So let's move on with the next demonstration,
and we'll enable the Name Resolution Policy Table.
So here in the Endpoint Manager admin center,
I'm going to click on our Always On VPN User Tunnel that we
created previously using the VPN profile type.
And here I'm going to scroll down to the Configuration settings and click edit,
and you'll find the NRPT settings under the DNS section.
So we'll expand DNS Settings,
and here you'll see that we already have our DNS suffix defined.
But in this case, the NRPT has not been configured.
So I'm going to go ahead and add a rule by clicking Add,
and here I'm going to specify a domain name.
And you'll notice that I included a leading dot.
So if I were just to put in lab.richardhicks.net,
even though that's my internal namespace,
this is technically speaking a hostname.
If I add the leading dot, or the preceding dot,
this now delineates this as a namespace.
So anything in the .lab.richardhicks.net namespace would apply to this rule,
and then I would supply my VPN servers here,
so I'll do that now.
And you can supply more than one DNS server, of course.
I just have one in my lab, so I'm going to leave it at that.
Here is where you would define that proxy server setting.
Again, this is only going to be used if you're using Internet Explorer.
IE is the only browser that will recognize this setting.
All other browsers will simply ignore it.
So if you want, you can put a proxy server here,
but it's probably not going to be of much help for you.
We'll leave the Automatically Connect setting to Not configured because this is
really only applicable for non‑Always On VPN connections.
Our Always On VPN connection is, of course, always on.
And there's no need to make this persistent.
I leave this Not configured.
If you set this to persistent,
this policy will remain in place when the VPN is not connected,
and that's not the behavior that we want.
We only want this behavior to be enabled when the VPN tunnel is established.
So we'll click Save, and then we'll review and save our configuration.
Save it.
And that's it.
The profile has been saved.
And at this point, the clients will get an updated configuration at some point,
and you'll be able to see that.
So let's go take a look at what that looks like on the endpoint.
So once the endpoint has synchronized with Intune and
gotten the new updated policy configuration,
let's take a quick look and see what that looks like.
So if I run Get‑NetIPConfiguration on my endpoint, the one thing
you'll notice is that for our Always On VPN interface,
the DNS server here is still showing as 172.16.0.200, which is the DNS
server assigned to the internal interface of our VPN server.
So it's important to know that the Name Resolution Policy Table does not
overwrite this setting. The VPN adapter still has the setting or the DNS
server that was given to it by the VPN server.
However,
the Name Resolution Policy Table simply overrides
this, so let's take a look at that.
So the PowerShell command to view the Name Resolution Policy Table
is Get‑DnsClientNrptPolicy, and you'll see it returns a bunch of
information. If we scroll to the top,
you'll see here is our defined namespace. This is what we
defined in the configuration. And you'll see now that our name
server here is listed as 172.16.0.222, which is what we did in the demonstration.
So in this scenario,
even though the VPN interface has a DNS server of 172.16.0.200, any name
queries for names in this namespace will be sent to this very specific DNS
server. You'll also notice that Windows adds a few different entries here
for LDAP, ISATAP, and WPAD and so forth.
And this is added by default just to kind of make sure that if the
administrator has defined a specific DNS server for a namespace, it's likely
that that namespaces also going to be used for other things,
other system services and things like that.
So that's added for you by default. You don't have to
go and add those things yourself.
If you're interested in deploying these settings,
the Name Resolution Policy Table settings, using XML,
you'll include the code shown here in your XML. Let me
demonstrate that for you real quick.
So let's open our XML file here.
And just to show you where this setting is defined here,
it is in the DomainNameInformation element.
Again,
you can find this in the VPNv2 CSP reference, but here I've
included the element DomainNameInformation,
the DomainName, and the DnsServers.
You can use multiple domain names, but they should
be defined as separate elements.
And so what that would look like was more than one of these blocks.
If you have another domain to add,
it would be another DomainNameInformation, DomainName
corp.richardhicks.net, the DnsServers /DomainName.
So you could have multiple blocks here.
If you need to add multiple DNS servers, you can do that.
That's a comma‑separated list. So I would just simply add another DNS server if I needed to do so.