Tuesday, March 18, 2014

Run Windows OpenVPN as a service for Users that aren't Administrators - Untangle

I needed to run the OpenVPN-GUI for users that weren't Administrators of their local computers to connect to an Untangle 10 server. It took me forever to find the solution, which is to run the Windows OpenVPN client as a service, but I couldn't because the of the following error:

"Windows could not start the OpenVPN Service service on Local Computer. Error 2: The system cannot find the file specified."

This is how you fix it (some of this is from different OpenVPN FAQs and How-To articles that I didn't write):

Go to START > Control Panel > Administrative Tools > Services
Right click on OpenVPN and select Properties
Change Start-up Type to Automatic
Click on the "Log On" tab, and select "This Account" and enter the username and password of a local account with Administrator privileges.
That account will be granted "Log On as a Service" rights.
Click OK
Close the Services window
Close the Administrative Tools window
Close Control Panel

Modify the Registry (64-bit Windows Only. This is not necessary on 32-bit Windows)

Go to Start > Run > Regedit (or Windows-R Keys)
Follow path down to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wow6432Node\
Locate the entry for "OpenVPN-GUI"
Modify the following registry value to be 1 (instead of 0): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wow6432Node\OpenVPN-GUI\allow_service
Follow path down to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wow6432Node\
Locate the entry for "OpenVPN"
Right Click and Choose "export" and save it as openvpnold.reg
Exit RegEdit
Right Click on openvpnold.reg and choose "edit"

Change: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenVPN]
To: [HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN]

Save it as openvpnnew.reg
Exit the Editor.


[The above is no longer necessary, but it is included in case you are using an older version of Untangle]


Double-click on openvpnnew.reg and allow it to be imported.

When the machine restarts,the user will automatically be connected to any VPN site with an .opvn file in the /config directory of OpenVPN (C:\Program Files....). There will be no more OpenVPN icon on the system. If a user needs to reconnect, they will have to either reboot, or restart the OpenVPN service if they have that right.

The right to restart a service can be granted by downloading SubInACL.exe from http://www.microsoft.com/en-us/download/confirmation.aspx?id=23510 and running:

"C:\Program Files\Windows Resource Kits\Tools\subinacl" /service "OpenVPN Service" /grant=<username>=TO where <username> is the non-admin account username. You may have to change C:\Program Files (x86) depending on your Operating System.


Apparently, this is fixed in the latest build ( for 10.1 - Build: 10.1.0~svn20140228r37310release10.1-1squeeze) of the OpenVPN Untangle client, but you have to uninstall and remove all registry entries by hand as the Uninstaller doesn't remove them all. Then redistribute the client and reinstall.