特定安全组与笔记本OU内VPN用户登录时更新VPN设置可行性问询

Great question—this is totally achievable, even with the limitation of not being able to natively match both security groups and OUs in a single direct filter. Here are three solid approaches tailored to different environment setups:

1. Login/Logoff Scripts with AD Querying #

This is a flexible method that works for both on-prem AD and hybrid environments:

• On Login: Write a script (PowerShell for Windows, bash/zsh for macOS) that does two checks first:
  1. Verify the current device is in your approved laptop OU (use Get-ADComputer on Windows, or query AD via ldapsearch on macOS to check the device's distinguished name).
  2. Confirm the logged-in user is a member of the specified VPN security group (use Get-ADUser -MemberOf on Windows, or similar LDAP queries).
     If both conditions pass, first remove any existing old VPN configurations (e.g., Remove-VpnConnection -Name "OldVPN" -Force on Windows) then deploy the new work VPN setup (e.g., Add-VpnConnection -Name "WorkVPN" -ServerAddress "vpn.yourcompany.com" -TunnelType IKEv2).
• On Logoff: Add a logoff script that cleans up the work VPN configuration (or specifically targets the one you deployed) to ensure no leftover settings.
• Pro tip: Make sure the script has permission to query AD and modify VPN settings—you might need to run it as a privileged account or grant necessary AD read permissions to regular users.

2. Group Policy (GPO) with Combined Filtering #

If you're using on-prem AD GPOs, you can work around the direct filter limitation with a two-step approach:

• Step 1: WMI Filter for Target OU: Create a WMI filter that only applies to devices in your approved laptop OU. For example, a WMI query like:

  SELECT * FROM Win32_ComputerSystem WHERE DNSHostName LIKE "%-approved-laptop.yourdomain.com"
  

  (Or query the device's AD OU directly via LDAP in WMI.)
• Step 2: Security Group Permissions: Link the GPO to your domain or the parent OU of your approved laptops, then edit the GPO's security settings to only allow members of the VPN security group to read and apply the GPO. This way, the GPO will only activate when both the device is in the OU (via WMI filter) and the user is in the security group (via permissions).
• Logoff Handling: Include a logoff script in the same GPO to remove old VPN configurations, or use GPO's "Replace" action for VPN settings—this automatically overwrites existing configurations instead of adding to them, ensuring only one work VPN exists.

3. Modern Management with Intune (If Applicable) #

If your environment uses Microsoft Intune for device management, this becomes even simpler:

• Create a VPN configuration profile targeted at the devices in your approved laptop OU.
• Use an assignment filter to restrict the profile to only users who are members of the specified VPN security group.
• Configure the profile to "Replace" existing VPN configurations (instead of "Merge")—this ensures the old settings get overwritten, leaving only the work VPN.
• For logoff cleanup, you can set the profile to be removed when the user is no longer in the security group, or use a script deployed via Intune that triggers on user logoff.

All three methods are fully feasible—your choice will depend on whether you're using traditional on-prem tools, modern cloud management, or a hybrid setup.

内容的提问来源于stack exchange，提问作者Tom