Access Server: Configure "Start Before Logon" (SBL) / "Pre-Logon Access Provider" (PLAP) using OpenVPN GUI

Description: OpenVPN GUI allows you to configure Start Before Logon (SBL) / Pre-Logon Access Provider (PLAP) so you can connect to the VPN before signing in to Windows.

Step by Step

1. Install OpenVPN GUI on your Windows machine.
2. On your taskbar, click to show hidden icons and right-click on OpenVPN GUI.
   
   
3. Press Left-Click on "Settings...":
   
   
4. Enable Pre-Logon Access Provider and click OK.
   
   
5. Download your connection profile (.ovpn file) from your Access Server Client Web UI.
6. Edit your connection profile (.ovpn file) with a text editor and add the below lines:
   

   management 127.0.0.1 12345
   management-hold
   management-query-passwords

   Optional: If you're using TOTP MFA and want to enable TOTP MFA with SBL/PLAP, you need to add this line as well:
   

   auth-retry interact

7. Save the changes.
8. Go to the below path in your Windows:
   

   C:\Program Files\OpenVPN

   
9. Go to the "config-auto" directory:
   
10. Paste there the modified connection profile (.ovpn file):
    
11. Open Powershell with admin privileges and run the below command:
    

    Restart-Service OpenVPNService

12. Open the OpenVPN GUI again, and you should see your connection profile under Persistent Profiles.
    
    
    If this doesn't work, please reboot your Windows PC and check again.

Test

1. Lock your Windows PC or reboot it.
2. You should see this icon from the Windows login page:
   
   
3. Click on that icon.
4. You will see this login prompt with the name of your connection profile:
   
   
5. Click the arrow, and you will be prompted to enter your VPN username and password:
   
   
6. Finally, you're connected to the VPN before you sign in to Windows.

If you have additional questions, please submit a ticket.