I usually want some kind of ticket back when i send configurations to the clients. With Active Directory Group Policies you will never know if all those fancy scripts of yours actually did something. If you have SCCM in your environment you could/should do it with more accuracy, get the status and remediate clients that do not comply.That is why i made custom AOVPN deployment script in Powershell that can use versioning when you need to upgrade your clients, change some ip range or whatever. Microsoft has a standard procedure that you can read about here , i borrowed most of the code and added some lines that should work with other deployment software, SCCM , Zenworks , Altiris etc. Alt 1: You will need only one file, Powershell script with everything (XML) embedded Alt 2: You'll need 2 files: Powershell script and XML as a separate file with configuration parameters for your VPN network. In this case i used machine-certificate IKEv2 type of configuration because it should work ri...