen? Or is that something else?

 

That may cause the machine to sit for a while before it gets to the login screen. Its offsite waiting for a VPN. There is no network.

 

EDIT:

 

@CHiLL ... You didn't say what OS this is ?

Ah, thanks for clarifying that. I thought I'd pressed the option for the OS when I created the thread. Maybe not. The client is Windows 10 Education 1709 x64 and the server is 2019.

[bald_pig]

It will, but if the laptop logs on before it has the network connection it isn't mapping the drive, at least that's the theory anyway!

[mikkydoos]

Actually @bald_pig you may have a point there. That GP turns off asynchronous doesn't it if I remember rightly.

[bald_pig]

Actually @bald_pig you may have a point there. That GP turns off asynchronous doesn't it if I remember rightly.

 

Yup, I didn't explain very well and put it across 2 posts, sorry.

[Dianalv]

If you are interested in stable connection you can try some service, as it connects without issue every time on-site. And it is not an issue when connecting through the VeePN. In my opinion that is a good decision that can solve a lot of problems.