Always on VPN deployment

[CAWJames]

Afternoon all,

 

Just finished a mammoth setup of AOVPN, and have everything in place with user certificates deploying and a working template. The only problem is that the generated script on the template PC, once added to a package on the SCCM server, does not work when deployed, but does when ran manually.

 

Does anyone else use AOVPN deployed by SCCM? I am trying to send to normal users, non-admin, package deploys, says succeeded but nothing actually shows up on the PC.

 

Really can't believe they have made it this hard to deploy! Even the generated PS script can only be run on a user who has admin rights, not a normal user.

 

Yes, MS, I give all my user admin rights on their computers....

 

There must be a way to easily deploy this! I thought, great we do have SCCM, so we are sorted, boy was I wrong!

 

Any input appreciated

 

Thanks

 

James

[FishCustard]

You can use PowerShell to do it (this is fast becoming my catchphrase...). Well, PowerShell and a scheduled task.

 

I'll do a proper write-up on it, but you create a scheduled task to run as the SYSTEM user when any user logs on that runs the PowerShell script. That way it runs in the background with full rights (and can't interact with the interactive user's environment).

 

Then you have a startup script for laptops that creates that scheduled task so it's a zero-touch system. Just build, boot, get the user to log on in school, and they're good to go. I put the relevant files on each local machine so that if for whatever reason the connection gets deleted, it can be re-instated at the next logon without needing domain connectivity.

Edited May 29, 2019 by FishCustard

[CAWJames]

Thanks for that, I read about scheduled tasks way of doing things in a blog post somewhere on that there google.

 

Are yours User tunnels or device tunnels?

 

Thanks again,

 

James

[FishCustard]

User tunnels - device tunnels don't seem reliable enough yet. I'll put a post together about how it all works and link it here sometime this week.