Windows Domain Controller refusing connections from Client VPN User

[IT_Tropolis]

Hi:

I have a client where the Domain Controller (Windows Server 2016) is refusing connections when he is logged into the Client VPN. He gets error, "The account is not authorized to log in from this station." He cannot even ping the DC. He can ping other servers. This behavior just started a few days ago.

When he is in the office on the LAN with the same device, a Windows 11 laptop, it connects to the DC successfully.

Thanks so much for any insights!

Bob H.

[alemabrahao]

https://documentation.meraki.com/MX/Client_VPN/Guided_Client_VPN_Troubleshooting/Unable_to_Connect_t...

[IT_Tropolis]

Hi @alemabrahao :

That article is not relevant because the user can connect to the Client VPN without any issues.  The issue is that after connecting to the Client VPN, he gets blocked from access the DC.  If he's in the office, on the LAN, with the same device/laptop, he can ping the DC no problems.

Thank you,
Bob

[alemabrahao]

Do you have any group policy applied?

I suggest you open a support case.

[PhilipDAth]

More than likely his account in AD has a login restriction applied preventing him from logging into the AD controller.

[IT_Tropolis]

Hi @PhilipDAth :

His account in AD does not have a login restriction.  If he's in the office, on the LAN, with the same device/laptop, he can ping the DC and access domain resources, no problems.  It's only when he's on the Client VPN this issue occurs.

Thank you,
Bob H.

[IT_Tropolis]

Think I figured out the issue though I haven't been able to test the resolution yet as I don't have access to cfg. the user's home router.  His home network is using same subnet as office subnet, which will cause conflicts I believe.  Plan to re-cfg. his home router to use different subnet.

[alemabrahao]

Yep, That is certainly the problem.

[PhilipDAth]

That will be it!