Microsoft Always-On VPN - Manually Install?

[CHiLL]

I've got a couple of users that had been remoting in via our Microsoft Always-On VPN, which is deployed out as an Application (Powershell script) via SCCM. However they've stopped working and the only way I've managed to fix this in the past, is to have the laptop in the office, logged on as the user and reinstall the application from Software Center. However I cannot use Software Center on a laptop that is not connected to the domain, because it errors during launch, saying it can't be loaded (same error message as if the SMSAgentHost service hasn't started yet).

 

The command that the SCCM application uses is:

Powershell.exe -ExecutionPolicy Bypass -File "VPN_Profile.ps1" -xmlfilepath "VPN_Profile.xml" -ProfileName "Always-On VPN"

 

I have connected to the user's computer remotely and I can't use Software Center to reinstall it, so have looked to replicate that the PowerShell script does using the files copied from ccmcache and a PowerShell window. I can locate the files in ccmcache and copy them out to another location. If I use PowerShell in the user's context and cd to that location and run the following command:

.\VPN_Profile.ps1 -xmlfilepath .\VPN_Profile.xml -ProfileName "Always-On VPN"

I get the following message:

Unable to remove existing outdated instance(s) of Always-On VPN profile: Access is denied.

If I run the same command as an elevated PowerShell instance, I get the following result:

User SID is S-1-5-21-.


AlwaysOn                :
ByPassForLocal          :
DnsSuffix               :
EdpModeId               :
InstanceID              : Always-On%20VPN
LockDown                :
ParentID                : ./Vendor/MSFT/VPNv2
ProfileXML              :
RememberCredentials     :
TrustedNetworkDetection :
PSComputerName          :

Created Always-On VPN profile.
Script Complete

However no VPN appears in the list of network connections (as it would normally do when installed via SCCM) and nothing appears in the VPN settings applet.

 

I don't understand why SCCM and PowerShell are having different results, executing the same command.

 

How can I reinstall the VPN for a user in a remote location?

Edited April 22, 2020 by CHiLL

[PyROm]

As your adding the vpn to the users profile, doing it in an elevated command prompt will install it for administrator.

 

Have a look at https://www.google.com/amp/s/directaccess.richardhicks.com/2018/03/12/deleting-an-always-on-vpn-device-tunnel/amp/ to delete existing connection before readding it.

 

As another thought, if you use certificates to authenticate do you all vpn users have access to your certificate server when at home (ie. Over vpn) so it can auto renew? If not it could be an expired certificate.

[PyROm]

as another thought, if your adding it to the machine rather then the user, you need to run the script as service. Grab psexec from sysinternals and prefix your command to run your script with psexec -i -s

[CHiLL]

As your adding the vpn to the users profile, doing it in an elevated command prompt will install it for administrator.

 

Have a look at https://www.google.com/amp/s/directaccess.richardhicks.com/2018/03/12/deleting-an-always-on-vpn-device-tunnel/amp/ to delete existing connection before readding it.

 

As another thought, if you use certificates to authenticate do you all vpn users have access to your certificate server when at home (ie. Over vpn) so it can auto renew? If not it could be an expired certificate.

 

as another thought, if your adding it to the machine rather then the user, you need to run the script as service. Grab psexec from sysinternals and prefix your command to run your script with psexec -i -s

It is using certificate authentication and the CA is on one of our DCs, so all clients have access to it, even when connected via the VPN. When I checked an affeceted user's installed certificates, the VPN certificate was missing completely. If it had expired, I would have expected to see it there but show as expired. I wasn't expecting for it to be missing completely.

 

Is there a way that I can generate that user's certificate, transfer it to their machine and install it for them?

[PyROm]

Ive seen it before where user certificates just disappear. Normally I would tell them to bring their laptop into school and reboot it/login so that it grabs new certificate. Obviously this isnt really ideal at the moment.

 

If the dc with the CA as a valid fqdn you can make external.... you could update you domains external dns to contain your dc (so somputers on the internet can find it) and allow access to incoming traffic to your dc's certificate services, that way the laptop should be able to grab a new certificate. I dont know how secure this method is, but being a ca I would hope ms made it secure, of course oncevthe laptop had certificate you could close the firewall again.

[CHiLL]

I have a post on Reddit too and one of the suggestions was to copy %AppData%\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk from a working machine to the affected machine. This worked in the sense that the VPN connection appeared again, however it wouldn't connect because it complained about not having the certificate.

 

I'm not particularly comfortable exposing the DC to the Internet.

 

We have remote access to staff laptops, even if they're at home and not connected to the domain (Cisco Meraki's free Systems Manager software). So I can perform some testing.

 

My idea at the moment:

1) User at home logs on as the local account on the laptop (not a domain account)

2) User connects to our RDS (when connected to RDS, as they're logging onto a domain machine, with their AD account - the certificate is installed by GPO)

3) Export the personal certificate and save it to the user's OneDrive (or elsewhere)

4) User disconnects from RDS, logs off the laptop and logs back on as their domain account

5) User downloads the certificate and imports/installs it

6) Copy rasphone.pbk to the user's appdata

7) See if it works

 

I'm not sure what specific steps I need to take to export/import the certificate correctly.

 

Edit: I have checked the certificate validity and the certificate issued is valid for 1 year.

Edited April 27, 2020 by CHiLL

[PyROm]

Assuming that the user has access to certificates manager on both their domain account and local laptop account, and the certificate is marked as exportable on the CA, run certmgr.msc, find the certificate under personal->Certificates, right click, all tasks, export... follow the wizard.

 

To import, just double click the file and follow the wizard.

 

This is assuming that you are using Always on VPN in user mode and not machine tunnels.

 

If the end user can do all this, then I see no reason why they couldn't also add their own personal IT kit to your VPN, might be something to watch out for.

[CHiLL]

As an update to this thread, I've managed to be able to install the VPN for remote users, who can't use Software Center.

 

1. Use PSExec to run the Powershell script that SCCM installs as the SYSTEM account
   
2. Copy a known working/configured rasphone.pbk to the user's %appdata% location
   
3. (While the user is logged onto their remote device as their cached domain account) Log the user into our RDS server, access their user certificate and export it. Upload it to their OneDrive and download it onto their remote machine. Then import the certificate into their domain account on the remote device.
   

Steps 1) and 2) I have scripted but 3) has to be done manually.

 

Assuming that the user has access to certificates manager on both their domain account and local laptop account, and the certificate is marked as exportable on the CA, run certmgr.msc, find the certificate under personal->Certificates, right click, all tasks, export... follow the wizard.

 

To import, just double click the file and follow the wizard.

 

This is assuming that you are using Always on VPN in user mode and not machine tunnels.

 

If the end user can do all this, then I see no reason why they couldn't also add their own personal IT kit to your VPN, might be something to watch out for.

If I export a certificate from RDS as user Domain\User1 and install that on a local/non-domain account on their laptop, would that still be valid? Or does the certificate need to match the account using it? Also the VPN IKEv2 is configured to specify our domain CA server, so I assume that the remote device also requires a machine certificate to be installed from our CA in the Trusted Root CAs. I hope that means that user's can't use the VPN on non-domain machines.