Azure VPN Client "Access denied" error

Question

Azure VPN Client "Access denied" error

Hi. I have a problem with an Azure VPN client. One of the users is trying to connect to Azure VPN (using Azure Virtual Network Gateway with AD Login) and getting the "Access denied" error:

This is not related to Azure AD because I can log in to the VPN with his credentials. We ran the diagnostics, all good. The logs showing nothing but "Access denied". We tried to reinstall this app, doesn't work.
I had the same problem but with a different error message, something like "The system cannot find the file specified." Same here, nothing useful in the logs. I've fixed it with a Windows update - not sure if the update helped, but the procedure of updating itself - I think it's reset something. But in this case, there are no updates on the list so we need to do something else.
I wonder what else we can look at?

Thanks.

Answer 1

GitaraniSharma-MSFT 30,141 Microsoft Employee

<<<Resolution Update>>>

Below is the RCA for this issue as updated by the support team:

Issue:

Azure VPN Client (OpenVPN) with AAD fails to connect to Azure with errors: "Access Denied" or "Cannot find file specified".

Cause:

Something changed permissions to HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache and removed access for "NT Service\DnsCache" user group.
This group is used by dnscache service to update DnsClientNrptRule in registry.
Failure to update the registry key leads to the error.

Resolution:

After adding required permissions, VPN Connection was established.
Because issue was observed on several machines, @Alexander Shushanidze wrote a script to fix the problem.
VPN PG has been informed about this issue and they will investigate further and try to fix the issue, if it is caused by VPN Client.

Thanks,
Gita

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Branislav Košík 11 Reputation points

2021-02-12T12:05:02.127+00:00

Hello Gita,

I checked registry permissions and DnsCache group wasn't assigned any access. So I added full control access for DnsCache group to HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache. But it didn't fix the issue.

Can you, or @Alexander Shushanidze share the script to be sure that I set it correctly?

Thank you.
Branislav Košík 11 Reputation points

2021-02-12T12:07:51.247+00:00

Sorry, my fault. I reassigned privileges again and it's working now. I don't know what I messed up for the first time.
GitaraniSharma-MSFT 30,141 Reputation points Microsoft Employee

2021-02-12T12:44:30.413+00:00

@Branislav Košík , thank you for the update, I'm glad to hear that the issue is fixed for you. Please upvote the answer to help others in the community looking for resolution to this issue.

Regards,
Gita

Answer 2

GitaraniSharma-MSFT 30,141 Microsoft Employee

Hello @Alexander Shushanidze ,

From your screenshot, it looks like AAD Token was granted but not accepted by the Server. And you also mentioned that you are able to login to the VPN with the same credentials on your machine. Hence, the cause could be either of the below:

Token was granted but not accepted by the Server means that Server is configured with different AAD Settings. Could you check the AAD settings and confirm that everything is same?
User cannot connect on their machine but their user can connect on another - This can sometimes happen when the clock on the machine has a discrepancy and is either too far ahead or too far behind. To fix the time run the following from an administrative cmd prompt and try again: w32tm /config /syncfromflags:domhier /update net stop w32time net start w32time

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Alexander Shushanidze 41 Reputation points

2020-12-28T07:44:58.47+00:00

Hi @GitaraniSharma-MSFT . We've tried the second option, it didn't work. And I don't quite understand what you mean by different AAD settings - his credentials works on my PC, what can be the difference? Where should I look?
Also, we've noticed that this problems somehow related to NrptRules. We need to modify it in order to get our AzureVPN works with other VPN. We use additional NRPT rule that hides our domain from Azure VPN (because by default it overrides all dns lookups). But even if we return everything to how it was before (by removing the added nrpt rule) it doesn't work anyway. What else can we do now? Thanks.
GitaraniSharma-MSFT 30,141 Reputation points Microsoft Employee

2020-12-29T13:21:35.003+00:00

Hello @Alexander Shushanidze ,

I am trying to understand if the client profile on this user's machine was imported from a working machine or manually added?
Please refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-client#import

If it was manually added, could you please check if all the connection information such as Audience, Issuer, Tenant, FQDN of gateway and ServerSecret are correctly entered?

Thanks,
Gita
Alexander Shushanidze 41 Reputation points

2020-12-31T05:47:27.357+00:00

Hi @GitaraniSharma-MSFT . We're using the same azureconfig file.
GitaraniSharma-MSFT 30,141 Reputation points Microsoft Employee

2021-01-04T08:32:51.547+00:00

Hello @Alexander Shushanidze ,

In that case, it may require deeper investigation. Hence, if you have a support plan, I request you to file a support ticket, else please do let us know, we will try and help you get a one-time free technical support. In this case, could you send an email to azcommunity@microsoft.com referencing this thread as well as your subscription ID. Please mention "ATTN gishar" in the subject field.

Thanks,
Gita
GitaraniSharma-MSFT 30,141 Reputation points Microsoft Employee

2021-01-06T12:12:47.63+00:00

Hello @Alexander Shushanidze ,

Could you please provide an update on this post? As requested above, please do send us an email for further assistance on this issue.

Regards,
Gita
GitaraniSharma-MSFT 30,141 Reputation points Microsoft Employee

2021-01-22T09:37:23.557+00:00

<<Update on this thread>>

We have raised a support request and troubleshooting is in progress to identify the cause of the issue.

I will update the solution once the cause of the issue is identified and a solution is in place.

Thanks,
Gita
Branislav Košík 11 Reputation points

2021-02-11T12:34:19.397+00:00

Hello Gita,

did you solved it? I got the same error "The system cannot find the file specified". I tested it from two other workstations with same config and same credentials and it's working there. Only from one specific machine it is not working.

I would appreciate any help.

Thank you,
Brano
GitaraniSharma-MSFT 30,141 Reputation points Microsoft Employee

2021-02-12T08:12:42.85+00:00

Hello @Branislav Košík ,

I have added the final RCA below in answer section.

Thanks,
Gita
Paul Schuur 1 Reputation point

2021-09-17T17:48:51.937+00:00

Confirmed to be a valid solution for me.

Azure VPN Client "Access denied" error

2 answers

Activity