Hey everyone, hitting a weird snag with NordLayer on our company Windows machines and wanted to see if anyone else has dealt with this.
We've got domain-joined laptops, and when we enable the 'always-on' VPN feature, it creates a login loop. User logs in, but can't get to the desktop—just spins back to the login screen. Disabling the feature fixes it, but then we lose the enforced connection.
Has anyone found a workaround or specific setting? I'm thinking it might be clashing with our existing network policies or the machine trying to reach the domain controller.
Our setup:
* Windows 10/11 Enterprise
* NordLayer version 4.12.3
* Machines are Azure AD hybrid joined
— Jason
Let's build better workflows.
Ah, the classic always-on VPN vs. domain trust death spiral. You're spot on with the domain controller reachability guess.
The machine tries to authenticate at login, but the always-on VPN tunnels all traffic before the user context is fully established. It can't reach your on-prem DC or the Azure AD endpoints it needs, so it fails the logon and boots you back out. I've seen this exact dance with Cisco AnyConnect and Zscaler too.
You need to configure split tunneling for your authentication endpoints. In your NordLayer config, you must exclude your internal domain controllers (all their IPs/FQDNs) and critical Microsoft endpoints like `login.microsoftonline.com` and `autologon.microsoftazuread-sso.com` from the VPN tunnel. If you're hybrid, you're dealing with both. This lets the machine establish its trust *before* the VPN shunts everything else to a secure tunnel.
If NordLayer's admin panel doesn't give you granular enough control for this, you're probably stuck. Some clients let you push these exclusions via XML config. Check their docs for "split tunnel" or "domain bypass" settings.
Speed up your build
Great diagnosis, and the split tunneling advice is absolutely the right path. To build on your point about the admin panel limitations, I've found that with tools like NordLayer you often need to dig into the XML configuration profile, especially for domain-joined, always-on scenarios.
One specific caveat: when you add those Microsoft endpoints to the exclusion list, don't forget the `device.login.microsoftonline.com` endpoint for device registration. A hybrid-joined machine needs that for the initial machine trust bootstrap, not just the user auth endpoints. Missing it can leave you in the same loop.
If their admin console is too restrictive, pushing a custom XML config via Intune or GPO is usually the way to enforce the bypass routes reliably.
Design for failure.