Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Win7 laptop with OpenVPN installed. The normal user is an unprivileged user without knowledge of the administrator password.

When running as an administrator, everything works fine with setting up the OpenVPN tunnel, but I cannot get a regular unprivileged user to perform the final stage (adding default route in setting up the tunnel without UAC asking for the administrator password.

By online searches I've found two possible ways:

  • Set up the OpenVPN client as a service
  • Start the OpenVPN GUI as a "scheduled task"

Both of these ways seems to have their own set of problems, so I wonder if there is no way to get the unprivileged user to get the rights to perform "add route" using the OpenVPN client without knowing and entering the admininstrator password?

share|improve this question
add comment

4 Answers

You may want to try using the OpenVPN MI GUI:

http://openvpn-mi-gui.inside-security.de/

share|improve this answer
add comment

You wont' be able to some how grant the Regular User or Power User to be able to ADD \ DELEE a route. There is a yet another workaround that worked for me. The problem with OpenVPN is that you have to have the Certificates imported for current user. So, if you Run As Admin, OpenVPN will attemp to read certificates not from current user's but from Admin's profile.

The workaround is to:

  1. Import all necessary certificates for Admin's profile;
  2. Run As Admin OpenVPN GUI;
  3. ENTER the admin password in this point;
  4. OpenVPN will read all certificates data from Admin's profile and successfylly connect with ROUTE ADD successfull comletion.

No, you have to enter the admin password to use this, but only once the GUI app launches.

So, may be the option to set up the OpenVPN client as a service and run from NETWORK SERVICE Account is the best choice.

share|improve this answer
add comment

This definitely solves that problem, but it is a bit flaky http://sourceforge.net/projects/securepoint/

share|improve this answer
add comment

NOT TESTED: Add a permanent default route via the tunnel with higher priority then the normal one. When the tunnel interface is up, this route will be used. When the tunnel is down, the normal one will be used.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.