The entire process that is described here [http://youtu.be/DxQaVf8iAJk|can be watched at youtube here].

These days a lot of users do not work as privileged user, they do not have administrative rights on their computers. If such a user needs to establish an OpenVPN connection (OpenVPN and OpenVPN-GUI are already installed) the connection will be established but the necessary routes are not set. Setting routes in Windows has some requirements:

Note: Since Windows 7 being **only** a member of the **"Network Configuration Operators"** group **is not enough** to be able to set routes.

There are some OpenVPN-Clients that are able to establish connections and setting routes without administrative privileges but they are either unstable [[http://sourceforge.net/projects/securepoint/|SecurePoint SSL VPN]]) or do not have all necessary features ([[http://openvpn-mi-gui.inside-security.de/|OpenVPN MI GUI]]). They both use a service (running as administrator) and communicate with the service from user mode. But sometimes your configuration does not allow "service mode" and so you are stuck.

Add the non privileged user (e.g. bob) to the group

You can do this with the following command

and OpenVPN-GUI will perfectly work without administrative privileges.

In July 2013 I had an idea. Why not creating a scheduled task at logon of any user that **automatically** creates another Scheduled Task for the non privileged user that is currently logging on. This **automatically** created task will put the user in the group "Network Configuration Operators" and then start OpenVPN GUI **automatically** at the next logon of this (non privileged) user (with highest privileges).

You need to walk through some small steps to achieve this goal.

Please verify the variable **TOSTART** at the beginning of the script. It must represent the physical location of **create_usertask.cmd** (our second script).

Take a look at the beginning of the script and change the variables **NGROUP** and **TOSTART** to your localized version of the **Network Configuration Operators** group and your location of **openvpn-gui.exe**.

Do a default installation of OpenVPN-GUI and also copy the necessary connection profiles to the target machine. ** Do this as administrative user. **

Start OpenVPN-GUI once as an administrative user. This will create the following registry key:

Close OpenVPN-GUI. Open the registry editor (regedit.exe) and take a look at this registry key:

By default it points to

This folder is not writeable by nonprivileged users, so they will get error messages when connecting.

Just change it to

With this change, a nonprivileged user logs to his personal temp folder, e.g.

Create the folder

and copy the above 2 script files

to this directory. ** Please double-check and make sure, that this files cannot be changed by non-privileged users! **

Use explorer.exe and jump to the directory where you stored the 2 scripts from above, usually

Right-click **create_main_task_only_runonce.cmd** and select **Run as administrator**. A command prompt will open and ask you for the password of the administrative account. Enter it correctly.


If everything went right, you have now a new scheduled task in the **Task Scheduler Library** with the name


It is setup to run

**Verify the automated generation of this task**.

We now change the shortcut(s) that start OpenVPN to a different target.They are usually located here:

Change all shortcuts to the following settings (via properties).


The rest of the settings can be left to their defaults.

Logon as a nonprivileged user, let's assume, the username is **user1** and he is logging on to machine **win7x64-vm**. The following will happen.

The "main" scheduled task **OpenVPN Logon Task Creator (main)** will run. It will programmatically


Since we changed the target for the OpenVPN-GUI shortcuts, the user can now already click the OpenVPN-GUI desktop icon, which will then run the scheduled task **win7x64_user1_openvpn** on demand. **win7x64_user1_openvpn** will then execute **openvpn-gui.exe** in the users context but with **highest privileges**.

There are 2 registry keys, that are dangerous and can allow the user to open an administrative prompt on the machine. They are

When using my method and click on ** View Log ** or ** Edit config **, by default notepad.exe will open (and of course) with highest privileges. To fix this, you should change the registry to an executable (you created), that shows an error message. I did this with a small AutoIT-Script, that does exactly that. I called it

The source is added to this Wiki page as

** Without this change your installation is vulnerable and normal users can get an elevated command prompt, so absolutely change this registry keys!!!! **

So I additionally changed the registry for OpenVPN-GUI to

Here is a screenshot:


When notallowed.exe is executed it just shows this message:


Since the **main** task has already run previously, it will **NOT** recreate the users personal scheduled task. - It does nothing.

Since the **user** task **win7x64_user1_openvpn** was present at logon, it get's executed and starts **openvpn-gui.exe**. So after the user logged in, he/she has the OpenVPN-GUI running in the system tray and is ready to establish connections **without administrative privileges**

My personal opinion is, that this is a nice workaround for the **nonprivileged user problem**. It can easily be deployed, it is **Open Source** and you can change it to your needs. If you use, change or blog it, please keep a line in your code, that refers to me (Der PCFreak) and my Blog ([http://blog.pcfreak.de]).

If I have time, I will add some screenshots and I am planning to create a video on Youtube, that shows exactly how it works.

Since this was the first time I posted to this Wiki, I hope I made no mistakes and no errors.

Thank you for reading!