How can users be prevented from installing VPN software on their home computers?

  • 6
    Prevented by whom, and for what purpose? – Mike Scott Aug 3 '15 at 19:55
  • If you want to permit VPN access from a very specific set of computers, you could use an IP address whitelist. Not sure what you're trying to do here. – etherealflux Aug 3 '15 at 20:12
  • Basically I am trying to prevent people from installing VPN software on their home PC's and accessing my corporate network. This is to prevent corporate data being stored on noncompliant PC's. – Stan Aug 6 '15 at 12:17

I assume you want to prevent your employees from using their personal computers to access your work network via VPN.

You can't prevent them from installing VPN software on their home computers, but you can disallow VPN connections from systems using Posture Checking.

Posture Checking involves the VPN server querying the VPN client for information prior to allowing authentication to be attempted. If the endpoint (client computer) doesn't meet the criteria for an allowed connection, then authentication and VPN connection are not allowed.

Posture Checking is one name, you may also see Posture Assessment, Endpoint Compliance, Endpoint Policy, etc. etc.

This can include (Cisco example):

In the adaptive security appliance (ASA), you can create a prelogin policy that evaluates endpoint attributes such as operating system, IP address, registry entries, local certificates, and filenames. Based on the result of the prelogin policy’s evaluation, you can control which hosts are allowed to create a remote access connection to the security appliance.

and (Check Point example):

The Endpoint Policy Management Software Blade allows you to enforce endpoint compliance on multiple checks before users log into the network.

You can check that the:

  • appropriate endpoint security software blades are installed
  • correct OS service pack are installed on the endpoint
  • only approved applications are able to run on the endpoint
  • appropriate anti-malware product and version is running on the endpoint.

Plus, set users to Observe, Warn, or Restrict access to the network if they are not compliant with the policy. Also, allows for automatic or user-based remediation.

Most commercial VPN systems will provide an equivalent functionality, sometimes bundled, sometimes for an additional cost.

Not the answer you're looking for? Browse other questions tagged or ask your own question.