Overview
A connection profile (.ovpn file) can be downloaded using any of the following methods:
From the Admin Web UI (administrators only).
From the Client Web UI.
By using the Import URL feature in OpenVPN Connect.
In enterprise environments, this process can be time-consuming when provisioning many users. This script automates downloading and importing connection profiles, making it suitable for MDM deployments.
Prerequisites
An Access Server installation.
A Windows machine with PowerShell.
OpenVPN Connect installed.
MDM solution (optional).
Step 1: Save and personalize the script
- Copy the script below.
- Save it as
install_vpn_windows_v1.ps1. - Update the
$Servervariable in the script with your Access Server IP.
Script
# Usage: .\install_vpn_windows_v1.ps1 -Username user -Password password [-SkipSSLVerification] [-Autologin]
param([string]$Username="",[string]$Password="",[switch]$SkipSSLVerification,[switch]$Autologin)
if (-not $Username -or -not $Password) { Write-Error "Usage: .\install_vpn_windows_v1.ps1 -Username <user> -Password <password> [-SkipSSLVerification] [-Autologin]"; exit 1 }
$Server = "203.0.113.26:943"
$ConnectExe = @("$env:ProgramFiles\OpenVPN Connect\OpenVPNConnect.exe","${env:ProgramFiles(x86)}\OpenVPN Connect\OpenVPNConnect.exe") | ?{Test-Path $_} | Select -First 1
if (-not $ConnectExe) { Write-Error "OpenVPN Connect is not installed. Download it from https://openvpn.net/client/"; exit 1 }
$TempFile = "$env:TEMP\$Username.ovpn"
$Base64 = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("${Username}:${Password}"))
$Endpoint = if ($Autologin) { "GetAutologin" } else { "GetUserlogin" }
$WRArgs = @{ Uri="https://$Server/rest/$Endpoint"; Headers=@{Authorization="Basic $Base64"}; OutFile=$TempFile; ErrorAction='Stop' }
if ($SkipSSLVerification) {
Write-Host "SSL verification disabled." -ForegroundColor Yellow
if ($PSVersionTable.PSVersion.Major -ge 6) { $WRArgs.SkipCertificateCheck = $true }
else {
Add-Type @"
using System.Net; using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy { public bool CheckValidationResult(ServicePoint s, X509Certificate c, WebRequest r, int e) { return true; } }
"@
[Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
}
} else { [Net.ServicePointManager]::CertificatePolicy = $null }
Write-Host "Downloading VPN profile for '$Username'..."
try { Invoke-WebRequest @WRArgs } catch {
Write-Error "Failed to download profile: $_"
if (-not $SkipSSLVerification) { Write-Host "If your server uses a self-signed certificate, try -SkipSSLVerification." -ForegroundColor Yellow }
Remove-Item $TempFile -ErrorAction SilentlyContinue
exit 1
}
Write-Host "Importing profile into OpenVPN Connect..."
if (-not (Get-Process -Name "OpenVPNConnect" -ErrorAction SilentlyContinue)) {
Start-Process -FilePath $ConnectExe -ArgumentList @("--minimize","--accept-gdpr","--skip-startup-dialogs") | Out-Null
Start-Sleep -Seconds 3
}
$Process = Start-Process -FilePath $ConnectExe -ArgumentList @("--import-profile=`"$TempFile`"","--username=`"$Username`"") -PassThru
$Process.WaitForExit(5000) | Out-Null
Remove-Item $TempFile -ErrorAction SilentlyContinue
if ($Process.HasExited -and $Process.ExitCode -ne 0) { Write-Error "OpenVPN Connect returned an error (code $($Process.ExitCode))."; exit 1 }
Write-Host "Done. The VPN profile for '$Username' was successfully installed in OpenVPN Connect."
Step 2: Run the script to download and import a connection profile
- Open PowerShell.
- Navigate to the directory where the script is saved.
- Run one of the following commands to download a profile:
User-locked profile:
.\install_vpn_windowsv1.ps1 -Username <username> -Password <password>
Auto-login profile (optional):
.\install_vpn_windowsv1.ps1 -Username <username> -Password <password> -Autologin
Skip SSL verification (optional):
.\install_vpn_windowsv1.ps1 -Username user -Password password -SkipSSLVerification
Tip: Use this option when you don't have a valid web SSL certificate for your Access Server.
Step 3: (Optional) Use with MDM
When used with an MDM solution (such as Microsoft Intune), the script supports silent execution when -Username and -Password parameters are provided.
- Administrators supply credentials through the MDM platform.
- The script executes on the device without user interaction.
Note: This script isn't compatible with SAML authentication.
Troubleshooting
PowerShell execution policy error
If you see this error:
install_vpn_windows_v1.ps1 cannot be loaded because running scripts is disabled on this system
This means that running scripts via PowerShell is disabled by default. To temporarily turn it on so you can test/run the script, you can run this command:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
Then run the script again.
Need help?
If you have additional questions, please submit a ticket.
Comments
0 comments
Please sign in to leave a comment.