Managing Microsoft Always On VPN deployments doesn’t have to be complicated. Always On VPN Dynamic Profile Configurator (DPC) is a free, open-source solution that simplifies deploying and managing Always On VPN client configuration settings while extending the capabilities of native deployment methods such as Microsoft Intune VPN profiles, custom XML, and PowerShell scripts.
Whether you’re deploying Always On VPN for the first time or looking to streamline an existing implementation, DPC provides powerful features that make advanced VPN configuration easier to deploy, manage, and maintain.
Join Our Live Webinar
Join me on Tuesday, August 18, at 1:00 PM EDT for a live webinar featuring Leo D’Arcy, creator and lead developer of Always On VPN DPC. During this live session, we’ll demonstrate many of DPC’s latest capabilities and show how they can simplify even the most complex Always On VPN deployments. Topics include:
Configuring flexible VPN deployment strategies
Optimizing interface and route metrics
Dynamically excluding Microsoft 365 and custom domains from the VPN tunnel
Configuring IKE mobility settings for improved roaming
Defining and managing IPv6 routes
Deploying DPC using Active Directory and Microsoft Intune
Exploring additional advanced features and deployment scenarios
Throughout the webinar, we’ll share practical guidance, configuration tips, and real-world examples to help you get the most from Always On VPN DPC.
Register Today
Registration is free, but you must register in advance to attend. If you can’t attend the live session, register anyway, and you’ll receive access to the on-demand recording after the event.
We’ll also reserve time for a live Q&A at the end of the presentation, giving you the opportunity to ask questions directly to the developers and experts behind DPC.
The following new features and improvements are included in the latest release of DPC.
Signed Binaries
Beginning with release v5.4.0, all binaries, including the installer, are digitally signed. This streamlines the installation process and allows DPC to better integrate with application controls.
EAP-TLS
By popular demand, EAP-TLS support has been added as an authentication option in DPC. Historically, DPC strictly adhered to security best practices and only allowed Protected EAP (PEAP). However, many administrators required EAP-TLS to better integrate with non-Microsoft VPN services.
Additional Enhancements
Other changes include better profile change comparison and a new logo. In addition, the DPC ADMX files are now publicly accessible on ADMScope.
Summary
Administrators running earlier versions of DPC are encouraged to upgrade to v5.4.0 as soon as possible.
The Always On VPN Dynamic Profile Configurator (DPC) is a free, open-source solution that helps administrators deploy and manage Always On VPN client configuration settings using Active Directory, Group Policy, or Microsoft Intune. Since version 5.0, DPC has been publicly available and widely adopted. Until now, support has been limited to the community Discord channel. Many organizations, however, require formal support before they can deploy software, even open-source solutions. To meet this need, Leo D’Arcy and I are now offering a commercial support option for DPC.
Why Commercial Support Matters
Enterprises rely on accountability and timely assistance to ensure business-critical services run smoothly. Open source provides flexibility and cost savings, but it often lacks the reliability guarantees companies require. Commercial support bridges that gap—delivering confidence, faster resolutions, and compliance with internal support standards.
Customer Success Story
A UK National Health Service (NHS) Trust, an early customer of the support program, praised the impact of DPC on its remote access strategy. An infrastructure engineer at the NHS trust has this to say about DPC and commercial support:
“We have recently transitioned from SSL VPN to AOVPN and took the opportunity to use DPC to manage our configuration and deployment. We’ve previously experimented with Microsoft’s officially documented process, but DPC really simplifies and streamlines the implementation and management of the AOVPN tunnels.
During rollout, we discovered an issue that caused the user tunnel config to become corrupt. Being able to directly communicate and troubleshoot with Leo and the team meant that we were quickly able to have a fix and a new version of the client ready for deployment.
We are now running DPC and AOVPN on around 4000 endpoints with around 2000 concurrent connections each day. Feedback from users is very positive, and DPC simplifies ongoing management.”
Value Added
This real-world experience highlights the two most significant benefits of DPC with commercial support: rapid issue resolution (direct access to the people who build the software) and confidence at scale (thousands of endpoints, thousands of daily connections).
What DPC Commercial Support Includes
Purchasing a commercial support package provides:
1 year of support services (renewable)
Direct access to Leo D’Arcy, lead developer of DPC
Support from Richard Hicks for DPC-related queries
Enhanced troubleshooting beyond community channels
Prioritized bug fixes
Early consideration for new feature requests
Dedicated private channels for secure communication
Don’t Wait
With a commercial support package, your organization gains expert guidance, faster issue resolution, and direct access to the team that builds and maintains DPC. DPC commercial support ensures smooth deployments, reduced risks, and compliance with internal support requirements
Learn More
Interested in a commercial support contract for Always On VPN DPC? Email us at [email protected] or complete the form below, and we’ll get back to you with more information.
I’m pleased to announce that Always On VPN Dynamic Profile Configurator (DPC) version 5.2.0 is now available. My good friend Leo D’Arcy has been hard at work for the last few months squashing some bugs and adding a few new features to DPC. If you are running a previous release of Always On VPN DPC, either open source or commercial, it’s time to upgrade.
Important!! DPC 5.2.0 has a bug that prevents the service from stopping. This has been addressed in DPC 5.2.1. Guidance for upgrading from DPC 5.2.0 to 5.2.1 can be found here.
Reminder: We’re on Discord. Join the conversation today!
What’s New in DPC 5.2.0
Always On VPN DPC 5.2.0 has some compelling new features.
Exclude Routes from DNS – DPC has a feature that allows administrators to add routes to the routing table using DNS. When this setting is enabled, DPC will attempt to resolve the specified hostname to an IP address and add it to the VPN’s routing table when creating the profile. With 5.2.0, this capability has been extended to exclusion routes, allowing administrators to exclude resources by host name.
Write Event Logs to Disk – This setting allows administrators to optionally write DPC event information to a text file in addition to logging them in the event log. Writing event log information to a text file on disk can make troubleshooting easier in some scenarios.
Delay Profile Updates – This new feature ensures reliable VPN profile creation after group policy updates take place.
Bug Fixes
In addition to new capabilities, Always On VPN DPC 5.2.0 includes fixes for many outstanding issues.
DPC name resolution issue where duplicate IP addresses are returned, resulting in failed route additions when using ‘Allow Routes from DNS’.
Missing events in the DPC operational event log.
Enabling ‘Disable Disconnect Button’ or ‘Disable Advanced Edit Button’ settings results in a profile mismatch warning.
Added resiliency to DPC name resolution when one or more name resolution requests fail.
Group Policy Template
As a reminder, any time there are new features in DPC, there will be corresponding changes to Group Policy administrative template and template language files. Be sure to update your ADMX and ADML files in the group policy central store to take advantage of these new capabilities in DPC 5.2.0.
Recommendation
If you are running any release of Always On VPN DPC, commercial or open source, consider upgrading now to gain access to new features and operational reliability improvements. You can find DPC v5.2.0 on GitHub here.
I’m excited to announce the launch of a brand-new Discord channel dedicated to administrators working with Always On VPN! Whether you’re a seasoned pro or just getting started, this community is designed to be your go-to hub for collaboration, troubleshooting, and staying up to date on all things Always On VPN. The channel was established by my good friend Leo D’Arcy, the creator of the popular Always On VPN Dynamic Profile Generator (DPC) software.
Why Discord?
Always On VPN is a powerful solution for secure, seamless remote connectivity, but managing it comes with its own set of challenges. From configuration quirks to deployment strategies, administrators often need a space to share insights, ask questions, and learn from one another in real time. That’s where our new Discord channel comes in.
Community Forum
Discord offers a dynamic, user-friendly platform for instant communication and community building. Unlike forums or email threads, it’s a place where you can start a conversation, jump into live discussions, share resources, ask questions, share important insights or experiences, and much more.
Channels
Today, the Always On VPN Discord channel is part of the Microsoft Remote Access User Group Discord Server. It consists of multiple channels divided into the following topics.
General – This is a great place to introduce yourself and say hello to everyone!
DPC-Development – Here, you can ask questions about DPC, provide feedback, and suggest new features and functionality.
DPC-Chat – This channel is for administrators to discuss all things DPC, including deployment strategies, operation, support, and more.
Aovpn-Chat – If you’ve deployed Always On VPN but aren’t using DPC, this is your channel! Although DPC is fantastic, not everyone is using it. In this channel, you can submit questions and share general information about Always On VPN.
DirectAccess-Chat – Yes, we realize some of you are still running DirectAccess, so there’s also a channel for you! Feel free to drop in and ask questions here, hopefully about migrating soon. 😉
Who Is This For?
This channel is open to anyone managing Microsoft secure remote access products. Whether you’re an IT administrator in a small business, an enterprise network engineer, or a consultant helping clients stay connected. If you’re working with Microsoft remote access technologies, this is the place to be!
Why Not Reddit?
Funny story: I tried to create an Always On VPN subreddit a few years ago. It lasted one day before it was banned! No reason was given, and I couldn’t get anyone from Reddit to respond. I answer questions ad hoc on Reddit all the time, but there’s no dedicated space for Always On VPN or Microsoft remote access in general.
Explore the other channels, ask questions, give feedback, and share your expertise!
See You There!
Leo and I, along with many other experienced Always On VPN administrators, are on the forums daily. We encourage you to share your expertise, ask questions, and help others along the way. The more we contribute, the stronger this resource becomes for everyone. Join us today!
Always On VPN Dynamic Profile Configurator (DPC) is a software solution that enables administrators to deploy and manage Always On VPN client configuration settings using Active Directory and Group Policy or Microsoft Intune. DPC began life as a commercial product. Recently, DPC has been released to the public via open source. DPC open source allows administrators everywhere to deploy the solution without cost. If you’re not using DPC today, I’d strongly recommend it. If you were previously a DPC commercial customer, you’ll want to migrate to DPC open source soon.
Migrating from DPC commercial to open source requires the administrator to deploy a Group Policy Object (GPO) and client software in a specific order to avoid disruption to end users. Perform the following steps to complete the migration.
GPO Files
Download the DPC v5.0 (open source) group policy settings file (ADMX) file here and the language definition (ADML) file here.
After downloading the files, copy dpc.admx to the following location.
Once complete, allow domain controller replication to finish before deploying DPC group policy settings.
New GPO
Create a new GPO that will contain the VPN client configuration settings. Do NOT copy the original DPC commercial GPO. Starting with a blank GPO is best to ensure proper operation and prevent conflicts. Also, please note the location for DPC settings has changed. The new location for DPC v5.0 settings is:
You can now link the GPO to the applicable OU(s) or complete this task before deploying the new software.
Migration Tool
The easiest way to migrate from DPC commercial to open source is to migrate the settings from the current GPO to a new one. A PowerShell script is available to simplify this task. You can download the Migrate-DpcConfig.ps1 PowerShell script here.
Note: It is not strictly required to migrate your current settings from DPC commercial. Although this migration script makes importing settings easier, nothing prevents you from creating a new GPO for DPC open source and starting from scratch if you wish.
Prerequisites
The PowerShell migration script requires the installation of the Remote Server Administration Tools (RSAT). Specifically, the Group Policy Management tools are needed. Although it’s possible to run this script on a domain controller, it is not recommended. The best practice is to install the RSAT tools on an administrative workstation or server.
You can install the necessary RSAT feature on Windows 11 by opening an elevated PowerShell or command window and running the following command.
On Windows Server, you can install the Group Policy Management tools by opening an elevated PowerShell command window and running the following command.
Install-WindowsFeature -Name GPMC
Once complete, restart the server to complete the installation process.
Import Settings
To migrate the DPC settings, open an elevated PowerShell command window and run the following command.
.\Migrate-DpcSetting.ps1 -PreviousGPOName <name of old DPC GPO> -NewGPOName <name of new DPC GPO>
For example,
.\Migrate-DpcSetting.ps1 -PreviousGPOName ‘Always On VPN DPC’ -NewGPOName ‘Always On VPN DPC – Open Source’
Apply GPO
If not done earlier, link the new DPC open-source GPO to the applicable OU(s). Do NOT unlink or delete the old GPO until all endpoints have been upgraded to the DPC v5.0 client.
Install Software
Once the new GPO has been configured and applied in Active Directory, the next step is to upgrade the DPC commercial client to the DPC open source client (v5.0). Software can be deployed via GPO using Active Directory software installation, SCCM, or any other method you use in your environment to deploy software. No switches or additional parameters are required to perform the upgrade. Simply run the .MSI file on the device, and the upgrade will occur automatically.
Important Note: Administrators must ensure that the new GPO settings are applied to the endpoint before installing the DPC v5.0 client.
Clean Up
After all endpoints have been upgraded to DPC v5.0, administrators can remove the DPC commercial GPO from AD. In addition, the commercial DPC ADMX and ADML files can be removed from domain controllers if desired.
Need Help?
If you’d like assistance migrating DPC commercial to open source, please don’t hesitate to reach out! I’m available to answer questions or provide remote assistance if necessary. You can reach me on the DPC-Chat channel on Discord here. Alternatively, you can fill out the form below, and I’ll provide more information.
The lead developer of DPC and my good friend Leo D’Arcy retained the source code for the product and has been working diligently to decommercialize the software. That work has been completed, and Always On VPN DPC is now available via open source. You can find the source code for DPC on GitHub here.
DPC Features
This initial open-source release (version 5.0.0) contains no significant new features or functionality. Most of the development efforts focused on removing references to PowerON Platforms (registry paths, binary names, etc.).
Support
Today, DPC support is community-based. You can report issues on the GitHub issues page for DPC. In addition, you can ask questions about DPC on Discord in the Microsoft Remote Access UG. Leo and I will monitor the group closely and answer any questions you might have there.
Deployment
If you’re not a DPC user today, I encourage you to have a look at its impressive feature set. Not only does DPC make Always On VPN deployment and management easier, but it also includes many advanced capabilities that will make connections more stable and reliable. Here are some links to articles outlining some of those advanced features.
If you already have a previous commercial release of Always On VPN DPC deployed, migrating to the new open-source DPC is straightforward. You will find guidance for migrating your existing DPC configuration here.
Contribute
Now that DPC is open source, we encourage everyone to contribute. If you have development skills, feel free to help. If you have feedback or feature requests, don’t hesitate to submit them!
Learn More
Are you interested in learning more about Always On VPN DPC? Would you like a personal demonstration of DPC’s features and capabilities? Do you need help migrating from a previous release to the new open-source software? Fill out the form below, and I’ll contact you with more information.
If you’re a follower of this website, you are undoubtedly familiar with PowerON Platforms as I have promoted their products extensively over the years. Dynamic Profile Configurator (DPC) is a clever solution that enables Always On VPN client configuration provisioning and management using Active Directory group policy. They recently introduced a cloud-based centralized reporting solution for organizations with multiple VPN servers. I worked closely with PowerON and influenced many of the features of these great technologies.
Out of Business
Sadly, I learned recently that PowerON Platforms has entered insolvency. Effective October 16, 2024, PowerON Platforms now cease to exist. If you are a current customer of theirs, you likely have received a notification email already.
The Future
Many of my customers have asked what will become of DPC and their cloud-based reporting solution. Here is some additional information.
DPC
Fortunately, DPC will live on through open source. My good friend and primary developer of DPC, Leo D’Arcy, is currently working on refactoring the software to meet open-source specifications. Although I don’t have a timeline for when the software will be available for download, I hope it will be soon.
You can follow the GitHub repository for the open-source DPC here.
If you have a current DPC license, the product should continue to work without issue. You can upgrade to the open-source version of DPC in the future if you choose to. You will likely encounter problems if you use DPC with a trial license. If this happens, contact me directly, and I’ll assist you.
Reporting
The PowerON Platforms Always On VPN reporting solution is dead and will not continue. If you were using this product, I would suggest deleting the resource group you created in Azure for this and the PowerBI application installed for it.
In addition, Always On VPN administrators should remove the reporting agent software from their VPN servers. You can do this on GUI installations using the Add or Remove Programs control panel app.
If you’ve installed the reporting agent on Server Core systems, you can remove it by running the following PowerShell command.
With PowerON Platforms out of business, their products are no longer supported. However, if you have issues with DPC or have any questions, please don’t hesitate to contact me. I’ll provide as much support as I can.
The latest release of PowerON Platforms’Always On VPN Dynamic Profile Configurator (DPC), version 4.3.1, is now available for download. This recent update includes fixes for previously known issues. In addition, it contains some critical new features administrators will find helpful in addressing the challenges they face with Always On VPN client configuration.
What Is DPC?
Always On VPN DPC is a solution to manage Always On VPN client configuration settings. It was originally designed to be used with on-premises Active Directory but can also be deployed with Microsoft Intune. DPC streamlines the configuration and management of client settings and includes many advanced features to fine-tune and optimize Always On VPN.
What’s New in 4.3.1
The following essential features are new in the 4.3.1 release of DPC.
Add Device Tunnel Routes to User Tunnel
Always On VPN administrators can now configure DPC to add device tunnel routes to the user tunnel automatically. This configuration option ensures that all traffic flows of the user tunnel when both user and device tunnels are established.
Note: This feature also requires administrators to define route metric options in DPC. Ensure the user tunnel route metrics are set to a lower value than the device tunnel metrics for proper operation.
Restart RasMan
Always On VPN connections occasionally fail with error 602 (ERROR_PORT_ALREADY_OPEN). The workaround for this is to restart the RasMan service on the endpoint. DPC now supports automatically restarting the RasMan service when this error occurs, ensuring reliable operation for Always On VPN connections.
Machine Certificate Filtering
DPC 4.3.1 now includes a feature to allow administrators to enable machine certificate filtering for Always On VPN device tunnels. This addresses a challenge when the endpoint has multiple machine certificates in its local computer certificate store when the VPN server is configured to accept a certificate with a specific custom application policy (EKU).
Additional Features
In addition, the updated DPC agent core service now run as x64 processes. Also, DPC now supports VPN server FQDNs longer than 63 characters (good news for those using DPC with Azure VPN gateway!).
Download DPC
For those customers currently licensed for Always On VPN DPC you can download the latest release here.
A while back, I wrote about the monitoring and reporting options for Windows Server Routing and Remote Access (RRAS) servers supporting Microsoft Always On VPN. In that article, I outlined how administrators can use the Routing and Remote Access Management console (rrasmgmt.msc) or the Remote Access Management console (ramgmtui.exe) to perform configuration tasks and review current user and device activity. However, neither solution is ideal in a distributed environment with multiple RRAS servers. Thankfully, there’s a new option available to address this crucial limitation today.
Centralized Reporting
I’m excited to announce the availability of a cloud-based, centralized reporting solution for Windows Server RRAS and Always On VPN from the folks at PowerON Platforms. Created by the folks that brought us the Dynamic Profile Configurator (DPC) solution for managing Always On VPN client configuration settings, PowerON Platforms’ new reporting solution allows administrators to aggregate configuration, performance, and user activity data from multiple individual RRAS servers across their organization.
Important! I’ll be joining the folks at PowerON Platforms for a webinar on Thursday, January 18 to introduce and demonstrate this new Always On VPN reporting solution. Register now!
Summary View
The Summary view page provides a consolidated high-level look at the environment’s health status and capacity of VPN servers. Administrators can quickly see if any servers are unhealthy and view current usage details to assess the capacity of the deployment.
Server Overview
The Server Overview page provides a more detailed look at individual server health status and configuration. Here, you’ll find information about the number of active and available connections and the TLS certificate status. In addition, you’ll find detailed information about provisioned CPU and RAM, disk space utilization, and system uptime. You will also see information about the size of the reporting database on disk and the number of IKEv2 and SSTP VPN ports provisioned.
VPN Server Configuration
The VPN Server Configuration page looks into the IP address pool configuration and current utilization. In addition, this page provides an in-depth look at the VPN server TLS certificate health status. Currently, configured authentication and accounting servers are also shown.
Server Performance
The Server Performance page shows granular details about resource utilization on RRAS servers. This includes CPU and memory utilization, disk space usage, and database size. Administrators can view aggregated data or select individual servers. The view can be further customized by filtering by date.
Connection History
The Connection History page details concurrent connections observed on all VPN servers. Data can be filtered by date, individual server, and user or device name.
Client Distribution
The Client Distribution page provides an intuitive graphical display of client activity by server and tunnel type. In addition, it includes details about usage by individual clients and the number of connections made by individual endpoints.
Connection Detail
The Connection Detail page allows administrators to view user activity across all servers in the organization. Once again, data can be filtered by date, individual server, and user or device name. This view provides granular details on user activity, enabling the administrator to drill down to view specific resources accessed over the VPN for individual sessions.
Data Flow
The Data Flow page displays information about data transfer through the VPN server.
Summary
The Always On VPN cloud-based centralized reporting solution for Microsoft Always On VPN by PowerON Platforms is sure to be helpful for organizations managing distributed RRAS server deployments. The reporting solution aggregates data from all RRAS servers in the enterprise, providing a holistic view of configuration, health status, and user activity in one management console. This consolidated visibility is crucial for capacity planning and configuration maintenance, making the identification of performance bottlenecks or misconfigured servers easy. Also, the ability to view certificate expiration status for all servers in the organization is sure to prevent outages. Security administrators will find the solution helpful for forensic reporting and to identify sources of data leakage and exfiltration.
Are you interested in learning more about PowerON Platforms Always On VPN reporting? Would you like an interactive solution demonstration or an evaluation license to trial the product in your environment? Fill out the form below, and I’ll contact you with more details.
