Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm sorry if I ask in the wrong forum. I'm not sure it is actually a networking problem, but I haven't found a proper forum for my question so far.

I setup a vpn connection for a pc in a store to the office. It works fine. The problem is : the user that need the vpn connection is not administrator, so when she login using her account ( standar user ) and dial/connect the vpn connection, a dialog windows appear asking for administrative password. Of course I don't want to tell her the password. Any suggestion on how to let the user connect using vpn?

I don't know whether it will help, but here are some of the properties for the vpn connection : data encryption : optional allowed protocols : CHAP & MS-CHAP v2 type of vpn : L2TP IPSec VPN

Thank You in Advance

Chung Yie

share|improve this question
2  
Wait, why does connecting the VPN require administrative rights? I'm not sure that's how it's supposed to work. –  HopelessN00b Dec 21 '12 at 3:20
    
@HopelessN00b To alter the routing tables, admin privs are required. –  fukawi2 Dec 21 '12 at 4:43
    
@fukawi2 Yeah, I suppose... never the way I've seen a VPN set up, in a Windows corporate environment, though. –  HopelessN00b Dec 21 '12 at 4:50
    
@HopelessN00b That's just in my experience. I'm not aware of another way. –  fukawi2 Dec 21 '12 at 8:46
add comment

2 Answers 2

The user needs to be a member of the "Network Administrators" local group on the client.

share|improve this answer
    
Thank You for the reply.Is there any other way? Because the store manager is concern about her staff installing games and other software. She insisted on keep the user account as standard user. –  wong chung yie Dec 21 '12 at 5:38
    
Am I understand your explanation correctly? If I was wrong, could you explain a litte bit further? I'm a programmer, actually, not really a networking guy :) –  wong chung yie Dec 21 '12 at 5:58
1  
IME, as I commented above, in order to alter the routing table, the user needs permission to be able to do that. So you need to either let the user do that, or find a way to let just that process have permission to. IME, it's easiest to just make the user a member of the Network Admin group. Make sure it's on the Local group though, not a domain group. –  fukawi2 Dec 21 '12 at 8:46
    
Thank You for sharing. I just keep this question open for some time, in case someone knows how to 'let just that process have permission to'. :) God bless –  wong chung yie Dec 21 '12 at 9:29
    
On my install of Windows 7, the group is called Network Configuration Operators, not Network Administrators. Either way, this is the best way to solve your problem. It gives the user the ability to change RouteTables, Create or enable Network Connections (this happens when connecting to the VPN) etc. It does NOT make them a local Admin, so the Store Manager should not be concerned. Here is Microsoft's description of the group: support.microsoft.com/kb/297938 –  BillN Dec 21 '12 at 17:03
show 1 more comment

This is a little outside my experience, as I'm not used to having a VPN set up in such a manner, but if you use GPOs, or change the "local" group policy settings of the machine, (with Group Policy Management Editor) you can allow normal users to do things to the network connections they otherwise wouldn't be able to do.

It should be under User Configuration --> Policies --> Administrative Templates --> Network --> Network Connections

Below is a screenshot of what I see, and what I have configured. You may have to experiment a little bit because I'm not sure precisely what settings you'd need to enable and disable, but you should be able to get what you want done with the settings in there.

"Remote access connections" would be your VPN connections, but if the VPN adds routes or changes other network connections properties, you'll need to set those policies as well.

GP Network Connections

share|improve this answer
    
Thank You for the reply. I'll try it too as soon as I can contact the people in the store, and come back with the result. God Bless :) –  wong chung yie Dec 27 '12 at 1:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.