VPN Triggers

-
Ok, so I realize this post won't apply to most people, but I want to share this just in case it can save someone hours of digging for VPN PowerShell commands.   The other day I found myself with a strange request from a client, they wanted to push out a VPN connection profile from Intune, and enable it so that it always stays connected when the PC has an internet connection.  We the short version of the story is I have not done a full deployment of always on, the 2nd part of the story is they wanted to use the VPN connection as the primary network connection of the currently non-domain joined machines 200+.  To make a long story short I wasn't able to get the simple certificate services to enroll intune joined user certificates to connect to the internal PKI infrastructure as it failed to autoenroll with a very detailed error.  "NO DATA".  So welcome to plan B.

B-Plan was a simple L2TP connection using the same RAS, NPS server.  One a profile was built and tested there were a couple tweaks we had to make to ensure that they could connect, join the domain, reboot and still have the option to connect to the VPN for 1st sign in.

The fun bit of this was to get the connection to always connect when on the internet to "protect" the users from themselves when not at work.  The solution is below.

#creates the connection
Add-VpnConnection -name "<MYDomain>VPN" -serverAddress "alwayson.<MYDomain>.com" -tunneltype "L2tp" -L2tpPsk "<MYPSK>" -dnsSuffix "<MYDomain>.com" -AuthenticationMethod Eap -force

 #Tells the connection to remember credentials
Get-VpnConnection "<MYDomain>VPN" | Set-VpnConnection -RememberCredential $true

 #Adds triggers when user starts applications (Can modify as desired)
Add-VpnConnectionTriggerApplication -ConnectionName "<MYDomain>VPN" -ApplicationID "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -force
Add-VpnConnectionTriggerApplication -ConnectionName "<MYDomain>VPN" -ApplicationID "C:\Program Files(x86)\internet explorer\iexplore.exe" -force
Add-VpnConnectionTriggerApplication -ConnectionName "<MYDomain>VPN" -ApplicationID "C:\Program Files\internet explorer\iexplore.exe" -force
Add-VpnConnectionTriggerApplication -ConnectionName "<MYDomain>VPN" -ApplicationID "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -force

 #Sets the connection to be available on the Ctrl-alt-delete screen
get-Vpnconnection -alluserconnection | set-vpnconnection -alluserconnection -force
The order is is specific.  You cannot add triggers to a VPN connection created with the -alluserconnection flag.  Make the changes 1st then convert it.

Comments

Post a Comment

Popular posts from this blog

Integrate Choco with SCCM

-
Image
Integrating Choco with SCCM Choco is well known and recently I've written on how to integrate choco with puppet as the control mechanism.  Today, I've explored how to do this with SCCM configuration manager.  This article assumes you have a working SCCM environment.  My lab environment was set up using Oracle's personal use virtual box and evaluation software provided by Microsoft's eval center and a Fedora host system.  (Let me know if you would like to know more about my setup) The reason I'm writing about this is to keep 3rd party software up to date leveraging choco packages as well as develop a standard deployment model for all software. High level steps: Create choco installer application in sccm. Create notepad++ installer and uninstaller applications in sccm. Upgrade notepad++ with supersedence Deploy non standard package (Comming soon) So to dig in, first we need to install choco on our SCCM clients.  In this test, I'm using SCCM appl
Read more

Windows 11 22H2 production setup!

-
Image
Windows 11 22H2 production setup! I recently started to deploy windows 11 and to my chagrin found many applications that didn't align to the business needs such as recommended apps, tiktok, instagram etc, as well as other apps like Microsoft Teams, and Onedrive.  So this is a short blog and shout out to the resources I found to help tame this beast Microsoft released. Customize the start menu for the default profile to remove suggested apps for all users Uninstall bloatware for all users Customized Start Menu Log in as an admin account and customize the start menu they way you would like. Windows 11 stores the customized configuration under the users profile folder: c:\users\%user%\appdata\local\packages\Microsoft.Windows.StartMenuExperienceHost_%randomized%\localstate\start2.bin Copy this start2.bin file to somewhere on the network.  Like the sysvol domain controller. I wrote the script below to account for the randomization as the folder path is unique per windows install, but co
Read more

Automate Server Patching with Puppet (Part 2)

-
Image
In the first blog post I made about this, I showed how to patch windows 3rd party software like, notpad++, windirstat and other software utilizing puppet and chocoloatey on windows.  However, the next part of the solution was to deploy windows patches as the name suggests.  This part of the equation was a bit more challenging, but well worth the effort. For help setting up puppet and chocolatey refer to the previous blog post .  When patching windows security patches, most of them are not on the chocolatey website ready to go, so I choose to build my own repository of patches using a internal NuGet server.  Getting NuGet up and running requires Visual Studio.  In my case I utilized the community edtion (Free).  During the install you have to pick which components you want to install.  See below: Once you get visual studio prepare, your ready to head over to the microsoft project site and build the package on your own IIS instance.  I wont go into much detail here, I didn'
Read more