Remote Access Always On VPN Deployment for Windows Server 2016 and Windows 10 Applies To: Windows Server 2016, Windows Server 2012 R2, Windows 10 Authors: James McIllece, Jerry Honeycutt and team Published: August 2017 Technical advisers: Philipp Kuhn, Jason Jones, Mihai Peicu, Aman Arneja, Lily Wang Abstract This is designed for network and system administrators who want to manage remote computers that connect automatically to the organization network with VPN whenever the user logs on to the device, changes networks, or simply turns on the display. This type of automatically connecting VPN is called an Always On VPN connection - because the VPN connection appears to be a persistent connection. This guide provides instructions on deploying Remote Access as a single tenant VPN RAS Gateway for point-to-site VPN connections that allow your remote employees to connect to your organization network with Always On VPN connections. This guide is also available on the Microsoft Windows Server 2016 Docs web site at .
easily insert the VPN profile configuration XML markup into the ProfileXML CSP node. This is the method you’ll use to configure the Remote Access Always On VPN client by using Intune. Windows Management Instrumentation (WMI)-to-CSP bridge. The second method of configuring the ProfileXML CSP node is to use the WMI-to-CSP bridge—a WMI class called MDM_VPNv2_01—that can access the VPNv2 CSP and therefore the ProfileXML node. When you create a new instance of that WMI class, WMI uses the CSP to create the VPN profile. This is the method you use to configure the Remote Access Always On VPN client by using Windows PowerShell and System Center Configuration Manager. Even though these configuration methods differ, both require a properly formatted XML VPN profile. To use the ProfileXML VPNv2 CSP setting, you construct XML by using the ProfileXML schema to configure the tags necessary for the simple deployment scenario. For more details, see . In the section “Infrastructure requirements,” Table 1 provided an overview of the individual settings for the VPN client. Below is each of those required settings and its corresponding ProfileXML tag. You configure each setting in a specific tag within the ProfileXML schema, and not all of them are found under the native profile. For additional tag placement, see the ProfileXML schema. Connection type: Native IKEv2 ProfileXML element: Copy <NativeProtocolType>IKEv2</NativeProtocolType> Routing: tunneling ProfileXML element: Copy <RoutingPolicyType>SplitTunnel</RoutingPolicyType> Name resolution: Domain Name Information List and DNS suffix ProfileXML elements:
b. Select the All Windows 10 (32-bit) and All Windows 10 (64-bit) check boxes. c. In Estimated disk space, type 1. d. In Maximum allowed run time (minutes), type 15. e. Click Next. On the Summary page, click Next. On the Completion page, click Close. With the package and program created, you need to deploy it to the VPN group. To deploy the ProfileXML configuration script In the Configuration Manager console, open Software Library\Application Management\Packages. In Packages, Windows 10 Always On VPN Profile. On the Programs tab, at the bottom of the details pane, right-click VPN Profile Script, click Properties, and complete the following steps: a. On the Advanced tab, in When this program is assigned to a computer, click Once for every user who logs on. b. Click OK. Right-click VPN Profile Script, and click Deploy to start the Deploy Software Wizard. On the General page, complete the following steps: a. Beside Collection, click Browse. b. In the Collection Types list (top left), click User Collections. c. VPN Users, and click OK. d. Click Next. On the Content page, complete the following steps: a. Click Add, and click Distribution Point.