We have an OpenVPN server and Active Directory. I’d like to restrict certain VPN users to only be able to log on to a couple machines. I tried to accomplish this using Log On To in the AD Account tab. After I configured the machines, the user can no longer connect via OpenVPN. I don’t even see his attempts in the logs.

So, I went back to Log On To and added the vpn server’s inside address (no go), the outside address (no go), both AD servers (no go) to no avail. These servers should be the only ones in the login path. Not sure where to look to find out what other hosts might be involved in the process in order to allow the user to even connect, let alone try to connect to the machines I want him to.

If I must continue to add servers just to get him able to log in, this additional access to servers concerns me. Has anyone else gotten this configuration to work?

Maybe I need to forgo using Log On To in AD and restrict his access through GPO?