Microsoft Always on VPN (Device Tunnel) Deployment

[KieranL]

Hi,

 

How have you got your Microsoft Always on VPN Device tunnel deployed?

 

I have have user tunnel working correctly already but I have looked online with deploying through GPO and it doesn't add anything.

 

I have currently have a computer GPO with a startup script which runs the below powershell script but I maybe missing something as it won't add anything. (We currently do not have SCCM setup)

 

$ProfileName = 'Always On VPN - Device'$ProfileXML = '  VPN Server NameIKEv2  CertificateSplitTunnel true      DC 1 IP Address32    DC 2 IP Address32    IP Range    true truetrue'$ProfileNameEscaped = $ProfileName -replace ' ', '%20'$ProfileXML = $ProfileXML -replace '<', '<'$ProfileXML = $ProfileXML -replace '>', '>'$ProfileXML = $ProfileXML -replace '"', '"'$nodeCSPURI = './Vendor/MSFT/VPNv2'$namespaceName = "root\cimv2\mdm\dmmap"$className = "MDM_VPNv2_01"$session = New-CimSessiontry {    $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName    $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key')    $newInstance.CimInstanceProperties.Add($property)    $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key')    $newInstance.CimInstanceProperties.Add($property)    $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property')    $newInstance.CimInstanceProperties.Add($property)    $session.CreateInstance($namespaceName, $newInstance)    $Message = "Created $ProfileName profile."    Write-Host "$Message"}catch [Exception] {    $Message = "Unable to create $ProfileName profile: $_"    Write-Host "$Message"    exit}$Message = "Complete."Write-Host "$Message"

Looking online I have seen bits about using PSexec but Sophos is blocking it and looking online there is conflicting advice if it should be allowed or not.

 

Thanks

Edited December 4, 2024 by KieranL

[DrCheese]

For group policy deployment, use this script and modify it to your needs. Then, set it as a startup script. It makes deploying AOVPN profiles over GPO a complete doddle.

 

https://github.com/Mr-Tbone/AoV

 

(His blog is here https://www.tbone.se/category/aov/)

 

You're seeing references to PSEXEC as to install Device AOVPN profiles it *has* to be done in SYSTEM context (You can't just use an admin account)

Startup scripts run as SYSTEM so you only need to do the PSEXEC thing if you are installing manually when logged on as a different user to bump yourself into the SYSTEM context by running

 

psexec -s "powershell.exe" - Which will then put you into a powershell prompt running as SYSTEM - Then you can install the device profile (or run the script above) manually.

[3s-gtech]

$ProfileName = 'AoVPN_device_profile'

$ProfileXML = '

vpn.newtown-hs.powys.sch.uk
IKEv2

Certificate


  SHA256128
  AES128
  AES128
  SHA256
  Group14
  PFS2048
 
SplitTunnel

true



172.x.x.x
24


172.x.x.x
24



true

true

true

newtown.sch.uk
'

$ProfileNameEscaped = $ProfileName -replace ' ', '%20'

$ProfileXML = $ProfileXML -replace '<', '<'
$ProfileXML = $ProfileXML -replace '>', '>'
$ProfileXML = $ProfileXML -replace '"', '"'

$nodeCSPURI = './Vendor/MSFT/VPNv2'
$namespaceName = "root\cimv2\mdm\dmmap"
$className = "MDM_VPNv2_01"

$session = New-CimSession

try {
   $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
   $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key')
   $newInstance.CimInstanceProperties.Add($property)
   $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key')
   $newInstance.CimInstanceProperties.Add($property)
   $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property')
   $newInstance.CimInstanceProperties.Add($property)

   $session.CreateInstance($namespaceName, $newInstance)
   $Message = "Created $ProfileName profile."
   Write-Host "$Message"
}
catch [Exception] {
   $Message = "Unable to create $ProfileName profile: $_"
   Write-Host "$Message"
   exit
}
$Message = "Complete."
Write-Host "$Message"

 

Ours. Run as a startup Powershell script directly. I updated this script for W11 - our W10 one didn't work on 11 but this works on both.

Note: change 172.x.x.x to your own subnet.

[KieranL]

Do you put any Script Parameters? I tried using that with changing the bits to my config but it didn't add anything. Ill have another go