On windows 10, how do I setup a VPN client so that all users can use it (i.e. available before login)

Question

On Windows XP, 7, 8, 8.1 you could tick a box that says 'Allow other users to use this VPN' when you initially connected the VPN.

This option is no longer available - how do I set the VPN to be available for connection on the Login screen?

Answer 1

Old question but for anyone trying to find an answer there is a better solution via elevated powershell:

Add-VpnConnection -Name MY_VPN_NAME -ServerAddress MY_VPN_SERVER -AllUserConnection $true -SplitTunneling $true -AuthenticationMethod MSChapv2 -TunnelType Automatic -EncryptionLevel Required -PassThru

Source

Answer 2

CrayFishUK, my experience for all Windows XP/Vista/7/2008/8/2012/10 This will connect VPN as a SYSTEM user when system starts.

1. You will need to create a VPN connection
2. Save or not save credential it is not important.
3. Find a rasphone.pbk in %APPDATA%\Microsoft\Network\Connections\Pbk_hiddenPbk
4. More nice if you will copy it to C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk or attach to exist rasphone.pbk (it is text files)
5. Now you need to create scheduler task...

Scheduler task:

• Start after boot
• Program to start has credential to connect VPN

Code:

cmd /c rasdial VPNUSER VPNPASSWORD /PHONEBOOK:"C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk" && route add 10.0.0.0/8 172.16.0.254

• You will need change the creator user to the SYSTEM user

I have add at the end:

route add 10.0.0.0/8 172.16.0.254

for exampe, how to auto add route when sucsesful connect VPN

If you will need to reconnect VPN when it fails ask a new question and I will help.

By default VPN send all traffic through VPN, if you want to use routes You will need to turn off this future.

Answer 3

A VPN config is stored as text in rasphone.pbk. The all-user copy of rasphone.pbk is located in the "all users" profile: on win11 pro the default is

c:\users\all users\microsoft\network\connections\pbk\rasphone.pbk

There are many ways you can add to or modify a text file. You can copy rasphone.pbk from your admin profile. You can copy and append from a text file: You can use WMI (or any Web-Based Enterprise Management controller), or RAS.exe or powershell -- which is a shell for things like RAS and WMI.

EAP data is stored as a blob in the file (CustomAuthData) Credentials are stored separately: the GUID referenced in the config file is used as a key to HKEY_LOCAL_MACHINE\Security\Cache. If you use certificate, make sure that it is stored in a store that the user has access to.

Rasphone.pbk is not "a vpn". It is a "phone book". When you put your phone book entries in the global phone book, windows can see them before login.

Answer 4

You CAN still setup a VPN for all users on Win10 and Win11 and you CAN still setup a VPN that to connect to a network (Network Sign in) before you login through the GUI. Microsoft have just made the interface a bit more convulted to get to it. Click Start, then type Control Panel. Click the Network and Internet heading, then select the Network and Sharing Centre heading. Then select the Setup a Connection or Network. Choose the option Connect to a workplace. Create a new connection, choose Use my Internet Connect (VPN), then add in the details (i.e. VPN server IP address or host name, and a name for the connection). Make sure you tick the option, Allow other people to use this connection.