Dear WireGuard-Community, TL;DR: wireguard forgets after restart that there was a activated tunnel before and won't activate said tunnel anymore unless an admin intervenes
I've deployed wireguard-windows on 50 domain-joined Windows 10 (20H1 x64) notebooks (WireGuard versions range from v0.3.14 - v.03.16) and need your assistance resolving some mysterious behavior. Some of my users are experiencing random connectivity loses (this example here is the only time I witnessed said behaviour myself): - admin setups and activates '20_EPNBLE-04' tunnel config - service 'WireGuardManager' runs - service 'WireGuardTunnel$20_EPNBLE-04' runs - everything is fine for days/weeks -- users reboot usually daily - user reboots / comes back from weekend - service 'WireGuardManager' runs - service 'WireGuardTunnel$20_EPNBLE-04' does not exist - config '20_EPNBLE-04.conf.dpapi' under 'C:\Program Files\WireGuard\Data\Configurations' still exists, it's just not active any more - config '20_EPNBLE-04.conf.dpapi' *stays* inactive (multiple reboots), unless an admin re-activates it via WireGuard UI My 99% windows environment: - users have no admin privileges - 'LimitedOperatorUI' is disabled, so users have no privileges to mess with network or wireguard config or tunnel state - all clients have the 'Windows Baseline Security' applied - each notebook has a unique config file (above example: 20_EPNBLE-04) - that config has been enabled via wireguard UI (before deployment by an administrative account) and works - that tunnel works 99%, but sometimes, just sometimes, the tunnel service is gone after reboot - I can't spot a pattern to which or when a client looses connectivity - Most clients have no issues whatsoever, but maybe 20% of those clients had the previously described vpn tunnel loss, but until now no client had this issue twice - WireGuard log doesn't show anything interesting, because that config file is obviously inactive, and after I click 'Activate' the tunnel works instantly I read (parts of) the source code and tried to understand how 'WireGuardManager' keeps tabs on which of the available vpn config needs to be reestablished after reboot, but I didn't grasp the business logic yet (I'm a longtime Go developer myself, so reading is usually not the issue - but maybe I need another coffee :/). Hope you have some pointers on how to resolve this. Cheers D. Brodbeck
