janjust
what if the user simply disables the network? janks out the network cable?
on windows, you can run openvpn as a service that is launched before the user is logged in; this service process cannot be controlled by a non-admin user, so the user would have no method , other than disabling the network, to disable the VPN
on linux, you can run openvpn at system startup as 'root' - as long as the user does not have root privileges you should be fine
for mac OS I'm sure something similar applies.
