Forum Discussion
SCCM and deploy Windows 10 Always On VPN Custom profile
Hi,
I posted a question this morning in System Center space.
I'm looking for suggestions in order to deploy custom AlwaysOn vpn profile to my clients.
I have SCCM Current Branch and about 2k clients to manage.
I've successfully deployed AlwaysOn vpn custom profile by MEM but now I need to do the same with SCCM that I'm not so familiar with.
My profile is composed by one PS1 script and one xml configuration file with NRPT and custom IKEv2 security baseline. Sometimes I need to edit the xml file in order to update NRTP, so I need to update client configuration. I need to deploy these setting to a User collection.
I tried to make a package with both files, first deploy were successfully but if I'll need to modify one of the files in the package, I should create a new package and a new deploy each time.
I tried with Compliance Settings > VPN profile but I can't upload my custom xml and the wizard doesn't allow to edit the IKEv2 security.
Last test was with Application. In this case the configuration failed due to client user permission (ps1 requires elevated but local user are not local administrator).
Did you have any suggestion?
Many thanks!
Francesco
3 Replies
- Danny_Guillory
Microsoft
FrancescoFacco Since you need to make changes have you considered using Configuration Item(s) [Script] to do that evaluation and remediation. Ideally, you can set up a configuration baseline that should be able to do this, that's one option. Another option might be to try different deployments. https://docs.microsoft.com/en-us/mem/configmgr/compliance/deploy-use/create-custom-configuration-items-for-windows-desktop-and-server-computers-managed-with-the-client#bkmk_script
Danny_Guillory Thank you Danny. Do you mean that I should create a kind of check-item (like a file or reg-key) and search for that? In case of missing or different status, I should create a remediation starting new deploy of the profile?
What about deploy method? Can I packages or applications or should think different?
- Danny_Guillory
FrancescoFacco, when you use that scripted method your only limited to your own PowerShell skills so you can then check whatever your requirements are and create or put what's needed from there. Lots of ways you can go here. Feel free to DM me if you want to kick some ideas around.
