When an Always On VPN connection is provisioned to a Windows 10 client, there’s nothing to prevent a user from disconnecting or even deleting the connection. Some administrators have expressed concern about this, fearful that users may disable the VPN to improve performance or circumvent access controls when force tunneling is enabled. Also, administrators may wish to prevent users from accidentally or purposefully making changes to the configuration, or even deleting the connection entirely.
LockDown Mode
To address these concerns, Microsoft included a feature called LockDown mode for Always On VPN. Once enabled, the following conditions apply.
- The LockDown VPN connection is always on.
- The LockDown VPN connection cannot be disabled.
- The user can’t make changes to or delete the LockDown connection.
- No other VPN connections can exist on the client.
- Force tunneling is enabled by default (split tunneling in LockDown mode is not supported).
Challenges with LockDown Mode
Always On VPN LockDown mode brings with it some unique challenges, however. Consider the following.
Limited Protocol Support
LockDown mode only supports IKEv2 and the native (built-in) VPN client. Third-party plug-in provider clients are not supported. IKEv2 is an excellent VPN protocol in terms of security, but operationally speaking it has some serious drawbacks.
Force Tunneling Only
LockDown mode uses force tunneling exclusively. All network traffic must go over the VPN connection. However, if the VPN connection is not available, the client will be unable to access any network resources at all, local or remote.
Captive Portal Issues
LockDown mode prevents clients from connecting to network resources from a network with a captive portal.
On-premises Connectivity
In LockDown mode all network traffic must flow over the VPN tunnel even if the client is on the internal network. This also means that if the VPN server is not reachable internally (unable to resolve public hostname, protocols/ports blocked by internal firewall, unable to route to VPN server, etc.) the client will not be able to access any internal or external network resources at all.
Deleting a LockDown VPN Connection
Deleting a LockDown VPN connection is also challenging. Administrators will find that trying to delete it using the UI or PowerShell often fails. To delete a LockDown Always On VPN connection, use psexec.exe to open an elevated PowerShell command window running in the system context using the following command.
.\psexec.exe -i -s C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
In the new elevated PowerShell window run the following commands to delete the LockDown VPN connection.
$ConnectionName = ‘[LockDown VPN connection name]’
$ConnectionNameEscaped = $ConnectionName -replace ‘ ‘, ‘%20’
$CimInstance = Get-CimInstance -Namespace ‘root\cimv2\mdm\dmmap’ -ClassName ‘MDM_VPNv2_01′ -Filter “ParentID=’./Vendor/MSFT/VPNv2′ and InstanceID=’$ConnectionNameEscaped'”
Remove-CimInstance -CimInstance $CimInstance
Optionally, download and run Remove-LockDownVPN.ps1 here.
Summary
While Always On VPN LockDown mode might seem like a good idea initially, its implementation is heavy-handed and practically speaking ends up causing more problems than it solves. For administrators that plan to enable this feature, carefully consider the drawbacks and limitations outlined above and their impact on supportability and the user experience.
Additional Information
Windows Always On VPN Device Tunnel Config using Microsoft Intune
Windows 10 Always On VPN Security Configuration
Windows 10 Always On VPN Hands-On Training
The Internet Key Exchange version 2 (IKEv2) is the protocol of choice for Always On VPN deployments where the highest level of security is required. Implementing Always On VPN at scale often requires multiple VPN servers to provide sufficient capacity and to provide redundancy. Commonly an Application Delivery Controller (ADC) or load balancer is configured in front of the VPN servers to provide scalability and high availability for Always On VPN.
