It must also be domain-joined and have a computer certificate with the Client Authentication Enhanced Key Usage (EKU) issued by the organization’s Public Key Infrastructure (PKI). To support an Always On VPN device tunnel, the client computer must be running Windows 10 Enterprise or Education version 1709 (Fall creators update) or later. Learn Windows 10 Always On VPN today! Register for an upcoming Always On VPN Hands-On Training class.

To address this issue and to provide feature parity with DirectAccess, Microsoft introduced support for a device tunnel configuration option beginning with Windows 10 version 1709 (Fall creators update). For example, pre-logon connectivity is required to support remote logon without cached credentials. This presents a challenge for deployment scenarios that require the VPN connection to be established before the user logs on. However, Always On VPN is provisioned to the user, not the machine as it is with DirectAccess.

Windows 10 Always On VPN and DirectAccess both provide seamless, transparent, always on remote network access for Windows clients.

Dirty laundry soap opera spoilers