Azure VPN Client not working on Windows 11 Domain Joined devices

Question

I've set up an Azure P2S VPN, that uses Azure AD as authentication. Attempting to test it, I immediately get an access denied error on opening the app. It then prevents adding any profiles, either via import or manual, as presumably, it lacks whatever permissions to save the changes

I've tested across a couple of devices, and noted the following:

• Windows 11 personal device works fine
• Windows 11 Domain joined devices get the error. Removing the device from the domain resolves the issue, and it re-occurs when re-joining the device to the domain

Seeing that it only occurs on domain joined devices, I've checked group policy, but I can't see any settings that would be affecting the app. As far as I can tell it's affecting the computer rather than the user, as a local user on the machine gets the error when the device is re-joined too

for clarity, here's what the error looks like. Unfortunately, it being a UWP app it's tricky to make a lot of diagnoses beyond the above. Any ideas?

**Update: error was caused by a policy messing with the permissions of the RasMan service (remote access connection manager), presumably preventing the app from creating new connections etc...

thanks all for the input

Answer 1

Hi @NFrca
The likely cause is DNS.

Review permissions in HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache and add access for the "NT Service\DnsCache" user group.
This group is used by dnscache service to update DnsClientNrptRule in the registry.

Try adding permissions and reconnecting.

Best Regards

Answer 2

Doing some additional testing, blocking GPO inheritance to this machine prevented the error from occurring, so I think the windows 10/11 disparity is a red herring and there is some GPO causing this problem. I will review each setting and report back on what was causing it