VPN always on for borrowed laptops

[petben]

Hello, we want students to be able to take home domain joined laptops, and log into them like they do at school.

 

I have looked at Intune but I don't feel it is quite there yet and it would be another managment platform (rather than just AD, GPO etc). I think the easiest would be to get an always on VPN client. CISCO do 'VPN anywhere' software which we are getting prices for, but early indications are its not what we want and its going to be £££. Then Windows do an Always On VPN setup, but the process for that looks totally mental and reviews are bad.

 

Anyone use a VPN solution like this?

 

Thanks

[synaesthesia]

What about the one built into windows? It's not entirely difficult - https://4sysops.com/archives/always-on-vpn-directaccess-for-windows-10/

[Oaktech]

DirectAccess. All day long.

[Norphy]

DirectAccess. All day long.

 

That’s been deprecated. AlwaysOn VPN is the replacement and is an order of magnitude easier to set up.

[Oaktech]

I'm still a fan because it allows a greater degree of management from an already established domain.

[PyROm]

We use Microsoft always on vpn with the device tunnel setting for all our staff laptops, so the laptops account is authenticated rather than the user and it means it connects before the student logs in, which can be useful if a windows update randomly messes up a profile. It also means that the user doesn't have any control over it and it just tends to work.

 

Device tunnels mean the user cant add their details to another device and use that to connect in instead of the school laptop.

[mrbios]

We use Microsoft always on vpn with the device tunnel setting for all our staff laptops, so the laptops account is authenticated rather than the user and it means it connects before the student logs in, which can be useful if a windows update randomly messes up a profile. It also means that the user doesn't have any control over it and it just tends to work.

 

Device tunnels mean the user cant add their details to another device and use that to connect in instead of the school laptop.

 

Worth making note of the advantages and disadvantages for anyone looking to take this route, best practice is still to use the user tunnel as well:

https://directaccess.richardhicks.com/2020/04/06/always-on-vpn-device-tunnel-only-deployment-considerations/

 

Just thought i'd put that out there.

[synaesthesia]

Exactly this - the device tunnel enables pre-logon authentication - once the user is logged in, the user VPN kicks in and authenticates the user against the network. Plus this fixes little niggles like red crosses on drives in my computer.