Always-On VPN - Strange Connection Issues

[CHiLL]

This is a bit of weird one, so please bear with me while I try to explain it!

 

I've had Always-On VPN deployed for many months now in a testing phase, with about a 10 staff using it and it's been fine for most of that time. I came to configure it for a new member member of staff and noticed an issue where it won't let the user log in from home, though I've not heard of any issues from staff that are currently using it. The error that was shown on the login screen stated:

We can't sign you in with credential because your domain isn't available. Make sure your device is connected to your organisation's network and try again. If you previously signed in on this device with another, you can sigh in with that credential.

 

The VPN is supposed to (and has done in the past) automatically establish a connection to our VPN server and then authenticate the login when the device can contact the DCs through the VPN. However this isn't happening and it's throwing that error. I've checked my VPN configuration, VPN profile (configured and deployed by SCCM) and firewall rules...and they're all the same as when I configured them and it worked.

 

Now onto the strange part. We have a backup line provided by VM that we can access from our office (and therefore is not associated to our domain/network in any way). When I join a laptop to this Wi-Fi and attempt to log onto the device using a VPN configured user, the VPN fails to connect with the above message. However, if I join it back to our school wireless and log onto our domain with said user - and then switch to the backup line's Wi-Fi once it's logged on...the VPN notices the switch and automatically connects the VPN service and it works! Accessing the file shares, SIMS, etc all work when it's connected this way. That proves that the actual technology/configuration of the VPN service is working.

 

So the issue appears to be that the VPN is not establishing when the user attempts to log on, when it should do. I've tested this on both a Windows 10 Education 1709 x64 laptop and another Windows 10 Education 1903 x64 laptop - both provide the same results.

 

This is where I am at a loss, because no configuration has changed.

 

Edit 1: I've just been informed that our Head appears to have been connected to the VPN from home on Saturday, as she reported one of the desktop icons is incorrect and needs amending. We do create a local account on devices that allow staff to use the laptops at home, however the icon she was talking about only appears on our staff redirected desktop on our domain. That suggests she was connected to the VPN.

 

Edit 2: I sent an email out to those staff who test this VPN, asking whether they've had issues with it. One replied with that they tried it last night and it wouldn't work for them and had the same error message.

Edited July 16, 2019 by CHiLL

[mikkydoos]

Try this... works for me with Win10 VPN isssues...

 

 

https://www.petenetlive.com/KB/Article/0001402

[CHiLL]

Try this... works for me with Win10 VPN isssues...

 

 

https://www.petenetlive.com/KB/Article/0001402

Thank you very much. That appears to fix this issue. I had actually seen that article before, though not acted on it because the VPN was just working without that extra configuration. Though it does seem strange that all of our clients have developed this metric bug at the same time.

 

I will add this info to my configuration document, to hopefully avoid this again in the future.

 

I wonder if it's possible to automate this as a part of my configuration steps for the VPN, or script it and deploy it alongside the VPN profile?

[mikkydoos]

Its not technically a bug. More the way Win10 handles multiple interfaces.... badly.

 

I discovered issues after upgrading to 10 from 7. Never had an issue with 7. 10 would work sometimes on some machines, always on others, never on the rest. Not good.

 

I've got that config built into my fat win10 images. Look for a GPO to set the network settings.

Edited July 16, 2019 by mikkydoos