Ask the Experts, July 2006: Automatically Configuring Client VPN Connections

We're planning to roll out a new VPN server that will allow our Windows XP and Windows 2000 mobile users to connect to the corporate network. How can we set up these network connections on each user's PC?

You can use the Connection Manager Administration Kit (CMAK) to build a custom executable setup file that will automatically configure your client-side VPN network connection. Then you distribute this .exe file to your users. CMAK is part of the Windows Server 2003 Administration Tools Pack, which you can download from http://www.microsoft.com/downloads/details.aspx?FamilyID=c16ae515-c8f4-47ef-a1e4-a8dcbacff8e3&DisplayLang=en. After you install CMAK, open it from the Administrative Tools Control Panel applet. The CMAK Wizard walks you through the process of building a service profile and its corresponding .exe file. The wizard will ask you the IP address of the VPN server and whether to connect via PPTP or L2TP, and lets you configure all the network, authentication, and encryption settings normally available when you create a VPN connection manually.

Although the CMAK wizard is pretty straightforward, there are a few modifications to the default settings you must make because you're creating a VPN-only (no dial-up) connection. After starting CMAK, click Next on the introductory page, select New profile on the Service Profile Selection page and click Next. On the Service and File Names page, enter a descriptive name that will identify your VPN to your users and enter a file name for the profile, as Figure 1 shows. Click Next. On the Realm page, you can specify a domain name to be automatically added to the username provided by the user if all your VPN users have accounts in the same domain. Click Next twice, which opens the VPN Support page. Select the Phone book from this profile check box, and enter the Internet IP address of your VPN server in the Always use the same VPN server field, as Figure 2 shows. Click Next twice, and on the Phone Book page, clear the Automatically download phone book updates check box. Click Next 10 times to go to the Support Information page where you can enter the number of your Help desk, if desired. Click Next until you reach the Ready to Build the Service Profile page, select Advanced Customization, and click Next. On the Advanced Customization page, which Figure 3 shows, select Connection Manager from the Section name drop-down list. Select Dialup in the Key name drop-down list and change the Value field from 1 to 0, to disallow dial-up connections. Click Apply, then click Next. CMAK now builds the executable file, which you can then distribute to your users.

End of Article