Always On VPN administrators may be called on to manage individual
user sessions under a number of different conditions.
VPN administrators may have to disconnect users or devices
under a variety of different scenarios.
For example,
you may be doing troubleshooting and you just need to reset
a problematic VPN connection or perhaps an endpoint is lost
or stolen or compromised, maybe it has malware or something to that effect.
And so in those scenarios, you want to not only disconnect users,
but you want to prevent them from accessing later,
and we'll talk about that more shortly.
And of course, administrators have two options to do this.
You can do this using any of the graphical user interfaces,
either the Remote Access Management Console,
or the Routing and Remote Access Management Console,
or the legacy console.
And of course, you can use PowerShell to manage individual user sessions as well.
So let's have a look at managing user sessions using the UI and PowerShell.
So here we are, once again, on our VPN server,
and first,
I want to demonstrate how to disconnect the user using the legacy console.
So once we're in the Remote Access Clients status,
and you'll see that we have our various connected sessions,
disconnecting the user is actually quite simple,
user or device for that matter.
You just simply double‑click on the connection and then choose Disconnect.
Now when I click on this, it's going to disconnect the user,
and more often than not, that user will just simply re‑establish the session.
This is an Always On VPN session so it makes sense that they would reconnect.
So this might be helpful for you in a scenario in which you
have a user with a problematic connection,
maybe it's not working correctly and you just simply want to
kickstart that connection and terminate the session and have it
re‑establish and that works a lot of times.
Another scenario where this might be helpful is,
you know, scenario where you have a load balancer,
you have many connections on a server,
you've taken the server out of the virtual pool on the load balancer,
and now you want to terminate these sessions and force
them to reconnect to another node.
This is a good option to do this as well.
We could also do this in the Remote Access Management Console,
and here it's quite simple.
We'll go to Remote Client Status, highlight an individual user,
and then choose Disconnect VPN clients.
If you needed to prevent a user from connecting, that's actually quite simple.
Before you disconnect them, you just remove them from the security group,
then when you disconnect them,
they'll be forced to re‑authenticate and they will fail that
authentication and so then the user won't be able to connect.
Unfortunately, it's not quite that simple for device‑based connections.
If I were to disconnect the device‑based connection,
it would reconnect automatically because it has a valid certificate.
So in that scenario,
I would first need to revoke the device's certificate on its issuing CA,
publish a new CRL, and then clear the CRL cache on those VPN servers.
Another alternative there would be just simply to put the endpoints or the
device certificate in the untrusted publishers certificate store on the VPN
server and that would prevent them from accessing,
and from there, you can then disconnect their session.
They won't be able to reconnect because they will fail the authentication request when they try to reconnect.