Import VPN provisioning file through GPO
You can automatically download and import the remote access VPN provisioning file (
.pro) to the Sophos Connect clients on users' endpoints using a script through Active Directory Group Policy Object (GPO).
Import provisioning file to Sophos Connect client
To download and import the provisioning file, do as follows:
Open a blank file in a text editor, such as Notepad, and paste the following script:
@echo off REM Use the automatic import feature of the Sophos Connect client to download and import the .pro file REM Wait for scvpn service to be available :WAIT2 timeout /t 5 > NUL for /f "tokens=4" %%s in ('sc query scvpn ^| find "STATE"') do if NOT "%%s"=="RUNNING" goto WAIT2 echo Service is now running! REM scvpn service is available. Download the .pro file from a centrally-hosted location. Make sure you enter your URL and the filename you want. powershell -Command "Invoke-WebRequest <full_web_url_where_pro_file_is_hosted> -OutFile download_import_scc.pro" REM Copy the downloaded .pro file to the SCC import folder for the automatic import feature to act copy download_import_scc.pro "C:\Program Files (x86)\Sophos\Connect\import\"
The script waits for the scvpn service to run after the endpoint starts. So, don't stop the Sophos Connect service in your startup apps.
Save the file with a
To add the path where you've saved the script, do as follows:
- On the Windows Server, open Group Policy Management Console (GPMC) and click Group Policy Management.
- Click the group policy that applies to users' endpoints, click Computer Configuration, and click Policies.
- Under Windows Settings, click Scripts, and double-click Startup.
- Follow the instructions to add the
.batfile. See Working with startup scripts using the Local Group Policy Editor.
To apply the script, run the following command:
When users start their endpoints, the
scvpnservice starts, and the script downloads the
.profile from the server to the Sophos Connect import folder.
The Sophos Connect client automatically imports the
.profile from this folder and deletes the file from the folder. It then connects to the user portal through the gateway configured in the
.profile and pulls the remote access IPsec and SSL VPN configurations.