1

On our network Notebooks can be powered on outside the network (home) and then connected to VPN after user logs in. Some GPOs, for instance Drive Maps and other things don't get applied when the computer is connected offline. How can I make policy to cache and apply even when domain controller is offline?

Thank you,

Improve this question
4
  • I think you are misunderstanding why they aren't working. A Drive map for example is done at logon, I'm guessing your users are not connecting the VPN before logon. Therefore the resource you are mapping to is not available. The GPO is still present.
    – Drifter104
    Jul 1, 2016 at 9:23
  • Yes because they use Cisco Client after login. So you think GPO is still applied but because server is "unavailable" it doesn't map. The point is it was working, nothing was changed.
    – rgomez
    Jul 1, 2016 at 9:25
  • Have they changed anything to do with offline files? If a laptop users caches a file in a mapped drive, then it will still show regardless of drive mappings
    – Drifter104
    Jul 1, 2016 at 9:27
  • No I don't think so. There were a massive change on all GPO Objects cause some were not getting applied because support.microsoft.com/en-us/kb/3163622 and they added Domain Computers read to all GPOs. All Offline Files are still available the point is that we run a Drive Map that gives access to all company files and that is not being created.
    – rgomez
    Jul 1, 2016 at 9:31

4 Answers 4

Reset to default
4

You current design of logon then connecting over VPN is flawed.

You may want to consider using shortcuts instead of drive mappings.

Or configure the VPN clients to connect before logon.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107598-sbl.html

Improve this answer
1
  • 1
    "You may want to consider using shortcuts instead of drive mappings." Cannot be said enough.
    – Jim B
    Jul 1, 2016 at 16:31
1

Clients need to be in contact with the file server when the GPO is run, which typically for drive maps is at user logon, since GP Preferences are User Settings.

If the VPN client is run after the user logon then they won't connect and map correctly.

Using SMB shares with VPNs can be hit and miss at times with users.

Improve this answer
0

I know it's a bit later, bit CISCO SBL (Start Before Logon) add-on for their Any Connect client works great. Except for computer policy GPO's.

Improve this answer
1
  • I know what Cisco Anyconnect is, but for someone who may not, this answer is a bit of a stub. You should include more information, and possibly a link for reference. See serverfault.com/help/how-to-answer
    – Cory Knutson
    Oct 31, 2017 at 5:24
0

Find the event ID of a successful VPN connection from your vendor, then create a scheduled task script that waits a few seconds and runs a gpupdate or maps to the login script.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .