-->
Applies to: Windows 10 version 1709
Always On VPN gives you the ability to create a dedicated VPN profile for device or machine. Always On VPN connections include two types of tunnels:
Use Remote Desktop on your Windows, Android, or iOS device to connect to a Windows 10 PC from afar. Set up the PC you want to connect to so it allows remote connections: Make sure you have Windows 10 Pro. To check, go to Start Settings System About and look for Edition. Download DirectX End-User Runtime Web Installer CloseDirectX End-User Runtime Web Installer On the Windows PC you want to connect to remotely, download the Microsoft Remote Desktop assistant to configure your PC for remote access. Quick Assist is a new app in Windows 10 that enables you to receive or provide assistance over a remote connection. We encourage you to try Quick Assist for a more streamlined, easy-to-use experience. Remote Desktop settings in Windows 10. Microsoft disabled the tool on Windows 10 Home but did not remove it entirely. With a workaround, you can still enable the premium feature reserved for Windows Pro users without buying an expensive license of Windows 10 Pro.
Device tunnel connects to specified VPN servers before users log on to the device. Pre-login connectivity scenarios and device management purposes use device tunnel.
User tunnel connects only after a user logs on to the device. User tunnel allows users to access organization resources through VPN servers.
Unlike user tunnel, which only connects after a user logs on to the device or machine, device tunnel allows the VPN to establish connectivity before the user logs on. Both device tunnel and user tunnel operate independently with their VPN profiles, can be connected at the same time, and can use different authentication methods and other VPN configuration settings as appropriate. User tunnel supports SSTP and IKEv2, and device tunnel supports IKEv2 only with no support for SSTP fallback.
User tunnel is supported on domain-joined, nondomain-joined (workgroup), or Azure AD–joined devices to allow for both enterprise and BYOD scenarios. It is available in all Windows editions, and the platform features are available to third parties by way of UWP VPN plug-in support.
Device tunnel can only be configured on domain-joined devices running Windows 10 Enterprise or Education version 1709 or later. There is no support for third-party control of the device tunnel. Device tunnel does not support using the Name Resolution Policy table (NRPT). Device tunnel does not support Force tunnel. You must configure it as Split tunnel.
Device Tunnel Requirements and Features
You must enable machine certificate authentication for VPN connections and define a root certification authority for authenticating incoming VPN connections.
VPN Device Tunnel Configuration
The sample profile XML below provides good guidance for scenarios where only client initiated pulls are required over the device tunnel. Traffic filters are leveraged to restrict the device tunnel to management traffic only. This configuration works well for Windows Update, typical Group Policy (GP) and Microsoft Endpoint Configuration Manager update scenarios, as well as VPN connectivity for first logon without cached credentials, or password reset scenarios.
Microsoft Remote Desktop Windows 10 Home Download
For server-initiated push cases, like Windows Remote Management (WinRM), Remote GPUpdate, and remote Configuration Manager update scenarios – you must allow inbound traffic on the device tunnel, so traffic filters cannot be used. If in the device tunnel profile you turn on traffic filters, then the Device Tunnel denies inbound traffic. This limitation is going to be removed in future releases.
Sample VPN profileXML
Following is the sample VPN profileXML.
Microsoft Remote Access Windows 10 Clipboard
Depending on the needs of each particular deployment scenario, another VPN feature that can be configured with the device tunnel is Trusted Network Detection.
Deployment and Testing
You can configure device tunnels by using a Windows PowerShell script and using the Windows Management Instrumentation (WMI) bridge. The Always On VPN device tunnel must be configured in the context of the LOCAL SYSTEM account. To accomplish this, it will be necessary to use PsExec, one of the PsTools included in the Sysinternals suite of utilities.
For guidelines on how to deploy a per device (.Device) vs. a per user (.User) profile, see Using PowerShell scripting with the WMI Bridge Provider.
Run the following Windows PowerShell command to verify that you have successfully deployed a device profile:
The output displays a list of the device-wide VPN profiles that are deployed on the device.
Example Windows PowerShell Script
You can use the following Windows PowerShell script to assist in creating your own script for profile creation.
Additional Resources
The following are additional resources to assist with your VPN deployment.
VPN client configuration resources
The following are VPN client configuration resources.
Remote Access Server Gateway resources
The following are Remote Access Server (RAS) Gateway resources.
Important
When using Device Tunnel with a Microsoft RAS gateway, you will need to configure the RRAS server to support IKEv2 machine certificate authentication by enabling the Allow machine certificate authentication for IKEv2 authentication method as described here. Once this setting is enabled, it is strongly recommended that the Set-VpnAuthProtocol PowerShell cmdlet, along with the RootCertificateNameToAccept optional parameter, is used to ensure that RRAS IKEv2 connections are only permitted for VPN client certificates that chain to an explicitly defined internal/private Root Certification Authority. Alternatively, the Trusted Root Certification Authorities store on the RRAS server should be amended to ensure that it does not contain public certification authorities as discussed here. Similar methods may also need to be considered for other VPN gateways.
Windows Remote Assistance lets someone you trust take over your PC and fix a problem from wherever they are.
Before you can use it, you'll need to enable access. In the search box on the taskbar, type remote assistance, and then select Allow Remote Assistance invitations to be sent from this computer from the list of results. Then, on the Remote tab, select the Allow Remote Assistance connections to this computer check box, and then select OK.
Microsoft Remote Access Windows 10
To get help:
In the search box on the taskbar, type remote assistance again and select Invite someone to connect to your PC and help you, or offer to help someone else.
Select Invite someone you trust to help you.
Do one of the following: If you've never used Easy Connect, select Use Easy Connect. If you've used Easy Connect before, select your helper’s contact name. To invite someone who isn't on your contact list, select Invite someone to help you.
Follow the instructions.
To give help if someone has requested it:
Microsoft Remote Access Windows 10 Recovery Environment
Go to the search box and enter remote assistance, then select Invite someone to connect to your PC and help you, or offer to help someone else.
Select Help someone who has invited you.
Do one of the following: If you’re using Easy Connect for the first time, select Use Easy Connect. Or, if you’ve used Easy Connect before, select the contact name of the person you want to help. To help someone not on the list, tap or click Help someone new.
Follow the instructions.
Microsoft Remote Desktop Windows 10 Android
You can also use Quick Assist to give and receive remote assistance.