Add Remote Access / Always-On VPN module (74-AlwaysOnVPN) (#39)

New module 74-AlwaysOnVPN is the VPN-gateway half of the remote-access
stack whose RADIUS auth back end is the NPS module (73): RRAS forwards
authentication to NPS, NPS applies the network policy.

  * Install the RemoteAccess (DirectAccess and VPN) role (reversible,
    via the timeout wrapper + undo).
  * Configure RRAS as a VPN server (Install-RemoteAccess -VpnType Vpn).
  * Point VPN authentication at an NPS/RADIUS server. The shared secret
    is collected as a SecureString, converted to plaintext only for the
    Add-RemoteAccessRadius call, then zeroed — never written to the
    Dry-Run queue, its JSON export, or any file. Undo removes the RADIUS
    server and reverts auth back to Windows.
  * Generate device-tunnel (machine-cert) / user-tunnel (EAP-TLS)
    Always-On VPN ProfileXML from a few prompts. User-supplied values are
    XML-escaped before interpolation, and profiles are written to the
    Admins+SYSTEM-only hardened state dir.
  * Show the current Remote Access / VPN configuration.

Wired into the loader, Header action set, entry-point dispatch
(AlwaysOnVPNSetup), Roles & Features menu (item 11), and menu runner.
Module count 74 -> 75; 4944 tests, 0 failures; PSScriptAnalyzer clean.

Author: TheAbider

Changelog.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## v1.105.0
+
+Remote Access / Always-On VPN — new module (74-AlwaysOnVPN.ps1), reachable from **Roles & Features → [11] Remote Access / Always-On VPN** and via the `AlwaysOnVPNSetup` CLI action. This is the VPN-gateway half of the remote-access stack whose RADIUS auth back end is the NPS module (73): RRAS forwards authentication to NPS, NPS applies the network policy.
+
+**What it does:**
+- **Install the Remote Access role** (`-Action AlwaysOnVPNSetup`, or menu): installs the DirectAccess and VPN (RAS) role with management tools. Reversible / Dry-Run-aware.
+- **Configure the VPN server** (interactive or CLI): enables RRAS as a VPN server (SSTP + IKEv2). Undo tears the VPN configuration back down.
+- **Point authentication at NPS/RADIUS** (interactive): register an NPS server as the VPN's RADIUS authentication source. The shared secret is collected as a SecureString and held only long enough for the registration — it never lands in the Dry-Run queue, its JSON export, or any file. Undo removes the RADIUS server.
+- **Generate Always-On VPN profiles** (interactive): build a device-tunnel (machine-cert) or user-tunnel (EAP-TLS) ProfileXML from a few prompts — server FQDN, protocol (IKEv2/SSTP/Automatic), split- vs force-tunnel, DNS suffix, and split-tunnel routes. The generated profile is written to an admin-only path, ready to deploy via the VPNv2 CSP (Intune) or PowerShell.
+- **Show the current Remote Access / VPN configuration.**
+
+Requires the Remote Access role; the menu surfaces install + VPN-configured status. Connection-request and network policies are authored in the NPS module / console.
+
+Module count: 74 → 75.
+
 ## v1.104.0
 
 Network Policy Server (NPS / RADIUS) — new module (73-NPS.ps1), reachable from **Roles & Features → [10] Network Policy Server (RADIUS)** and via the `NPSSetup` CLI action. NPS is Windows' RADIUS server for 802.1X (wired/wireless NAC), VPN authentication, and as the auth back end for Always-On VPN.

Header.ps1

@@ -3,7 +3,7 @@
     RackStack - All-in-one Windows Server setup utility (Monolithic Build).
 
 .DESCRIPTION
-    This is the MONOLITHIC BUILD -- all 74 modules combined into a single file.
+    This is the MONOLITHIC BUILD -- all 75 modules combined into a single file.
     Generated by sync-to-monolithic.ps1 from the modular source in Modules/.
     The .exe is compiled from this file via ps2exe.
 
@@ -30,7 +30,7 @@
     7h3 4b1d3r
 
 .VERSION
-    1.104.0
+    1.105.0
 
 .LAST UPDATED
     05/23/2026
@@ -1391,7 +1391,7 @@
 param(
     # CLI headless mode: run a specific action without interactive menus
     # Usage: RackStack.exe -Action Cleanup [-Tier Standard] [-Silent] [-OutputFormat JSON]
-    [ValidateSet('Cleanup', 'Debloat', 'HealthCheck', 'Batch', 'QuickScan', 'Inventory', 'DriftCheck', 'Snapshot', 'Compliance', 'Harden', 'Remediate', 'Aggregate', 'Compare', 'Export', 'Trend', 'CertCheck', 'ReportHTML', 'ListeningPorts', 'SoftwareList', 'Uptime', 'ServiceAudit', 'EventAudit', 'NetInfo', 'ScheduledExport', 'ValidateConfig', 'Watch', 'Query', 'Diff', 'Baseline', 'Alert', 'FleetScan', 'PatchStatus', 'UserAudit', 'FirewallAudit', 'TaskAudit', 'DiskAudit', 'TLSAudit', 'SMBAudit', 'DriverAudit', 'TimeAudit', 'BootAudit', 'GPOAudit', 'MemoryAudit', 'ProcessAudit', 'BackupAudit', 'ShareAudit', 'DNSAudit', 'PowerAudit', 'RegistryAudit', 'ProfileAudit', 'HyperVAudit', 'NetworkAudit', 'StorageAudit', 'FeatureAudit', 'AutoStartAudit', 'BIOSAudit', 'ClusterAudit', 'AuditPolicyAudit', 'EnvAudit', 'CrashAudit', 'LocalGroupAudit', 'WMIAudit', 'TempAudit', 'UpdatePolicyAudit', 'IISAudit', 'SSHAudit', 'BitLockerAudit', 'PrintAudit', 'CredGuardAudit', 'PortAudit', 'AntivirusAudit', 'DotNetAudit', 'RDPAudit', 'VPNAudit', 'HostsFileAudit', 'NetStatAudit', 'LicenseAudit', 'USBDeviceAudit', 'AppLockerAudit', 'EventSubAudit', 'HotfixAudit', 'SysInfoAudit', 'LogonAudit', 'ACLAudit', 'RecoveryAudit', 'ServiceAccountAudit', 'ProxyAudit', 'PendingRebootAudit', 'PageFileAudit', 'CPUAudit', 'DefenderExclusionAudit', 'KerberosAudit', 'DHCPAudit', 'NUMAAudit', 'SymlinkAudit', 'StartupScriptAudit', 'SecureChannelAudit', 'ComObjectAudit', 'FirewallLogAudit', 'ScheduledRebootAudit', 'PowerShellAudit', 'RouteTableAudit', 'TokenPrivilegeAudit', 'WindowsCapabilityAudit', 'ARPTableAudit', 'LocaleAudit', 'TaskHistoryAudit', 'NTFSAudit', 'Win11Cleanup', 'DarkMode', 'LightMode', 'iSCSIAudit', 'NICTeamAudit', 'SMBSessionAudit', 'WindowsUpdateAudit', 'ClusterQuorumAudit', 'S2DAudit', 'VirtualSwitchAudit', 'MPIOPathAudit', 'ServiceRecoveryAudit', 'VMOvercommitAudit', 'DedupAudit', 'ClusterNetworkAudit', 'ReplicaLagAudit', 'HandleLeakAudit', 'ShadowCopyAudit', 'QoSPolicyAudit', 'LiveMigrationAudit', 'DomainTrustAudit', 'DiskLatencyAudit', 'NICOffloadAudit', 'StorageTimeoutAudit', 'EventLogCapacityAudit', 'TcpSettingsAudit', 'WinRMAudit', 'ClusterHealthScore', 'VMInventoryExport', 'VMSnapshotAudit', 'StorageHealthScore', 'CSVSpaceAudit', 'SMBConnectionAudit', 'VolumeLabelAudit', 'NICErrorAudit', 'VMResourceWaste', 'HealthDashboard', 'SCCMClientAudit', 'SCOMAgentAudit', 'WACConnectivityAudit', 'AzureADAudit', 'ServerScore', 'FleetReport', 'PasswordPolicy', 'FirewallRuleAudit', 'GPResultAudit', 'DNSCacheAudit', 'TPMAudit', 'SecureBootAudit', 'TimeSkewAudit', 'NetworkProfileAudit', 'InsecureServiceAudit', 'SelfTest', 'CheckForUpdate', 'ExportLogs', 'UpdateSelf', 'Rollback', 'ScheduleUpdateCheck', 'Dashboard', 'History', 'Replay', 'AzureArcEnroll', 'DefenderEndpointOnboard', 'WSUSSetup', 'ADCSSetup', 'StorageMigrationSetup', 'GPOBackup', 'GPODrift', 'JEAList', 'NPSSetup')]
+    [ValidateSet('Cleanup', 'Debloat', 'HealthCheck', 'Batch', 'QuickScan', 'Inventory', 'DriftCheck', 'Snapshot', 'Compliance', 'Harden', 'Remediate', 'Aggregate', 'Compare', 'Export', 'Trend', 'CertCheck', 'ReportHTML', 'ListeningPorts', 'SoftwareList', 'Uptime', 'ServiceAudit', 'EventAudit', 'NetInfo', 'ScheduledExport', 'ValidateConfig', 'Watch', 'Query', 'Diff', 'Baseline', 'Alert', 'FleetScan', 'PatchStatus', 'UserAudit', 'FirewallAudit', 'TaskAudit', 'DiskAudit', 'TLSAudit', 'SMBAudit', 'DriverAudit', 'TimeAudit', 'BootAudit', 'GPOAudit', 'MemoryAudit', 'ProcessAudit', 'BackupAudit', 'ShareAudit', 'DNSAudit', 'PowerAudit', 'RegistryAudit', 'ProfileAudit', 'HyperVAudit', 'NetworkAudit', 'StorageAudit', 'FeatureAudit', 'AutoStartAudit', 'BIOSAudit', 'ClusterAudit', 'AuditPolicyAudit', 'EnvAudit', 'CrashAudit', 'LocalGroupAudit', 'WMIAudit', 'TempAudit', 'UpdatePolicyAudit', 'IISAudit', 'SSHAudit', 'BitLockerAudit', 'PrintAudit', 'CredGuardAudit', 'PortAudit', 'AntivirusAudit', 'DotNetAudit', 'RDPAudit', 'VPNAudit', 'HostsFileAudit', 'NetStatAudit', 'LicenseAudit', 'USBDeviceAudit', 'AppLockerAudit', 'EventSubAudit', 'HotfixAudit', 'SysInfoAudit', 'LogonAudit', 'ACLAudit', 'RecoveryAudit', 'ServiceAccountAudit', 'ProxyAudit', 'PendingRebootAudit', 'PageFileAudit', 'CPUAudit', 'DefenderExclusionAudit', 'KerberosAudit', 'DHCPAudit', 'NUMAAudit', 'SymlinkAudit', 'StartupScriptAudit', 'SecureChannelAudit', 'ComObjectAudit', 'FirewallLogAudit', 'ScheduledRebootAudit', 'PowerShellAudit', 'RouteTableAudit', 'TokenPrivilegeAudit', 'WindowsCapabilityAudit', 'ARPTableAudit', 'LocaleAudit', 'TaskHistoryAudit', 'NTFSAudit', 'Win11Cleanup', 'DarkMode', 'LightMode', 'iSCSIAudit', 'NICTeamAudit', 'SMBSessionAudit', 'WindowsUpdateAudit', 'ClusterQuorumAudit', 'S2DAudit', 'VirtualSwitchAudit', 'MPIOPathAudit', 'ServiceRecoveryAudit', 'VMOvercommitAudit', 'DedupAudit', 'ClusterNetworkAudit', 'ReplicaLagAudit', 'HandleLeakAudit', 'ShadowCopyAudit', 'QoSPolicyAudit', 'LiveMigrationAudit', 'DomainTrustAudit', 'DiskLatencyAudit', 'NICOffloadAudit', 'StorageTimeoutAudit', 'EventLogCapacityAudit', 'TcpSettingsAudit', 'WinRMAudit', 'ClusterHealthScore', 'VMInventoryExport', 'VMSnapshotAudit', 'StorageHealthScore', 'CSVSpaceAudit', 'SMBConnectionAudit', 'VolumeLabelAudit', 'NICErrorAudit', 'VMResourceWaste', 'HealthDashboard', 'SCCMClientAudit', 'SCOMAgentAudit', 'WACConnectivityAudit', 'AzureADAudit', 'ServerScore', 'FleetReport', 'PasswordPolicy', 'FirewallRuleAudit', 'GPResultAudit', 'DNSCacheAudit', 'TPMAudit', 'SecureBootAudit', 'TimeSkewAudit', 'NetworkProfileAudit', 'InsecureServiceAudit', 'SelfTest', 'CheckForUpdate', 'ExportLogs', 'UpdateSelf', 'Rollback', 'ScheduleUpdateCheck', 'Dashboard', 'History', 'Replay', 'AzureArcEnroll', 'DefenderEndpointOnboard', 'WSUSSetup', 'ADCSSetup', 'StorageMigrationSetup', 'GPOBackup', 'GPODrift', 'JEAList', 'NPSSetup', 'AlwaysOnVPNSetup')]
     [string]$Action,
 
     [ValidateSet('Light', 'Standard', 'Aggressive')]

Modules/00-Initialization.ps1

@@ -225,7 +225,7 @@ if (-not $PSCommandPath -and $script:ScriptPath) {
 if (-not $script:ModuleRoot -and $script:ScriptPath) {
     $script:ModuleRoot = [System.IO.Path]::GetDirectoryName($script:ScriptPath)
 }
-$script:ScriptVersion = "1.104.0"
+$script:ScriptVersion = "1.105.0"
 $script:ScriptStartTime = Get-Date
 
 # Post-update cleanup: UpdateSelf / Rollback leave a `.pending-delete` sibling next to RackStack.exe.

Modules/48-MenuDisplay.ps1

@@ -426,6 +426,12 @@ function Show-RolesFeaturesMenu {
     } -CacheSeconds 120
     $npsColor = if ($npsStatusText -eq "Installed") { "Success" } else { "Warning" }
 
+    $aovpnStatusText = Get-CachedValue -Key "RemoteAccessState" -FetchScript {
+        $r = Get-RemoteAccessStatus
+        if ($r.VpnConfigured) { "VPN configured" } elseif ($r.Installed) { "Role installed" } else { "Not Installed" }
+    } -CacheSeconds 120
+    $aovpnColor = if ($aovpnStatusText -eq "VPN configured") { "Success" } elseif ($aovpnStatusText -eq "Role installed") { "Warning" } else { "Warning" }
+
     Write-OutputColor "" -color "Info"
     Write-OutputColor "  ╔════════════════════════════════════════════════════════════════════════╗" -color "Info"
     Write-OutputColor "  ║$(("                           ROLES & FEATURES").PadRight(72))║" -color "Info"
@@ -443,6 +449,7 @@ function Show-RolesFeaturesMenu {
     Write-MenuItem "[8]  Group Policy Manager ►" -Status $gpoStatusText -StatusColor $gpoColor
     Write-MenuItem "[9]  Just Enough Administration (JEA) ►" -Status $jeaStatusText -StatusColor $jeaColor
     Write-MenuItem "[10] Network Policy Server (RADIUS) ►" -Status $npsStatusText -StatusColor $npsColor
+    Write-MenuItem "[11] Remote Access / Always-On VPN ►" -Status $aovpnStatusText -StatusColor $aovpnColor
     Write-OutputColor "  └────────────────────────────────────────────────────────────────────────┘" -color "Info"
     Write-OutputColor "" -color "Info"
     Write-OutputColor "  [B] ◄ Back to Server Config" -color "Info"

Modules/49-MenuRunner.ps1

@@ -253,9 +253,10 @@ function Start-Show-RolesFeaturesMenu {
             "8" { Show-GPOManagerManagement }
             "9" { Show-JEAManagement }
             "10" { Show-NPSManagement }
+            "11" { Show-RemoteAccessManagement }
             "back" { return }
             default {
-                Write-OutputColor "  Invalid choice. Enter 1-10 or B." -color "Error"
+                Write-OutputColor "  Invalid choice. Enter 1-11 or B." -color "Error"
                 Start-Sleep -Milliseconds 500
             }
         }

Modules/50-EntryPoint.ps1

@@ -403,6 +403,7 @@ function Assert-Elevation {
                 @{ Action = 'GPODrift';         Description = 'Compare live GPOs against a baseline backup folder given in -Config <folder>' }
                 @{ Action = 'JEAList';          Description = 'List the registered JEA (Just Enough Administration) constrained endpoints on this host' }
                 @{ Action = 'NPSSetup';         Description = 'Install the Network Policy Server (NPAS / RADIUS) role' }
+                @{ Action = 'AlwaysOnVPNSetup'; Description = 'Install the Remote Access role and configure RRAS as a VPN server' }
                 @{ Action = 'Batch';            Description = 'JSON-driven full configuration' }
             )
             if ($script:CLIOutputFormat -eq 'JSON') {
@@ -2005,6 +2006,11 @@ footer{text-align:center;color:#999;font-size:12px;padding:16px}
             $npsOk = Start-NPSSetup
             [Environment]::Exit([int](-not $npsOk))
         }
+        'AlwaysOnVPNSetup' {
+            # Install the Remote Access role and configure RRAS as a VPN server.
+            $aovpnOk = Start-AlwaysOnVPNSetup
+            [Environment]::Exit([int](-not $aovpnOk))
+        }
         'Batch' {
             if (-not $script:CLIConfig) {
                 Write-OutputColor "  ERROR: -Action Batch requires -Config <path>" -color "Error"