Hi, I had some tasks to solve regarding OpenVPN in our environment and after testing and successful implementation I wanted to give back my knowledge to the community. [b]My self-imposed task looked like that:[/b] - OpenVPN - Windows 7 with UAC being on - Users not being in "Administrator Group" nor "Network Operations Group" - User launches "OpenVPN up script" with currently logged-in user privileges - This "OpenVPN up script" launches a script on remote site via UNC via "\\remote-via-VPN-AD-Domaincontroller\netlogon\script.cmd" - This script launches network drives mapping via %username% variable that is taken from currently logged-in user - Avoid the well know security token error that a process is started with higher privileged rights mentioned here: [url]http://support.microsoft.com/kb/937624/en-us[/url] - That means not changing the mentioned setting "EnableLinkedConnections" in registry which wouldnt help anyway [b]What I needed to solve that where three applications.[/b] 1. OpenVPN with OpenVPN-Gui 2. SuRun for Windows; SuRun makes it possible to launch applications with administrative privileges without being prompted for User credentials or change system settings. It is needed to launch openvpn.exe and openvpn-gui.exe with administrative rights. Link: [url]http://kay-bruns.de/wp/software/surun/[/url] 3. hstart; it is a lightweight command line utility that allows you to run console applications and batch files with some special switches. Since openvpn-gui is running in administrative rights due to SuRun I need to de-elevate the rights for getting our mappings done with normal security token. Link: [url]http://www.ntwind.com/software/utilities/hstart.html[/url] [b]Short summary of the steps I did:[/b] 1. Install OpenVPN with OpenVPN-Gui as Admin; default installation; nothing special 2. Install SuRun as Admin; launch it; set openvpn.exe and openvpn-gui.exe to be launched with administrative privileges; disallow normal users to see & launch SuRun or set anything in SuRun. 3. copied hstart into C:\Program Files\OpenVPN\config and launch my remote script in "OpenVPN up script" like that: hstart /NONELEVATED "\\remote-via-VPN-AD-Domaincontroller\netlogon\script.cmd" [b]Result:[/b] That's it. Now my users can log in with their laptop normally being normal AD users........Launch OpenVPN with higher rights without interaction or being "Administrator Group" or "Network Operations Group"......Click connect....Enter username and password.....and the script maps network drives automatically with the same script that is used in AD when being in the office. With proxy-arp feature (thanks janjust for your great book) the roadwarriors are totally integrated in the LAN and in the same situation being on the road like being in the office. Exchange works, Mappings work, user credentials etc. all the same. And no Admin rights to the ordinary user. :) I hope this helps others. If some questions show up I will try help. Thanks and Best BruceLee

Windwos 7+OpenVPN+user rights; nice solution for me

BruceLee

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Mimiko

Good description. Althought even if you hide SuRun from start menu, one that whants to run a program elevated and knows more in computer will find how to do it.

I will go by setting OpenVPN as a service which will connect before users logs in system. And configure the OpenVPN server to disable routing when laptop will connect from local work LAN.

BruceLee

Thanks for your feedback. But in my situation your way is not working at all.

Althought even if you hide SuRun from start menu, one that whants to run a program elevated and knows more in computer will find how to do it.

Never talked about start menu? Conceringn SuRun that doesn't matter, you don't hide it..you disallow normal users. Even if you start SuRun (that you can't do if it is set it correctly) you can't run/change/or do anything if you are not the admin. So go ahead and show me a way how to elevate my user privileges that is not admin to admin privileges in the same user context. 🙂

I will go by setting OpenVPN as a service which will connect before users logs in system. And configure the OpenVPN server to disable routing when laptop will connect from local work LAN.

Running OpenVPN as a service is not a solution. It doesn't solve the problem. It's not about when it starts or when not or if it's an process or a service.
It's about user context and privileges. Because you would run the service as a user that has special privileges to set routes. If you do that, OpenVPN will run in the service users context and does not run in the correct currently logged in user context. In then it won't run my scripts as needed. And it won't map the drives...and...and...and have many other disadvantageous things.

So I'm sorry to say but your idea is not a solution at all. Have you read my requirements and my tasklist?

kevinobrien

I'm sorry to dig this up! :oops:

Mimiko said to disable route at OpenVPN server when connected locally. Could someone please help explain that to me?