u/ntuner

I have an RRAS server with separate NPS server onprem trying to configure AOVPN. I’m using public certs for NPS and RRAS and also Entra short-lived certs, root cert is installed on the domain and available to the clients. Entra replaces onprem CA and allows use of conditional access policy.
When the client attempts to connect, it connects to entra and generates a one hour cert in the user cert store. However, the connection fails and not sure where the issue is. I already checked and user cert is valid, has private key and trusts the root, has client authentication. Not much info in NPS logs, it doesn’t appear the client is actually trying to connect. How would I troubleshoot this ?

Error message on the client:
A certificate could not be found that can be used with this Extensible Authentication Protocol. (Error 798)

I’m trying to setup AOVPN with entra conditional access user tunnel and when im creating the policy it’s asking for eap xml. Can someone provide a sample, I’ve been trying various configurations and windows client will not prompt for mfa that’s in the conditional policy. I’m only trying to use user tunnel.
I’ve also tried the custom profile option and used the sample from Richard hicks but this one will error out and not deploy.

Anyone using Zulus v2 LRF with avenge x .25 cal ? Looking for details to enter into the ballistic calculator..

Coming from VMware I’m used to right click and clone vms, this took care of all file naming issues.
Let’s say you have a vm used as a template in hyper v, what are some options to clone it correctly so it has the vm files renamed to the new vm name? Exporting and importing a vm does not rename the vm files or cloning via admin center..

Which vpn would you pick, the free forticlient vpn or Microsoft vpn solution for around 150 users ?

We are a Microsoft shop, M365, hybrid join devices etc. We would like to rely on entra for mfa (hello, secure key) which we use already on the laptops.
Forticlient supports entra integration which is what we were looking at using. But is Microsoft solution better being a Microsoft product and not having to worry about out installing and managing a vpn client ?
Performance wise, is one faster ? Tips, ideas appreciated. Thank you.

Hello,
We decommissioned onprem exchange and moved to m365. We ran the cleanup scrips in AD and created the cname record to point to autodiscover.outlook.com.
All onprem exchange records have been removed and not showing in adsi edit anymore but outlook classic clients take very long to open 5-10min which eventually open.
We tried registry settings to skip looking for SCP records onprem but no change.

Any ideas ?

Edit: I should add deleting profile and creating a new outlook profile fixes the problem. The profile might have been setup to connect directly to onprem exchange

Hello, I need some help with a cancelled account. I have proof it’s been cancelled but it’s not and got billed past due now.