Is it possible to automatically invoke group policies when manually connecting to a VPN in Windows?

Question

Our company has several laptop users (including myself) who log on to our VPN remotely, after logging in to a local domain profile on the laptop.

The problem with this, however, is that group policies and startup scripts are not automatically invoked when connecting to the VPN.

This results in loss of control and a possible added security risk (such as domain users being able to join without virus software installed).

Is there any solution to this problem? I have read about logging using a dial-up connection, but there are two downsides to this:

1. It seems to be unavailable on Windows Vista / 7 machines
2. It requires the laptop user to have an internet connection.
3. It still leaves the option open to connect manually.

Any help would be appreciated.

Note: we are using Windows Server 2008 (not R2)

Answer 1

As you mentioned startup scripts etc will only run at startup, by connecting to your DC after startup you miss this window of opportunity. Group policy will still be collected and applied at next startup.

This has in theory been solved using 2008 R2 & Win 7 using Direct Access. Essentially you get an 'automatic' VPN which the machine account initiates prior to user logon, hence allowing startup scripts etc to be applied.

My understanding is that you don't need to upgrade your domain you just need (at least) one 2008R2 server to terminate the Direct Access.

Answer 2

You only get group policy for machines that are part of your domain, but it sounds like you're using a domain-joined machine. The issue here is that when users connect with cached credentials, GPOs aren't updated when you rejoin the network.

One workaround is to have users select the "Log on using dial-up networking" checkbox when they log in; this will force the VPN connection, and GPO application, to happen at logon.

Another may be to shorten the default policy refresh interval, although this may cause other problems unless you put the laptops into a separate OU so you can apply separate policies to them.

See http://technet.microsoft.com/en-us/library/cc736905(WS.10).aspx.