# OpenVPN as non privileged user **NOTE: this article is outdated. It has been possible for years to run OpenVPN-GUI as a normal Windows user without admin-level privileges.** The entire process that is described here [http://youtu.be/DxQaVf8iAJk|can be watched at youtube here]. These days a lot of users do not work as privileged user, they do not have administrative rights on their computers. If such a user needs to establish an OpenVPN connection (OpenVPN and OpenVPN-GUI are already installed) the connection will be established but the necessary routes are not set. Setting routes in Windows has some requirements: ``` ---------------------------------------- | Operating System | ADM | NCO | RHP | ---------------------------------------- | Windows XP | X | | | ---------------------------------------- | Windows XP | | X | | ---------------------------------------- | Windows 7 | X | | | ---------------------------------------- | Windows 7 | | X | X | ---------------------------------------- | Windows 8 | X | | | ---------------------------------------- | Windows 8 | | X | X | ---------------------------------------- ``` ``` RHP = run with highest privileges but in context of a non-administrative user ADM = Member of group "Administrators" NCO = Member of group "Network Configuration Operators" ``` Note: Since Windows 7 being **only** a member of the **"Network Configuration Operators"** group **is not enough** to be able to set routes. There are some OpenVPN-Clients that are able to establish connections and setting routes without administrative privileges but they are either unstable [[http://sourceforge.net/projects/securepoint/|SecurePoint SSL VPN]]) or do not have all necessary features ([[http://openvpn-mi-gui.inside-security.de/|OpenVPN MI GUI]]). They both use a service (running as administrator) and communicate with the service from user mode. But sometimes your configuration does not allow "service mode" and so you are stuck. ## Solution for Windows XP Add the non privileged user (e.g. bob) to the group ``` Network Configuration Operators ``` You can do this with the following command ``` net localgroup "Network Configuration Operators" bob /add ``` and OpenVPN-GUI will perfectly work without administrative privileges. **This solution does no longer work with Windows 7 and above.** ## New and working solution for Windows 7 (and above) In July 2013 I had an idea. Why not creating a scheduled task at logon of any user that **automatically** creates another Scheduled Task for the non privileged user that is currently logging on. This **automatically** created task will put the user in the group "Network Configuration Operators" and then start OpenVPN GUI **automatically** at the next logon of this (non privileged) user (with highest privileges). You need to walk through some small steps to achieve this goal. ### 2 scripts that help us #### Script 1 create_main_task_only_runonce.cmd ``` @ECHO OFF CLS REM Detect current user (should be an administrator) SET USER=%USERNAME% SET DOM=%USERDOMAIN% SET ACCOUNT=%DOM%\%USER% SET TASKNAME=OpenVPN Logon Task Creator (main) REM Where to store the created XML-File SET XML=%temp%\%RANDOM%_temp.xml REM What to start via the generated task SET TOSTART=C:\ProgramData\OpenVPN\create_usertask.cmd ECHO ^<?xml version="1.0" encoding="UTF-16"?^> > "%XML%" ECHO ^<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"^> >> "%XML%" echo. ^<RegistrationInfo^> >> "%XML%" echo. ^<Date^>2001-01-01T01:01:01.01^</Date^> >> "%XML%" echo. ^<Author^>Der PCFreak^</Author^> >> "%XML%" echo. ^<Description^>This task will be executed at logon of any user. The script will then determine the username and domain/computer of this user. The user will then added to the group "Network Configuration Operators" and additionally a new scheduled task with name "%DOM%_%USER%_openvpn" will be created. The automatically created task will be set up to only run when the specific, detected user logs on. This task will then start OpenVPN-GUI with highest privileges at logon.^</Description^> >> "%XML%" echo. ^</RegistrationInfo^> >> "%XML%" echo. ^<Triggers^> >> "%XML%" echo. ^<LogonTrigger^> >> "%XML%" echo. ^<StartBoundary^>2001-01-01T01:01:01^</StartBoundary^> >> "%XML%" echo. ^<Enabled^>true^</Enabled^> >> "%XML%" echo. ^</LogonTrigger^> >> "%XML%" echo. ^</Triggers^> >> "%XML%" echo. ^<Principals^> >> "%XML%" echo. ^<Principal id="Author"^> >> "%XML%" echo. ^<UserId^>%ACCOUNT%^</UserId^> >> "%XML%" echo. ^<LogonType^>Password^</LogonType^> >> "%XML%" echo. ^<RunLevel^>HighestAvailable^</RunLevel^> >> "%XML%" echo. ^</Principal^> >> "%XML%" echo. ^</Principals^> >> "%XML%" echo. ^<Settings^> >> "%XML%" echo. ^<MultipleInstancesPolicy^>IgnoreNew^</MultipleInstancesPolicy^> >> "%XML%" echo. ^<DisallowStartIfOnBatteries^>false^</DisallowStartIfOnBatteries^> >> "%XML%" echo. ^<StopIfGoingOnBatteries^>false^</StopIfGoingOnBatteries^> >> "%XML%" echo. ^<AllowHardTerminate^>true^</AllowHardTerminate^> >> "%XML%" echo. ^<StartWhenAvailable^>false^</StartWhenAvailable^> >> "%XML%" echo. ^<RunOnlyIfNetworkAvailable^>false^</RunOnlyIfNetworkAvailable^> >> "%XML%" echo. ^<IdleSettings^> >> "%XML%" echo. ^<StopOnIdleEnd^>true^</StopOnIdleEnd^> >> "%XML%" echo. ^<RestartOnIdle^>false^</RestartOnIdle^> >> "%XML%" echo. ^</IdleSettings^> >> "%XML%" echo. ^<AllowStartOnDemand^>true^</AllowStartOnDemand^> >> "%XML%" echo. ^<Enabled^>true^</Enabled^> >> "%XML%" echo. ^<Hidden^>false^</Hidden^> >> "%XML%" echo. ^<RunOnlyIfIdle^>false^</RunOnlyIfIdle^> >> "%XML%" echo. ^<WakeToRun^>false^</WakeToRun^> >> "%XML%" echo. ^<ExecutionTimeLimit^>P3D^</ExecutionTimeLimit^> >> "%XML%" echo. ^<Priority^>7^</Priority^> >> "%XML%" echo. ^</Settings^> >> "%XML%" echo. ^<Actions Context="Author"^> >> "%XML%" echo. ^<Exec^> >> "%XML%" echo. ^<Command^>"%TOSTART%"^</Command^> >> "%XML%" echo. ^</Exec^> >> "%XML%" echo. ^</Actions^> >> "%XML%" echo ^</Task^> >> "%XML%" REM Create the task using schtasks REM use /f to make sure we can re-create this task on demand %windir%\system32\schtasks.exe /create /TN "%TASKNAME%" /XML "%XML%" /RU %ACCOUNT% /RP "" /F REM Delete temporary XML FILE DEL /Q "%XML%" ``` Please verify the variable **TOSTART** at the beginning of the script. It must represent the physical location of **create_usertask.cmd** (our second script). #### Script 2 create_usertask.cmd ``` @ECHO OFF CLS REM Some Variables REM Where to store the created XML-File SET XML=%temp%\%RANDOM%_temp.xml REM Name of the Network Configuration Operators group (without quotes) SET NGROUP=Network Configuration Operators REM What to start via the generated task SET TOSTART=C:\Program Files\OpenVPN\bin\openvpn-gui.exe REM We need to find the domain/computer and username of the user that is logging on REM We run under a different user context so we need a trick to do that REM Session to search, usually "console" SET SESSION=console REM Process to search, usually "explorer.exe" SET PROCESS=explorer.exe for /f "usebackq tokens=8,9 delims=\ " %%a IN (`tasklist /fi "SESSIONNAME eq %SESSION%" /FI "IMAGENAME eq %PROCESS%" /V /NH`) do ( SET DOM=%%a SET USER=%%b SET ACCOUNT=%%a\%%b ) echo The detected user was %USER% in domain/computer %DOM% . ECHO ^<?xml version="1.0" encoding="UTF-16"?^> > "%XML%" ECHO. ^<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"^> >> "%XML%" ECHO. ^<Settings^> >> "%XML%" ECHO. ^<MultipleInstancesPolicy^>StopExisting^</MultipleInstancesPolicy^> >> "%XML%" ECHO. ^<DisallowStartIfOnBatteries^>false^</DisallowStartIfOnBatteries^> >> "%XML%" ECHO. ^<StopIfGoingOnBatteries^>false^</StopIfGoingOnBatteries^> >> "%XML%" ECHO. ^<AllowHardTerminate^>true^</AllowHardTerminate^> >> "%XML%" ECHO. ^<StartWhenAvailable^>false^</StartWhenAvailable^> >> "%XML%" ECHO. ^<RunOnlyIfNetworkAvailable^>false^</RunOnlyIfNetworkAvailable^> >> "%XML%" ECHO. ^<IdleSettings^> >> "%XML%" ECHO. ^<StopOnIdleEnd^>true^</StopOnIdleEnd^> >> "%XML%" ECHO. ^<RestartOnIdle^>false^</RestartOnIdle^> >> "%XML%" ECHO. ^</IdleSettings^> >> "%XML%" ECHO. ^<AllowStartOnDemand^>true^</AllowStartOnDemand^> >> "%XML%" ECHO. ^<Enabled^>true^</Enabled^> >> "%XML%" ECHO. ^<Hidden^>false^</Hidden^> >> "%XML%" ECHO. ^<RunOnlyIfIdle^>false^</RunOnlyIfIdle^> >> "%XML%" ECHO. ^<DisallowStartOnRemoteAppSession^>false^</DisallowStartOnRemoteAppSession^> >> "%XML%" ECHO. ^<UseUnifiedSchedulingEngine^>false^</UseUnifiedSchedulingEngine^> >> "%XML%" ECHO. ^<WakeToRun^>false^</WakeToRun^> >> "%XML%" ECHO. ^<ExecutionTimeLimit^>PT0S^</ExecutionTimeLimit^> >> "%XML%" ECHO. ^<Priority^>7^</Priority^> >> "%XML%" ECHO. ^</Settings^> >> "%XML%" ECHO. ^<Actions Context="Author"^> >> "%XML%" ECHO. ^<Exec^> >> "%XML%" ECHO. ^<Command^>"%TOSTART%"^</Command^> >> "%XML%" ECHO. ^</Exec^> >> "%XML%" ECHO. ^</Actions^> >> "%XML%" ECHO. ^<RegistrationInfo^> >> "%XML%" ECHO. ^<Date^>2013-07-11T11:39:44.2138665^</Date^> >> "%XML%" ECHO. ^<Author^>Der PCFreak^</Author^> >> "%XML%" echo. ^<Description^>This task will run when the user %ACCOUNT% logs on. It will then start OpenVPN-GUI with in the context of this user with highest privileges at logon of this user.^</Description^> >> "%XML%" ECHO. ^</RegistrationInfo^> >> "%XML%" ECHO. ^<Principals^> >> "%XML%" ECHO. ^<Principal id="Author"^> >> "%XML%" ECHO. ^<UserId^>%ACCOUNT%^</UserId^> >> "%XML%" ECHO. ^<LogonType^>InteractiveToken^</LogonType^> >> "%XML%" ECHO. ^<RunLevel^>HighestAvailable^</RunLevel^> >> "%XML%" ECHO. ^</Principal^> >> "%XML%" ECHO. ^</Principals^> >> "%XML%" ECHO. ^<Triggers^> >> "%XML%" ECHO. ^<LogonTrigger^> >> "%XML%" ECHO. ^<Enabled^>true^</Enabled^> >> "%XML%" ECHO. ^<UserId^>%ACCOUNT%^</UserId^> >> "%XML%" ECHO. ^</LogonTrigger^> >> "%XML%" ECHO. ^</Triggers^> >> "%XML%" ECHO. ^</Task^> >> "%XML%" REM Create the task using schtasks REM do not use /f since we only want to create this task once! %windir%\system32\schtasks.exe /create /xml "%XML%" /tn "%DOM%_%USER%_openvpn" /DELAY 0000:25 REM Add the user to the Network Configuration Operators group net localgroup "%NGROUP%" %ACCOUNT% /add REM Delete temporary XML FILE DEL /Q "%XML%" ``` Take a look at the beginning of the script and change the variables **NGROUP** and **TOSTART** to your localized version of the **Network Configuration Operators** group and your location of **openvpn-gui.exe**. ### Install OpenVPN-GUI Do a default installation of OpenVPN-GUI and also copy the necessary connection profiles to the target machine. ** Do this as administrative user. ** ### Prepare and fix Registry Keys Start OpenVPN-GUI once as an administrative user. This will create the following registry key: ``` HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI ``` Close OpenVPN-GUI. Open the registry editor (regedit.exe) and take a look at this registry key: ``` HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\log_dir ``` By default it points to ``` C:\Program Files\OpenVPN\log ``` This folder is not writeable by nonprivileged users, so they will get error messages when connecting. Just change it to ``` %temp%\OpenVPN\log ``` With this change, a nonprivileged user logs to his personal temp folder, e.g. ``` C:\Users\user1\AppData\Local\Temp\OpenVPN\log ``` ### Copy script files to target Create the folder ``` C:\Programdata\OpenVPN ``` and copy the above 2 script files ``` create_usertask.cmd create_main_task_only_runonce.cmd ``` to this directory. ** Please double-check and make sure, that this files cannot be changed by non-privileged users! ** ### Setup the main task Use explorer.exe and jump to the directory where you stored the 2 scripts from above, usually ``` C:\ProgramData\OpenVPN ``` Right-click **create_main_task_only_runonce.cmd** and select **Run as administrator**. A command prompt will open and ask you for the password of the administrative account. Enter it correctly.  If everything went right, you have now a new scheduled task in the **Task Scheduler Library** with the name ``` OpenVPN Logon Task Creator (main) ```  It is setup to run ``` with the administrators account with highest privileges at logon of any user executing C:\Programdata\OpenVPN\create_usertask.cmd ``` **Verify the automated generation of this task**. ### Change OpenVPN-GUI shortcut We now change the shortcut(s) that start OpenVPN to a different target.They are usually located here: ``` C:\Users\Public\Desktop\OpenVPN GUI.lnk C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\OpenVPN\OpenVPN GUI.lnk ``` Change all shortcuts to the following settings (via properties). ``` Target: %windir%\System32\schtasks.exe /RUN /TN "%USERDOMAIN%_%USERNAME%_openvpn" Icon : C:\Program Files\OpenVPN\icon.ico (or any other icon you like) ```  The rest of the settings can be left to their defaults. ## Test it! Logon as a nonprivileged user, let's assume, the username is **user1** and he is logging on to machine **win7x64-vm**. The following will happen. ### First logon #### Main scheduled task will execute The "main" scheduled task **OpenVPN Logon Task Creator (main)** will run. It will programmatically ``` add user1 to the localgroup "Network Configuration Operators" create a userspecific scheduled task with the name win7x64_user1_openvpn ```  Since we changed the target for the OpenVPN-GUI shortcuts, the user can now already click the OpenVPN-GUI desktop icon, which will then run the scheduled task **win7x64_user1_openvpn** on demand. **win7x64_user1_openvpn** will then execute **openvpn-gui.exe** in the users context but with **highest privileges**. ### Security related information There are 2 registry keys, that are dangerous and can allow the user to open an administrative prompt on the machine. They are ``` HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\editor and HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\log_viewer ``` When using my method and click on ** View Log ** or ** Edit config **, by default notepad.exe will open (and of course) with highest privileges. To fix this, you should change the registry to an executable (you created), that shows an error message. I did this with a small AutoIT-Script, that does exactly that. I called it ``` notallowed.exe ``` The source is added to this Wiki page as ``` notallowed.au3 ``` ** Without this change your installation is vulnerable and normal users can get an elevated command prompt, so absolutely change this registry keys!!!! ** So I additionally changed the registry for OpenVPN-GUI to ``` Key : HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI Name : editor Value: C:\ProgramData\OpenVPN\notallowed.exe Key : HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI Name : log_viewer Value: C:\ProgramData\OpenVPN\notallowed.exe ``` Here is a screenshot:  When notallowed.exe is executed it just shows this message:  ### Future logons #### Main scheduled task will execute Since the **main** task has already run previously, it will **NOT** recreate the users personal scheduled task. - It does nothing. #### User task will execute Since the **user** task **win7x64_user1_openvpn** was present at logon, it get's executed and starts **openvpn-gui.exe**. So after the user logged in, he/she has the OpenVPN-GUI running in the system tray and is ready to establish connections **without administrative privileges** ## Summary My personal opinion is, that this is a nice workaround for the **nonprivileged user problem**. It can easily be deployed, it is **Open Source** and you can change it to your needs. If you use, change or blog it, please keep a line in your code, that refers to me (Der PCFreak) and my Blog ([http://blog.pcfreak.de]). If I have time, I will add some screenshots and I am planning to create a video on Youtube, that shows exactly how it works. Since this was the first time I posted to this Wiki, I hope I made no mistakes and no errors. Thank you for reading!