Hello, I work in an internal IT department that has roughly 200 employees throughout the company. From time to time we get users where their VPN certificate crashes and it stops working. I am actually getting very frustrated and need to break down this issue. I need your help with where to start the troubleshooting... What can make the VPN-cert just suddenly stop working and break? Is it because they been out of the office for too long? or because the user uses a certain external network or does something to the computer which causes this error? It doesnt happen to everyone, just a few and usually the same user as well. Info: We have a RRAS server (Windows Server 2019 - Version 1809 (OS Build 17763.5576)). All users have the AD-group "VPN-UserAccess" (Group enabling Always ON VPN for users). Credential Type: Microsoft: Protected EAP (PEAP) A walk around, that sometimes work, have been, to enter "certmgr.msc" and enter "personal certificates" and then remove the "DOMAIN_USER_AUTHENTICATED_SESSION" issued by DOMAIN ENT ROOT CA 01 and then make the user go back the office, connected to the domain network, do an gpupdate /force and a new one has appeared, and it has worked again. But sometimes that doesnt even work, then our only way out is to reinstall the whole computer... Thanks in advance!

Always On VPN Error 812

Vladimir Nuñez 20

Hello,
I work in an internal IT department that has roughly 200 employees throughout the company.
From time to time we get users where their VPN certificate crashes and it stops working.
I am actually getting very frustrated and need to break down this issue.

I need your help with where to start the troubleshooting...

What can make the VPN-cert just suddenly stop working and break? Is it because they been out of the office for too long? or because the user uses a certain external network or does something to the computer which causes this error? It doesnt happen to everyone, just a few and usually the same user as well.

Info:

We have a RRAS server (Windows Server 2019 - Version 1809 (OS Build 17763.5576)).
All users have the AD-group "VPN-UserAccess" (Group enabling Always ON VPN for users).
Credential Type: Microsoft: Protected EAP (PEAP)
A walk around, that sometimes work, have been, to enter "certmgr.msc" and enter "personal certificates" and then remove the "DOMAIN_USER_AUTHENTICATED_SESSION" issued by DOMAIN ENT ROOT CA 01 and then make the user go back the office, connected to the domain network, do an gpupdate /force and a new one has appeared, and it has worked again. But sometimes that doesnt even work, then our only way out is to reinstall the whole computer...

VPN ERROR CODE 2

VPN ERROR CODE 1 NPS

Thanks in advance!

Vladimir Nuñez 20 Reputation points

2024-05-14T07:06:17.5533333+00:00

Any idea just where to start?
Gary Nebbett 6,081 Reputation points

2024-05-16T20:45:08.07+00:00
Hello Vladimir,

If you are prepared to share trace data and the VPN is using IKEv2, you could try the following:

issue the command logman start gary -ets -p "IKEEXT Trace Provider" 0xFFF 4 -o why.etl

attempt to establish the VPN connection

issue the command logman stop gary -ets

share the file why.etl

Gary
Vladimir Nuñez 20 Reputation points

2024-05-17T12:47:37.9133333+00:00

Thanks for a reply!

Some additional information. When entering VPN-settings on the computer, there you can see, when editing the VPN connection which is delivered with GPO, that the type of login method is "Microsoft: Protected EAP (PEAP).

Now to the eventviewer and the errcode. There I could see just one raw, "The user SYSTEM dialed a connection named VPN connection which has failed. The error code returned on failure is 812.
Event ID is 20227. Level: Error. Source: RasClient.

This log-example is from a month ago. Right now I don't have many users to contact. I can try and see if any new show up. Many are on vacation now. In that case, I will make a new trace and send it directly to you @Gary Nebbett

Last but not least. Our walkaround right now is to manually change the VPN connection and authenticate the user against the same vpn server but with a different login method, i.e. username and password. Remove the certificate "User_Authenticated_Session" and run a GP/update and obtain a new certificate, restart the computer and connect again. However, this walk-around does not always work. Any ideas?
Gary Nebbett 6,081 Reputation points

2024-05-17T13:40:23.7766667+00:00

Hello Vladimir,

Speculating about a problem that only occurs infrequently and a work-around that only sometimes works is not very fruitful. Let's wait until some detailed evidence of what is happening becomes available.

Gary

Share via

Always On VPN Error 812

Your answer