In LockDown mode all network traffic must flow over the VPN tunnel even if the client is on the internal network. LockDown mode prevents clients from connecting to network resources from a network with a captive portal. However, if the VPN connection is not available, the client will be unable to access any network resources at all, local or remote. All network traffic must go over the VPN connection. LockDown mode uses force tunneling exclusively. IKEv2 is an excellent VPN protocol in terms of security, but operationally speaking it has some serious drawbacks. Third-party plug-in provider clients are not supported. LockDown mode only supports IKEv2 and the native (built-in) VPN client.

Force tunneling is enabled by default (split tunneling in LockDown mode is not supported).Īlways On VPN LockDown mode brings with it some unique challenges, however.

No other VPN connections can exist on the client.The user can’t make changes to or delete the LockDown connection.The LockDown VPN connection cannot be disabled.The LockDown VPN connection is always on.Once enabled, the following conditions apply. To address these concerns, Microsoft included a feature called LockDown mode for Always On VPN. Also, administrators may wish to prevent users from accidentally or purposefully making changes to the configuration, or even deleting the connection entirely.

Some administrators have expressed concern about this, fearful that users may disable the VPN to improve performance or circumvent access controls when force tunneling is enabled. When an Always On VPN connection is provisioned to a Windows 10 client, there’s nothing to prevent a user from disconnecting or even deleting the connection.

Sysinternals windows 10