My current network is a mix of XP and Windows 7 machines with a Server 2008 primary domain controller. As it stands now, when we have new laptops come in we need to manually add in two RDP links and a VPN link. Desktops do not get these links.

I'm looking for a way to automate both of these steps. On the RDP links the user will log in with their existing windows username and password. On the VPN (L2TP with a pre-shared key) the user has a seperate password, but still uses the windows username.

In my ideal world both of these items (RDP & VPN) can be set up through group policy on our laptop machines with minimal input from me. If I have to go in and set the password on each VPN connection that's fine, but if there was somewhere in group policy or the user profile I could input their VPN password ahead of time and that information gets rolled into the VPN link that gets created, that would be fantastic.

===== RDP

This is the closest I've come to a link about automating the RDP shortcut creation and it's really just link on creating an .rdp file from a RemoteApp program which I'm pretty sure I don't want: http://technet.microsoft.com/en-us/library/cc730673(WS.10).aspx#BKMK_CreateRDP

===== VPN

In the following link the author specifically states an L2TP VPN connection can be automated with a pre-shared key through the MS CMAK tool, but he doesn't get into specifics about how to set this up: http://cjwdev.wordpress.com/2011/05/19/automate-creation-of-an-l2tp-vpn-with-pre-shared-key-and-automatically-use-windows-credentials/

Here's a technet article about how to deploy VPN connections, but 1) I don't see a section where I can specify a pre-shared key and 2) I'm not sure if this can be a script because a lot of our laptop users aren't always connected to the network and certainly don't start up connected to the network.


This is seemingly a huge undertaking compounded by the fact I only know enough on server 2008 to make me dangerous and until this point, usually worked on general networking and Cisco issues.

Any help and/or input is appreciated.


Not sure what the problem is here, honestly. That article you linked about creating an RDP file may be exactly what you want. To create an RDP file, open mstsc.exe, configure your options as desired and Save As.... Then you simply need to deploy it to the user's desktop (or where ever) by GPO.

As to the VPN, maybe I'm missing something, but the site you linked to contains the script needed to deploy this kind of VPN setup automatically. Run the program, and input the three arguments it requires.

(And I was missing something...)

The setup you desire is not supported by MS. If you want an easy to automate solution using MS tools, you're restricted to what MS supports.

  • Maybe I'm not understanding it correctly, but the RDP article I linked the instructions talk about picking a program and creating an .rdp file for it. I don't want to do that. I have 2 existing rdp links so users can remote in that I want to deploy to my new laptop users. – Winski Tech Aug 21 '12 at 16:38
  • As far as VPN, the link that has the custom script in it is close to what I need, but not what I need, and I'm not very versed on .net . I need to add a different password in for VPN, not the windows default. – Winski Tech Aug 21 '12 at 16:40
  • @WinskiTech updated the RDP part. As to the VPN part... this isn't a "gimmie teh codez" site, so you're probably not going to get anyone to modify the script to meet your exact specifications, but you're an SA, so you should be able to do that without much difficulty... right? – HopelessN00b Aug 21 '12 at 16:48
  • The custom code section I was actually just using as a reference as the author said the CMAK could do L2TP deployment with a pre-shared key, but wouldn't let him set the username and pass on VPN to windows default. I don't want that. As far as that section goes I was going to see if there was an example of someone stepping through the CMAK process, with an L2TP VPN, and pre-shared key as googling has turned up no results. – Winski Tech Aug 21 '12 at 17:01
  • @WinskiTech Because it's not supported, and bad security practice, according to MS. support.microsoft.com/kb/240262 If you want an easy to automate solution using MS tools, you're restricted to what MS supports. – HopelessN00b Aug 21 '12 at 17:16

I can say there is no built-in way for Windows or CMAK to store a pre-shared key and deploy to the user. With built-in tools the closest you can get is using either CMAK to create the VPN install and then on first login you'll have to set the pre-shared (as you are now)... or using Group Policy Preferences to create a VPN profile (which I've done and works well). Note that a VPN profile is nothing but a text file in a users profile path somewhere. Use Procmon to watch for it's creation while you step through VPN creation wizard and you may find a way to edit it directly... but I bet the pre-shared is stored in registry in a protected location.

That link for CMAK has a guy creating a .net app so if you don't know how to run msbuild and edit code then I wouldn't recommend that solution.

Same with .rdp file. it's actually a text file you can open in notepad and bend to your will, and use Group Policy Preferences to copy the file to each users start menu or desktop.


If you use the *.exe generated by the CMAK, you can indeed distribute a pre-shared key for an L2TP VPN connection. I've done it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.