Win L2TP/IPSEC transfers VPN user over to the SMB Share

RouterOS General
1

Hi,

I have a problem with Windows L2TP/IPSEC clients (also IKEv2/UserManager).
We have a domain controler and shared network drives.

User takes the notebook home connects to VPN without a problem and then when trying to connect to network drives it fails.
But if I go to credential manager on the client and delete the windows session credential the network drives start to work with no problem.
Until reboot.

Is the any way to disable transfer of VPN credentials over VPN to SMB shares.
I have tried PAP, CHAP instead od MSCHAP but to no avail.
It works using RADIUS server to sync the user and password with the domain. But that I do not want to do.

Also Wireguard is working without those problems.

It is ROS version unrelated (6.48.6, 6.49.10, 7.10.2, 7.11.2)

Thanks for any pointers/help!

2

I have found a sollution. You have to edit the Windows .pbk file!

On the user’s computer, go to to C:\Users[username]\AppData\Roaming\Microsoft\Network\Connections\Pbk.
Open the rasphone.pbk file with a text editor.
In the section for the relevant VPN connection, find userascredentials=1 and change it to userascredentials=0.

Or, specify this Windows PowerShell command:

$pbkpath = Join-Path $env:APPDATA 'Microsoft\Network\Connections\Pbk\rasphone.pbk'
(Get-Content -path $pbkpath -Raw) -Replace 'UseRasCredentials=1','UseRasCredentials=0' | Set-Content -path $pbkpath