The IT Crownd

Our VPN solution is based on RRAS running on Windows Server 2016 running on ESX 7.5, through a Fortinet Firewall. For a while we've been having VPN connectivity issues.  Users who could connect one day were failing to connect or connections were dropping.   It is your typical IT nightmare - nothing changed in either client or server config and things just worked or failed randomly. It got so bad (Execs got involved!) and we are now implementing a new solution and moving away from RRAS. In any case I began last month by finally "giving-in" and rebooting the servers each night (I've an Orchestrator job which checks the VPN connections and reboots the server if there are none) This seemed to help and connections were a lot better. I did some more trawling the internet and found some really old posts that VMXNET3 adapters caused issues with RRAS and NAT (which I am doing)  So I reconfigured to use E1000. Again another level of stability!   Finally I rememb...

Messing around with VPNs last week I found that it is easier (sometimes) to have a one liner for VPN creation! Here's how I make a PEAP\MSChapV2 VPN profile...using the users Windows creds! Change ServerAddress, DnsSuffix and choose a better L2tpPsk!! $a = New-EapConfiguration -UseWinlogonCredential $b = New-EapConfiguration -Peap -TunnledEapAuthMethod $a.EapConfigXmlStream Add-VpnConnection -Name "VPN (SSL)" -ServerAddress vpn.fqdn.com -AuthenticationMethod Eap -DnsSuffix my.domain.com -EapConfigXmlStream $b.EapConfigXmlStream -EncryptionLevel Maximum -Force -RememberCredential -AllUserConnection -TunnelType Sstp Add-VpnConnection -Name "VPN (L2TP)" -ServerAddress vpn.fqdn.com -AuthenticationMethod Eap -DnsSuffix my.domain.com -EapConfigXmlStream $b.EapConfigXmlStream -EncryptionLeve...

We have a pair of 2019 core servers running our file shares. We also use System Center Orchestrator to automate some things. Here is how I set up Orchestrator to take initate VSS snapshots. Ensure that VSS is running ok on your fileserver and you can manually take a VSS snapshot - using vssadmin. Decide on your schedule - we do a snapshot every 2 hours. Create a Monitor Date/Time step configured to the required VSS schedule I found the only way to get VSS to run correctly was using PSEXEC to run the actual VSS snapshot  So make a Run Program step for each File Server, to run the following command line (replacing values where needed) psexec.exe -h -accepteula \\fileserver01 vssadmin create shadow /for=F: M ake sure you enter an account in the Advanced and Security sections.  The account needs the correct permissions to create VSS snaps on the fileservers! I then do some error checking and logging based on this with failures also raising an email not...

Ran into an issue where I needed to "double-hop" from one PSSession to another. This led to an investigation into how to set up CredSSP My issue resolved around getting System Center Orchestrator to run some PowerShell which reports back the number of users currently on our VPN server. I followed the awesome posts from * where they suggest to run a PSSession onto the localhost (in my case Orchestrator) rather than to run PowerShell.  This is cool unless you then want to PSSession onto another box, in my case my VPN box to run some more PowerShell! The post does briefly mention setting up WSManCred - too briefly ;) Anyways on the first hop machine you need to run (as Administrator) the PowerShell - replace *.domain.com with you domain name - or for tighter security replace with the FQDN of the target server. PS C:\Enable-WSManCredSSP Client -DelegateComputer *.domain.com And on the second hop computer... PS C:\Enable-WSManCredSSP Server -Force At any time you...

Had some trouble with our ESX VMs booting to the Windows Deployment Server when using UEFI. UEFI is now the default boot for VMs - finally! Changing the network interface from VMXNET3.0 to E1000e made things work again!  We had Secure Boot enabled in both cases. Our physical devices (DELL Latitudes) have no issue so we suspected ESX. Devices with VMXNET interfaces were failing to boot, get DHCP or anything....they just (seemingly) timed out. Turns out, for us it was a TFTP configuration. In WDS right click your WDS Server node and open the properties dialog.   GO to the TFTP config tab and set the following Disable : Enable Variable Window Extension Configure: Maximum Block Size to 16384 Worked for us. Thanks to fboehme (although I see Secure Boot is disabled in this post!) https://communities.vmware.com/thread/572481?start=15&tstart=0

Windows 10 has a nice feature called Always On VPN. This is pretty much an acceptance that many people have not deployed Direct Access :)  Although DA is not a VPN solution I prefer AO so I set it up for our recent Windows 10 roll out. Basically the steps boil down to... Create some certificate templates. Create 2 new VMs. Enroll into those templates Install RRAS and NPS roles Config RRAS and NPS Client Config The most difficult for me was deciding on how to get the client config to roll out.  We use the Quest appliance KACE here so I used that to deploy a powershell script which sets up the VPN.  Love Windows 10!! I used MDT to build two Windows 2016 servers - I tried the core but my skills were not up for it! EDIT: It is not possible to install NPS on core - it does "come with" RRAS but avoid on core! EDIT:  I ended up making my NPS and RRAS box the same it reduces the server count a bit and proved more reliable/stable (Never found out w...

We noticed that after installing Fortinet VPN our Windows VPNs configured on the same machine stopped working. uninstalling the Fortinet client had no effect. We did notice that the services, IKEEXT and PolicyAGent were disabled. Making these auto start and rebooting fixed the issue. We are not sure that Fortinet VPN has anything to do with causing this - however only those machine with the client have shown this issue. Thanks to this posting from Stephan for the solution: https://social.technet.microsoft.com/Forums/lync/en-US/46667a11-5a49-4549-9e18-7d07e8001c35/error-789-when-trying-to-establish-l2tp-vpn-connection?forum=w7itpronetworking