From a command prompt, change OpenVPN adapter from Public to Work location/profile on Windows?

Question

I'm working on a silent installer for OpenVPN as part of a bigger software package to be deployed on numerous Windows systems within my employer's corporate network.

I'm able to get OpenVPN to install silently using some command line options (stuff like /S /SELECT_SHORTCUTS=0 /SELECT_OPENVPN=1 /SELECT_SERVICE=1, etc). This works great.

However when it's done, it's assigned the TAP adapter to the Public Network location/profile:

I need the TAP adapter to be installed onto the Work network location/profile, so when I open up some ports on Windows' Advanced firewall (using some netsh advfirewall firewall add commands) I can specify that traffic on these ports should only be allowed via network adapters on the Domain and Private profiles, not Public.

The installer is run with elevated privileges, so there are never any prompts or opportunities to pick the location/profile (i.e. Windows networking popups) during the install. Besides, I really don't want the guy running this installer to have any opportunities to muck around with it or make any changes--this is for internal use only and these settings are non-optional.

The bummer here, and the reason for my question, is I cannot figure out how to change the location/profile of the TAP adapter from the command line. There don't seem to be any netsh commands to do it.

How can I change the location/profile of a Windows Network adapter from the command line? Something doable in a batch file would be preferred.

p.s. I am also using the steps described here to make the adapter not show up as an "unidentified network", which might be a pre-requisite for the above, not sure.

Thanks!

Answer 1

Powershell can help here:

Get-NetConnectionProfile

gets the information you want

Set-NetConnectionProfile -NetworkCategory Private

Changes it.

Also, if you have multiple active current networks, you'll have to identify the one you want.

Tech-Net documentation about Set-NetConnectionProfile

Answer 2

In the end I couldn't find a completely automated way to do what I wanted. In case anyone else stumbles here struggling with something similar, the registry value for changing a Network from Public to Work is under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\<GUID>

But the part I could never figure out programmatically is identifying the right <GUID>. Maybe there is actually a linkage in the registry between the OpenVPN TAP adapter and the right Network profile I just couldn't find, or maybe there's a way with powershell or some other command to find it.

Anyways, once you know the right one (via eyeballing or whatever), you can change the Category from 0 (Public) to 1 (Work). An OpenVPN restart is all that's needed for it to begin honoring the right Windows firewall rules.

Instead, I ended up going with the *NdisDeviceType = 1 technique (google), which:

1. relieves you from caring about what Windows Network profile it's in (it doesn't even show up under Network and Sharing Center anymore), and
2. causes OpenVPN's traffic to fall under the Private profile inside Windows firewall. Which is all I really needed anyway. However this doesn't seem to be documented anywhere I could find.

This is marginally acceptable for what I need, right now, I just hope this technique works in all the versions of Windows I end up needing it for and that it doesn't go away any time soon.

In case it's useful, here is the powershell script I wrote, to be run after the OpenVPN silent installer, but before starting the OpenVPN service:

$ErrorActionPreference = "Stop"

Write-Host "Beginning"

$adapters = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Class\*" `
    | Where-Object { $_.Class -eq "Net" } `
    | Foreach-Object { $_.PSPath }

Write-Host "Found adapters: " $adapters

Write-Host "Now setting *NdisDeviceType to 1 on all tap0901 adapters..."
Get-ChildItem $adapters -erroraction silentlycontinue `
    | Foreach-Object { get-itemproperty -path $_.PSPath } `
    | Where-Object {
        ($_.ComponentId -eq "tap0901") -and -not ($_."*NdisDeviceType" -eq 1)
    } `
    | Foreach-Object {
        Set-ItemProperty -path $_.PSPath -name "*NdisDeviceType" -Type DWORD -Value 1
    }

Write-Host "Now disabling then re-enabling all TAP-Windows adapters..."
Get-WmiObject -Class Win32_NetworkAdapter `
    | Where-Object { $_.Name -like "TAP-Windows Adapter*" } `
    | Foreach-Object {
        $junk = $_.Disable()
        $junk = $_.Enable()
    }

Write-Host "Done."

Serious thanks to x0n's nivot.org post and thijs's Brokenwire.NET post for the above Powershell script.