Windows Server and the Routing and Remote Access Service (RRAS) is a popular choice for Windows 10 Always On VPN deployments. It is easy to implement and support, offers flexible scalability, and is cost-effective. In addition, it provides support for a TLS-based VPN protocol which is required for many deployments.
Configuration Backup
When deploying RRAS to support Always On VPN, it’s an excellent idea to export the configuration once all settings have been finalized. Often this is done by opening an elevated command window and running netsh.exe ras dump and piping the output to a text file, as shown here.
netsh.exe ras dump > rasconfig.txt
Import Error
Importing a saved configuration is accomplished by opening an elevated command window and running netsh.exe exec [filename], as shown here.
netsh.exe exec rasconfig.txt
Oddly, this doesn’t work by default. The import will fail and return the following error message.
“The following command was not found: ■.”
Root Cause
Importing the RRAS configuration fails because the default configuration output is saved in Unicode format. Inexplicably this encoding is not recognized by netsh.exe when importing the configuration.
Workaround
Follow the steps below to save the configuration file in a format that can be imported using netsh.exe.
1. Open the exported configuration file using notepad.exe.
2. From the Menu bar choose File > Save As.
3. From the Encoding drop-down list choose ANSI.
4. Click Save.
Once complete, import the file using netsh.exe exec [filename]. Restart the RemoteAccess service to apply the changes.
PowerShell
Administrators can use PowerShell to export the RRAS configuration and ensure the correct encoding format is used by default. To do this, open an elevated PowerShell window and run the following command.
Invoke-Command -ScriptBlock {netsh ras dump} | Out-File [filename] -Encoding ASCII
You can also find PowerShell script to import and export RRAS configuration on my Github.
Export-VpnServerConfiguration.ps1
Import-VpnServerConfiguration.ps1
Additional Information
Windows 10 Always On VPN and Windows Server Routing and Remote Access Service (RRAS)
After deploying or upgrading to Windows 10 1903, administrators may find that Windows 10 Always On VPN connections fail to establish successfully. Always On VPN connections continue to work for Windows 10 1809 and earlier clients, however.
When an Always On VPN connection is provisioned to a Windows 10 client, there’s nothing to prevent a user from disconnecting or even deleting the connection. Some administrators have expressed concern about this, fearful that users may disable the VPN to improve performance or circumvent access controls when force tunneling is enabled. Also, administrators may wish to prevent users from accidentally or purposefully making changes to the configuration, or even deleting the connection entirely.
