Always On VPN

Always-On VPN

The Remote Access module stands up the Windows Remote Access (RRAS) role as a VPN server and generates Always-On VPN client profiles. It is the gateway half of the remote-access stack whose RADIUS authentication back end is the NPS module: RRAS forwards authentication to NPS, and NPS applies the network policy.

New in v1.105.0: Remote Access / Always-On VPN module.

---

Table of Contents

• Accessing the Module
• Menu Options
• RADIUS Authentication
• Generating an Always-On VPN Profile
• CLI / Headless Mode
• Security
• Related

---

Accessing the Module

Menu path: Configure Server > Roles & Features > [11] Remote Access / Always-On VPN

The submenu shows whether the Remote Access role is installed and whether RRAS is configured as a VPN server.

---

Menu Options

Option	Description
[1] Install Remote Access Role	Installs the DirectAccess and VPN (RAS) role with management tools. Reversible / Dry-Run-aware.
[2] Configure VPN Server	Enables RRAS as a VPN server (SSTP + IKEv2). Undo tears the VPN configuration back down.
[3] Set RADIUS (NPS) Authentication	Point VPN authentication at an NPS/RADIUS server.
[4] Generate Always-On VPN Profile	Build a device-tunnel or user-tunnel ProfileXML from prompts.
[5] Show Configuration	Current VPN / RADIUS settings.

---

RADIUS Authentication

You supply the NPS/RADIUS server address and a shared secret (matching the NPS client entry). The secret is a hidden SecureString, converted to plaintext only for the Add-RemoteAccessRadius call and never persisted. The undo removes the RADIUS server and reverts authentication back to Windows, so the VPN is never left pointing at a removed server.

---

Generating an Always-On VPN Profile

The generator prompts for the VPN server FQDN (must match the gateway certificate SAN), tunnel type (user / device), protocol (IKEv2 / SSTP / Automatic), routing (split- vs force-tunnel), DNS suffix, and split-tunnel routes. It writes a ProfileXML you deploy via the VPNv2 CSP (Intune) or PowerShell:

• Device tunnel — machine-certificate authentication (no user interaction).
• User tunnel — an EAP-TLS template you complete with your client-auth certificate.

All user-supplied values are XML-escaped, and the generated profile is written to the Administrators + SYSTEM-only hardened directory.

---

CLI / Headless Mode

# Install the Remote Access role and configure RRAS as a VPN server
RackStack.exe -Action AlwaysOnVPNSetup

# JSON output for fleet automation
RackStack.exe -Action AlwaysOnVPNSetup -OutputFormat JSON

The JSON envelope reports RoleInstalled, VpnConfigured, and Changed. (Configuring the VPN server can require a reboot before Install-RemoteAccess is available, so a not-yet-configured VPN is reported, not treated as a hard failure.)

---

Security

• The RADIUS shared secret is SecureString, materialized only for the cmdlet call, and excluded from the Dry-Run queue / JSON / logs.
• Generated ProfileXML is XML-escaped and written to the hardened state directory.
• The role install and VPN configuration are reversible and Dry-Run-aware.

---

Related

• NPS & RADIUS — the authentication back end for this VPN gateway
• CLI & Automation — full -Action reference