Windows 10 - VPN-Tunnel computerseitig einrichten

   $ProfileName = 'AlwaysOn VPN'  
   $ProfileNameEscaped = $ProfileName -replace ' ', '%20'  

   $ProfileXML = '  
 <VPNProfile>
   <DnsSuffix>ks-ag.local</DnsSuffix>
   <NativeProfile>
 <Servers>OEFENTLICHERDNSEINTRAG</Servers>
 <NativeProtocolType>IKEv2</NativeProtocolType>
 <Authentication>
   <UserMethod>Eap</UserMethod>
   <Eap>
    <Configuration>
     <EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>25</Type><EapType xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1"><ServerValidation><DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation><ServerNames>ksaaop02.ks-ag.local</ServerNames><TrustedRootCA>6b 3e 46 2a b0 b0 f9 26 d9 07 47 58 95 0a 5b 52 8d 81 c9 2d </TrustedRootCA></ServerValidation><FastReconnect>true</FastReconnect><InnerEapOptional>false</InnerEapOptional><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>13</Type><EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1"><CredentialsSource><CertificateStore><SimpleCertSelection>true</SimpleCertSelection></CertificateStore></CredentialsSource><ServerValidation><DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation><ServerNames>ksaaop02.ks-ag.local</ServerNames><TrustedRootCA>6b 3e 46 2a b0 b0 f9 26 d9 07 47 58 95 0a 5b 52 8d 81 c9 2d </TrustedRootCA><TrustedRootCA>6b 3e 46 2a b0 b0 f9 26 d9 07 47 58 95 0a 5b 52 8d 81 c9 2d </TrustedRootCA></ServerValidation><DifferentUsername>false</DifferentUsername><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</AcceptServerName><TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2"><FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3"><CAHashList Enabled="true"><IssuerHash>6b 3e 46 2a b0 b0 f9 26 d9 07 47 58 95 0a 5b 52 8d 81 c9 2d </IssuerHash></CAHashList></FilteringInfo></TLSExtensions></EapType></Eap><EnableQuarantineChecks>false</EnableQuarantineChecks><RequireCryptoBinding>false</RequireCryptoBinding><PeapExtensions><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">true</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">true</AcceptServerName></PeapExtensions></EapType></Eap></Config></EapHostConfig>  
    </Configuration>
   </Eap>
 </Authentication>
 <RoutingPolicyType>ForceTunnel</RoutingPolicyType>
   </NativeProfile>
 <AlwaysOn>true</AlwaysOn>
 <RememberCredentials>true</RememberCredentials>
 <TrustedNetworkDetection>ks-ag.local</TrustedNetworkDetection>
   <DomainNameInformation>
 <DomainName>INTERNERDOMAINNAME</DomainName>
 <DnsServers>172.16.1.50,172.16.1.60,172.16.1.100</DnsServers>
 </DomainNameInformation>
 <DomainNameInformation>
 <DomainName>EXTERNERDOMAINNAME1</DomainName>
 <DnsServers>172.16.1.50,172.16.1.60,172.16.1.100</DnsServers>
 </DomainNameInformation>
 <DomainNameInformation>
 <DomainName>EXTERNERDOMAINNAME2</DomainName>
 <DnsServers>172.16.1.50,172.16.1.60,172.16.1.100</DnsServers>
 </DomainNameInformation>
  <RegisterDNS>true</RegisterDNS>
 </VPNProfile>
 '  

   $ProfileXML = $ProfileXML -replace '<', '&lt;'  
   $ProfileXML = $ProfileXML -replace '>', '&gt;'  
   $ProfileXML = $ProfileXML -replace '"', '&quot;'  

   $nodeCSPURI = "./Vendor/MSFT/VPNv2"  
   $namespaceName = "root\cimv2\mdm\dmmap"  
   $className = "MDM_VPNv2_01"  

   try
   {
   $username = Gwmi -Class Win32_ComputerSystem | select username
   $objuser = New-Object System.Security.Principal.NTAccount($username.username)
   $sid = $objuser.Translate([System.Security.Principal.SecurityIdentifier])
   $SidValue = $sid.Value
   $Message = "User SID is $SidValue."  
   Write-Host "$Message"  
   }
   catch [Exception]
   {
   $Message = "Unable to get user SID. User may be logged on over Remote Desktop: $_"  
   Write-Host "$Message"  
   exit
   }

   $session = New-CimSession
   $options = New-Object Microsoft.Management.Infrastructure.Options.CimOperationOptions
   $options.SetCustomOption("PolicyPlatformContext_PrincipalContext_Type", "PolicyPlatform_UserContext", $false)  
   $options.SetCustomOption("PolicyPlatformContext_PrincipalContext_Id", "$SidValue", $false)  

   try
   {
  $deleteInstances = $session.EnumerateInstances($namespaceName, $className, $options)
  foreach ($deleteInstance in $deleteInstances)
  {
      $InstanceId = $deleteInstance.InstanceID
      if ("$InstanceId" -eq "$ProfileNameEscaped")  
      {
          $session.DeleteInstance($namespaceName, $deleteInstance, $options)
          $Message = "Removed $ProfileName profile $InstanceId"  
          Write-Host "$Message"  
      } else {
          $Message = "Ignoring existing VPN profile $InstanceId"  
          Write-Host "$Message"  
      }
  }
   }
   catch [Exception]
   {
  $Message = "Unable to remove existing outdated instance(s) of $ProfileName profile: $_"  
  Write-Host "$Message"  
  exit
   }

   try
   {
  $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
  $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", "String", "Key")  
  $newInstance.CimInstanceProperties.Add($property)
  $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", "String",      "Key")  
  $newInstance.CimInstanceProperties.Add($property)
  $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", "String", "Property")  
  $newInstance.CimInstanceProperties.Add($property)
  $session.CreateInstance($namespaceName, $newInstance, $options)

  #Zusatzeinbau für Priorisierung IPv4 gegenüber IPv6

  if(!(Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters -Name DisabledComponents)){
    New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters -Name DisabledComponents -PropertyType DWord -Value 32
  }
  else{
    Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters -Name DisabledComponents -Value 32
  }

  $Message = "Created $ProfileName profile."  

  Write-Host "$Message"  
   }
   catch [Exception]
   {
  $Message = "Unable to create $ProfileName profile: $_"  
  Write-Host "$Message"  
  exit
   }

   $Message = "Script Complete"  
   Write-Host "$Message"