On windows 10, how do I setup a VPN client so that all users can use it (i.e. available before login)

Question

On Windows XP, 7, 8, 8.1 you could tick a box that says 'Allow other users to use this VPN' when you initially connected the VPN.

This option is no longer available - how do I set the VPN to be available for connection on the Login screen?

Answer 1

Old question but for anyone trying to find an answer there is a better solution via elevated powershell:

Add-VpnConnection -Name MY_VPN_NAME -ServerAddress MY_VPN_SERVER -AllUserConnection $true -SplitTunneling $true -AuthenticationMethod MSChapv2 -TunnelType Automatic -EncryptionLevel Required -PassThru

Source

Answer 2

CrayFishUK, my experience for all Windows XP/Vista/7/2008/8/2012/10 This will connect VPN as a SYSTEM user when system starts.

1. You will need to create a VPN connection
2. Save or not save credential it is not important.
3. Find a rasphone.pbk in %APPDATA%\Microsoft\Network\Connections\Pbk_hiddenPbk
4. More nice if you will copy it to C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk or attach to exist rasphone.pbk (it is text files)
5. Now you need to create scheduler task...

Scheduler task:

• Start after boot
• Program to start has credential to connect VPN

Code:

cmd /c rasdial VPNUSER VPNPASSWORD /PHONEBOOK:"C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk" && route add 10.0.0.0/8 172.16.0.254

• You will need change the creator user to the SYSTEM user

I have add at the end:

route add 10.0.0.0/8 172.16.0.254

for exampe, how to auto add route when sucsesful connect VPN

If you will need to reconnect VPN when it fails ask a new question and I will help.

By default VPN send all traffic through VPN, if you want to use routes You will need to turn off this future.

Answer 3

A VPN config is stored as text in rasphone.pbk. The all-user copy of rasphone.pbk is located in the "all users" profile: on win11 pro the default is

c:\users\all users\microsoft\network\connections\pbk\rasphone.pbk

There are many ways you can add to or modify a text file. You can copy rasphone.pbk from your admin profile. You can copy and append from a text file: You can use WMI (or any Web-Based Enterprise Management controller), or RAS.exe or powershell -- which is a shell for things like RAS and WMI.

EAP data is stored as a blob in the file (CustomAuthData) Credentials are stored separately: the GUID referenced in the config file is used as a key to HKEY_LOCAL_MACHINE\Security\Cache. If you use certificate, make sure that it is stored in a store that the user has access to.

Rasphone.pbk is not "a vpn". It is a "phone book". When you put your phone book entries in the global phone book, windows can see them before login.