Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to deploy a VPN settings to 100+ plus users. There must be a better way than doing it manually. I’ve had a look at CMAK but that doesn’t have the option of having a preset username and password already inserted. The all VPN users use the same username and password (not my decision) It’s a full Windows Environment. I'm using Routing and remote access for VPN. How can I do this?

share|improve this question
1  
So it's not really a VPN, then. It's more of just an "VN", w/o the "P". –  Evan Anderson Oct 28 '10 at 15:16
    
@Evan LOL, but let's think about this. What's the P in VPN really about. It's about connecting 2 "private" networks over a "public" network. i.e. A contractor VPN'ing into a client's network over the internet. The credentials are largely irrelevant to the definition of private. –  JamesBarnett Dec 30 '10 at 7:46
2  
Wow - shared credentials between 100+ people. Perhaps you should just publish them on the internet before someone else does... –  dunxd Dec 30 '10 at 11:11
1  
Fight management tooth and nail - Your hired to ensure this sh*t doesn't happen, (shared credentials, security risk etc) - Or at the very least, get them to accept responsibility in writing. It'll make them think twice. If I was you, I would publish a guide on how to connect to the VPN for the three main OS, and use their windows credentials. –  Mister IT Guru Jan 10 '11 at 10:06

3 Answers 3

In general you will find that the OS does not support not so smart decisions and in general totally insecure settings. As such, support for:

but that doesn’t have the option of having a preset username and password already inserted. The all VPN users use the same username and password

Is not given. If I were such an employee, I would make my employer sign me a waiver for all consequences that may come from them thinking it is me - or jsut not use the VPN.

share|improve this answer
    
agreed. It is a stupid thing to do. but its gotta be done. –  Jake Oct 28 '10 at 13:31
1  
If they were doing certificate only authentication and using one cert, it would be the same thing. The attack surface here is essentially the same as physical access to a network jack on site. I'm assuming it being a windows environment access to all network resources is authenticated with AD credentials. But then again I know what they say about sys admin's who assume things, so I don't know exactly how stupid a thing they are attempting to do. –  JamesBarnett Dec 30 '10 at 7:47

It depends on your VPN client.

I know that with the cisco VPN client you can cache the credentials in the vpn profile (pcf file) then copy the file to another computer.

I think you can do a similar thing with the builtin vpn client in windows XP, that config file is C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk. Not sure if the password is in that file. I might be stored hashed in the registry.

Again, without knowing more about your VPN setup...

share|improve this answer

Maybe I am totally missing something here or misunderstand your need but..
Even though you said you don't want to use CMAK Why can’t you create the single user login you want to use with it and then simply deploy that? I am not saying you CAN, do this.

I am in the middle of trying to figure out how to do the same thing only unlike you, I want to create a single pbk with NO user login and password and then deploy that on each system as each user does have a different username and password. I just want those to be saved when they use it the first time as the default.
It took me a while to figure out what kind of "white lies" to feed Cmak on a windows 7x64 system to create a default.pbk But.. I finally did. I also read early on that this can be used to deploy to other systems. But.. That was hours ago and hundreds of web-searches. I am working on trying to look back to the beginning now that I found the end. :(

If anyone knows the answer here, please post it. I think you have to copy the one CMAK makes over the hidden pbk file located in the "usersname\AppData\Roaming\Microsoft\Network\Connections\Pbk_hiddenPbk" folder

I Think!

But there is another location that it has to go as well. (Again, memory fails me. sigh) And i decided to go all for broke and get the script to create the 4 mapped network drives each user has to access all at the same time. CMAK does allow you to call post-connection scripts but.. I have no idea how to use CMAK. Never saw it before an hour ago. mapping the drives is a snap with net use but..

Seems there should be an easier way to do this. Maybe a scripted Mouse-thru? It isn’t that hard to do but gets tedious after a few hundred I agree. I hope someone doesn't now tell me that what I am doing can't be done anyway :(

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.