PS: AutoLaunch Cisco AnyConnect VPN

Description:

Follow this guide to have Anyconnect start after the user signs in on their computer. I couldn’t ever get this to officially work because what it does is “hijack” Windows explorer as the landing pad and runs a batch file instead and essentially holds the desktop hostage unless the user signs into the VPN. The problem is a couple things:

  1. The network stack doesn’t always completely load so sometimes it will throw weird errors.
  2. Sometimes it works perfectly, other times it doesn’t?

DISCLAIMER: This was abandoned because we want to go the official route using Cisco Anyconnect SBL – Start Before Logon. Just fun in a lab.

To Resolve:

1a. So start by creating the following in C:\scripts on a laptop you want to test this with:

c:\scripts\start-vpn\private
c:\scripts\start-vpn\private\helpers.psm1 – See here.

c:\scripts\start-vpn\public
c:\scripts\start-vpn\public\create-info.bat
c:\scripts\start-vpn\public\create-info.ps1
c:\scripts\start-vpn\public\create-sched.bat
c:\scripts\start-vpn\public\create-sched.ps1
c:\scripts\start-vpn\public\startup.bat
c:\scripts\start-vpn\public\startup.ps1
c:\scripts\start-vpn\public\script.bat

2. All the bat files just need:

Except script.bat, it should have:

3. Now populate create-info.ps1:

This is to be ran once, it just saves the username and password to a file in┬ác:\scripts\start-vpn\public\ called “info.dat”. I know, not secure, but this is just testing. We will eventually need to find a way to store in Credential Manager or encrypt somehow.

4. Now populate “create-sched.ps1”:

This just creates a scheduled task at login to run startup.bat.

5. Now we populate startup.ps1:

Modify line 46 to an IP on your internal network. The idea here is to check their connection status and if they are not connected to the internet at all or connected to your internal network – do nothing. If they have internet and are not connected – launch VPN.

We could just stop here, but as I said – sometimes works, sometimes doesn’t. So we go a step further…

6. Modified “startup.ps1”:

This does the same thing, but it will hijack Windows Explorer after the user logs in and instead show a message that they need to connect to the VPN if the conditions of the previous step are met. Lines 20-26 are what hijacks the desktop. They allow the user to the desktop, but change it afterwards to the startup script for the next reboot.
Lines 28-74 are just the function to show the fullscreen message.
Lines 118-125 is the main part – it’s supposed to keep looping until they connect to the VPN. It’s supposed to use the credentials from step 2. You could also look at the Event Viewer here which is how I initially coded it, but it wasn’t as reliable as just a ping to an internal device.

7. Well, as I mentioned, this is as far as I got in my lab – if you are working on this – good luck! Some other resources you could try:

https://gist.github.com/jhorsman/88321511ce4f416c0605

https://community.spiceworks.com/scripts/show/4087-automated-anyconnect-login-script