Connection Manager Administration Kit

Connection Manager is a versatile client dialer and connection software that you can customize by using the Connection Manager Administration Kit (CMAK) wizard.

  • For an overview of CMAK and its audience, see Welcome.
  • Before installing CMAK, see Before you start: Understanding Connection Manager and the Administration Kit.
  • To understand your customization options and how to select the options most appropriate to your needs and those of your users, see Phase one: Planning.
  • For information on how to design and develop custom graphics, text, programs, and other elements to support your needs, see Phase two: Developing custom elements.
  • For information on how to create your service profiles using the CMAK wizard and advanced customization techniques, see Phase three: Running the CMAK wizard and creating a service profile.
  • For information on delivery options and methods, see Phase four: Preparing for integration, delivery, and installation.
  • For information on testing and verifying your customizations, see Phase five: Testing your deliverables.
  • For problem-solving instructions and other support information, including answers to frequently asked questions about Connection Manager and CMAK, see Phase six: Supporting your customers.


Welcome

Before you run the Connection Manager Administration Kit (CMAK) wizard, you should plan and develop the Connection Manager custom elements that you want in your client dialer. Then, simply run the CMAK wizard, answering the questions and providing the information about your custom elements. The CMAK wizard then builds a service profile, which is a set of files which you distribute to your users so that they can easily install and run your custom version of Connection Manager.

Audience

The CMAK wizard and this documentation is designed for the network administrators, information officers, and other team members responsible for the design, development, testing, distribution, and support of connection software for the customers who connect to your Internet or network service.

About this documentation

The CMAK wizard provides defaults that support quick and easy creation of a basic Connection Manager service profile. If you want to use all of the defaults and do not want to take advantage of the many customizable elements, you probably do not need this documentation.

However, if you want a custom dialer that promotes your brand and supports more advanced functions, such as automatic phone book updates and support for virtual private networking, you need this documentation to help you effectively plan and implement your custom elements.

Notes

  • The information in this documentation is based on the assumption that you have already installed the CMAK software. For more information on evaluating Connection Manager, see the Microsoft Web site (http://www.microsoft.com/).
  • You can display this documentation directly from the CMAK wizard by clicking Help. When you click Help in a pane of the CMAK wizard, the Help topic associated with that specific pane appears.


Before you start: Understanding Connection Manager and the Administration Kit

Connection Manager provides a customized remote access client so your customers can connect to your service using connection features that you define. The Connection Manager Administration Kit (CMAK) wizard simplifies the customization process by providing a graphical interface that you use to specify custom elements for your service. It then builds your customized installation package for you. This section covers the information you need to know before starting the customization process:

  • Connection Manager components and system requirements
  • Connection Manager features
  • Connection Manager user interface
  • The Connection Manager Administration Kit Wizard
  • The Connection Manager Administration Kit and the customization process
  • Connection Point Services and Connection Manager


Connection Manager components and system requirements

This section covers the system requirements for Connection Manager and its components.

Connection Manager requires at least 2 megabytes (MB) of free disk space and one of the following:

  • Windows 95
  • Windows 98
  • Windows NT Workstation 4.0
  • Windows 2000
  • Windows Millennium Edition
  • XOX
  • Windows Server 2003 family
  • Internet Explorer 4.01, 5.0, 5.5, or 6.0. Users do not have to have Internet Explorer set as their default browser or use the software.

Disk-space requirements for each system vary, based on the elements included in the service profile. For information on determining the size of the complete deliverable, see Planning for effective implementation.

For dial-up connections, Connection Manager also requires a 28.8 modem or faster connection. Connection Manager can automatically configure the modem. If you include Connection Manager in the service profile, the user's modem is configured as needed to support Connection Manager.

Connection Manager requires Transmission Control Protocol/Internet Protocol (TCP/IP) (for peer connections in a network), Telephony Application Programming Interface (TAPI) (for dialing support), and Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) (to establish a VPN connection), but when Connection Manager installs, it automatically installs the appropriate level of software on computers with operating systems that do not have the appropriate level. There are two exceptions. On Windows NT 4.0, the user must manually set up PPTP (in Remote Access Setup). For information that you can provide to your users on how to set up PPTP on Windows NT 4.0, see Providing user documentation. On Windows 95, Windows 98, Windows Millennium Edition, and Windows NT 4.0, users must install Microsoft L2TP/IPSec VPN Client in order to set up L2TP. For more information about Microsoft L2TP/IPSec VPN Client, see the Microsoft Web site (http://www.microsoft.com/).

If your service profile supports PPTP VPN connections, any users who are running Windows 95 on their computers must have the latest connection software installed on their computers to establish a VPN connection. For more information on this requirement, see Implementing VPN support. For information that you can provide to your users to update their connection software, see Providing user documentation.

Notes

  • It is recommended that your clients install the latest service pack for their operating systems before installing a Connection Manager service profile.
  • If your Connection Manager profile includes phone book downloads, your users must have a version of Internet Explorer installed on their computers, as noted above. Users do not have to have Internet Explorer set as their default browser or use the software.


Connection Manager features

Connection Manager 1.3 provides support for local and remote connections to your service using a network of access points, such as those available worldwide through Internet service providers (ISPs). If your service requires secure connections over the Internet, you can use Connection Manager to establish virtual private network (VPN) connections to your service. Following are some of the features supported by Connection Manager 1.3.

New features of Connection Manager 1.3

Connection Manager provides the following new features:

  • VPN server selection If you include a VPN file and configure VPN entries, your users will be able to choose what VPN server to use when making a connection.
  • Log files Log files for a connection can be created, cleared, and viewed by the user.
  • Favorites Users can define the properties of a connection, save these settings for future use, and pick the favorite to use from the Connection Manager user interface. For example, a user can configure location properties and dialing rules for connecting to the office from home and from a frequent business travel location, and then the user can choose between these two sets of settings when connecting.
  • Provide user name and password for the service profile An administrator can pre-populate the User Name and Password fields of a Connection Manager profile for first-time or permanent use.
  • Terminal windows Connection Manager 1.3 supports the use of a terminal window on all supported platforms except Windows NT 4.0.

General connection support

Connection Manager supports a variety of features that both simplify and enhance implementation of connection support for you and your users. Most of these features can be incorporated using the Connection Manager Administration Kit (CMAK) wizard:
Feature | Support
Routing table updates | You can reconfigure user routing tables in order to better manage your network traffic and security.
Automatic proxy configuration | You can configure user proxy settings to ensure that the user has appropriate access to internal and external resources while connected to your service.
Branding | You can customize the graphics, icons, messages, Help, and phone book support in Connection Manager to provide an identity and support that are unique to your service or corporation. You can include custom logos, customer support, and phone book information to identify and represent your company.
Custom actions and monitored applications | You can incorporate custom functionality, including your own programs to enhance the connection experience for your users. These programs can be automatically run at various points during the connection process, such as when users log on or disconnect. Connection Manager also supports pre-connect and pre-tunnel actions. And you can set up monitored applications to automatically disconnect after the program ends.
Multiple user support for each service profile | You can provide support for users who share computers. User profiles allow two or more people to use the same computer and the same service profile. Credentials are maintained, based on the logon ID of the user, so users do not have to re-enter them for each connection.
Simplified distribution | Using the CMAK wizard to automatically build your service profile (the customized software required for your users to run Connection Manager), you create a self-installing executable file that can be distributed on compact disc or downloaded by your users.
Custom phone books | You can specify the phone books to be provided to your users. You can download your phone book to users and provide automatic phone book updates when your users log on. And to simplify maintenance, you can combine existing phone books by merging existing service profiles.

VPN connection support

In addition to the support for basic dial-up connections, you can also use the CMAK wizard to incorporate support for VPN connections using a tunneling protocol to tunnel through a public network (such as when dialing into an ISP to access a corporate server). Connection Manager can create a VPN connection through a pre-existing dial-up session, local area network (LAN), or digital subscriber line (DSL).
Feature | Support
VPN server selection | You can allow your users to choose a VPN server to use when connecting to your service.
Direct connections | If you specify support for VPN, you can provide support for direct connections (sometimes referred to as always on or persistent connections). Support for direct connections includes support for cable, asymmetric digital subscriber lines (ADSLs), and other types of direct connections.
Protocols | You can specify whether or not to support VPN, which enables your users to connect to your service using Point-to-Point Tunneling Protocol (PPTP) or, if running Windows 2000, XOX, or a member of the Windows Server 2003 family, Layer Two Tunneling Protocol (L2TP) with IPSec encryption as the tunneling protocol. These protocols enable improved security for direct and dial-up connections.


Connection Manager user interface

The Connection Manager user interface consists of a logon dialog box and a set of property dialog boxes with which users can customize their connection settings. What users see depends largely on how you customize your service profile.

Logon dialog box

The logon dialog box is often the only Connection Manager screen your users see when they access your service. In this dialog box, users specify their credentials (such as user name and user password) so they can connect to your network servers. You can customize the service name, the graphic, support information, and many other elements of this dialog box. Users can customize this logon box if they configure favorite connection settings. If two or more favorites have been configured, the user can select between them from the logon dialog box.

Properties dialog box

The ServiceProfileServiceName Properties dialog box appears when a user clicks Properties in the logon dialog box.

Note

  • The title bar of this dialog box contains the service name of the service profile in front of the word Properties, but it is referred to as simply the Properties dialog box throughout this documentation.

Properties, General tab

On the General tab, users can specify the way their system connects to an Internet service provider to access your service:

  • If the service profile that you provide supports virtual private network (VPN) connections, users can choose to use a direct connection that has already been established through the Internet or use a dial-up connection, and they can specify phone numbers and other information needed to establish the dial-up connection.
  • If the service profile that you provide does not support VPN connections, users do not see the direct connections option, but they are still able to specify phone numbers and other information for their dial-up connections.

Using this tab, users specify the following information for dial-up connections:

  • The phone number to be dialed to establish a connection. Users can type a number or click the Phone Book button to select a phone number.

    When users click the Phone Book button, they can select a Point of Presence (POP) from the list in the Phone Book dialog box. Only those access numbers that are supported by the selected service type, country (or region), and state (or province) appear in the list.

    Additional numbers appear in the More access numbers box only if you configure the phone book to support this second set of numbers (such as the phone numbers you specify as surcharge numbers when you use Connection Point Services to create your phone book). If the phone book has not been set up with additional access numbers for the selected geographic location, the box will be empty. If you specify in the Connection Manager Administration Kit (CMAK) wizard that custom text is to be displayed next to the More access numbers box, the text appears only when numbers are available for the selected geographic location.

  • Dialing rules for the dialing location. If users click Dialing Rules on the General tab, they can specify information about the location from which they are currently dialing, such as calling card numbers and codes for accessing outside and long-distance lines, or information about other locations for future use.
  • The type of device to be used to connect to your service. Only installed and available device types appear in the Connect using list.
  • Whether to save the settings on the General tab as a favorite for later use. Users can name and save all the current settings on the General tab and then select one of these favorite sets of settings from the Connection Manager logon dialog box.

Properties, Internet Logon tab

On the Internet Logon tab, the user types a user name and password to connect to the Internet for a VPN connection. This tab appears only if, in the CMAK wizard, you:

  • Specify support for VPN connections, and
  • Do not select the Use the same user name and password for VPN and dial-up connections check box.

Properties, Options tab

On the Options tab, users can change the connection defaults for establishing and keeping active connections. Users can change both the number of redial attempts that occur and the amount of idle time that elapses before Connection Manager ends the connection. Users can also choose whether to enable logging for this connection. If a log file has been created, users can choose to view or clear it.

Properties, VPN tab

On the VPN tab, users can choose a VPN server for the connection. This tab appears only if, in the CMAK wizard, you do each of the following three things:

  • Specify support for VPN connections.
  • Select the Allow the user to choose a VPN server before connecting check box.
  • Include a VPN file with your service profile.

For more information, see Implementing VPN support and Incorporating VPN entries.

Properties, Advanced tab

On the Advanced tab, users can enable Internet Connection Sharing, Internet Connection Firewall, or both services for the connection. This tab only appears on computers running XOX or a member of the Windows Server 2003 family. Users who are not members of the Administrators group will not see this tab.

For more information, see Understanding Internet Connection Firewall and Internet Connection Sharing.

Additional screens

Depending on how you customize the service profile, other screens appear during the connection process. For example, you can specify whether a license agreement appears when users install Connection Manager. You can also incorporate Help screens and other messages into the service profile.


The Connection Manager Administration Kit Wizard

The Connection Manager Administration Kit (CMAK) wizard guides you through the process of building service profiles that exactly meet your business needs. Before you can build these profiles, you must install the CMAK wizard.

New features in the CMAK wizard

The CMAK wizard offers many new features, including some that help you do the following:

  • Provide routing table updates that apply only while clients are connected to your server ("split tunneling")
  • Automatically configure Internet Explorer proxy settings for a client computer
  • Enable clients to choose which virtual private network (VPN) server to use when they connect
  • Include a pre-shared key for L2TP/IPSec authentication
  • Encrypt a pre-shared key profile with a personal identification number (PIN) that the user must type in before the profile can be installed

Additionally, the CMAK wizard gives you greater customization and control when you build the service profile, including:

  • More types of custom actions and full configuration of all custom actions from within the wizard
  • An advanced customization pane in which you can edit .cms and .cmp files as the profile is built
  • Improved interface and text throughout the wizard

Differences from earlier versions of the CMAK wizard

If you have used an earlier version of the CMAK wizard, you should be aware of the following issues:

  • If you have upgraded your operating system, you might have to manually migrate some profile files.
  • If you have manually edited the .inf file of a profile created with an earlier version of the CMAK wizard, you must reapply the edits to the .inf file if you change the profile with the current version of the CMAK wizard.
  • You can no longer use the CMAK wizard to incorporate an animation in your service profile.
  • If you add a program under the [RunPostSetupCommandsSection] of the .inf file of your profile, you must add the file as an additional file when you edit the profile with the CMAK wizard.

Installing the CMAK wizard

To install Connection Manager components, including the CMAK wizard, on a computer running a member of the Windows Server 2003 family:

  1. Open the Windows Components wizard.
  2. In Components, click Management and Monitoring Tools (but do not select or clear the check box), and then click Details.
  3. Select the Connection Manager Administration Kit check box.
  4. Click OK, click Next, and then click Finish.

Notes

  • XOX
  • XOX
  • XOX

To install the CMAK wizard on a computer running XOX, you must install the Windows Server 2003 Administration Tools Pack. To install the Administration Tools Pack:

  1. Insert the installation CD for a member of the Windows Server 2003 family into the CD-ROM drive of the computer running XOX.
  2. Click Perform additional tasks.
  3. Click Browse this CD.
  4. Double-click the I386 folder.
  5. Double-click the Adminpk.msi file and follow the instructions on your screen.

Starting the CMAK wizard

XOX


The Connection Manager Administration Kit and the customization process

Connection Manager is brandable, which means that you can customize the installation package that you deliver to your customers so that Connection Manager reflects the identity of your organization. You determine which functions and features you want to include, and how Connection Manager will appear to your customers. You do this by using the Connection Manager Administration Kit (CMAK) wizard to build custom service profiles.

A service profile consists of all of the files needed by Connection Manager to run the installation file and then enable users to establish connections with your service. You can maximize or minimize the identification of your service or organization, depending on what you decide to include in a service profile. For example, you can include custom corporate logos or other graphics, custom icons, and your own online Help. You can also add monitored applications, specify actions to run before, during, and after a connection, and customize other features available in Connection Manager.

To customize the features and support provided in Connection Manager for your service, you can customize your service profile in two ways:

  • Run the CMAK wizard (required to build a service profile).
    You can use the CMAK wizard to customize most features of Connection Manager at the same time that you build a service profile. For example, you can use the wizard to specify the name and graphics that your users see when running Connection Manager, whether virtual private network (VPN) connections to your service are available to your users, and whether your custom connect actions should run when a connection is established. How much you customize depends on your needs and those of your users. When you finish running the wizard, it automatically builds your customized service profile for you.
  • Use advanced customization techniques (optional).
    In some instances, there may be features or functions that you want to customize that are not available through the wizard. To add these features or functions, you can use the Advanced customization pane to edit the .cms and .cmp files when you build a service profile. After the service profile has been built, you can manually edit any service profile file, but you must run the CMAK wizard again after editing the files in this way in order to incorporate your changes. For example, you can change case sensitivity for passwords by editing the value for the PasswordHandling key in the Advanced Customization pane.

    For more information, see Methods of editing service profile files.

Each service profile that you create includes the ready-to-use custom features that you specify in a complete, self-installing package so users can seamlessly connect to your service.

Although using the CMAK wizard to build your custom service profiles is simple, creating the custom elements requires careful planning and development. This guide covers the six phases of planning, development, and implementation:

Phase | Tasks | Persons responsible
1 | Decide and document which features to customize for Connection Manager. The information you need to complete these tasks is covered in Phase one: Planning. | Network administrator or technical lead
2 | Design and develop a phone book and any other custom elements you want, such as graphics, text, and related programs, as needed. The information you need to complete these tasks is covered in Phase two: Developing custom elements. | Technical support team
3 | Use the CMAK wizard to build each custom service profile, and then use advanced customization techniques, as appropriate, to complete the customization of each, as covered in Phase three: Running the CMAK wizard and creating a service profile. | Technical lead or other member of technical support team
4 | Verify distribution readiness, including addressing any integration requirements, as covered in Phase four: Preparing for integration, delivery, and installation. | Technical lead or other member of technical support team
5 | Test your Connection Manager deliverables, including all custom elements, on all target platforms and operating systems, using the process and criteria covered in Phase five: Testing your deliverables. | Testers or other members of technical support team
6 | Provide effective troubleshooting and other support to your customers. Phase six: Supporting your customers. | Customer support team


Connection Point Services and Connection Manager

Connection Point Services (CPS) enables you to automatically distribute and update custom phone books. These phone books contain one or more Point of Presence (POP) entries, with each POP supplying a telephone number that provides dial-up access to an Internet access point. The phone books give users complete POP information, so when they travel they can connect to different Internet access points rather than being restricted to a single POP.

Without the ability to update phone books (a task CPS handles automatically), users would have to contact technical support to be informed of changes in POP information and to reconfigure their client dialer software.

CPS has two components:

  • Phone Book Administrator, a tool used to create and maintain the phone book database and to publish new phone book information to the Phone Book Service.
  • Phone Book Service, an Internet Information Services (IIS) extension. Phone Book Service automatically checks subscribers' or corporate employees' current phone books and, if necessary, downloads a phone book update.

CPS is available with the Windows Server 2003 family.

For information on setting up a phone book, see Providing phone book support. For more information on CPS, see Connection Point Services.


Phase one: Planning

The information in this section supports the planning that you need to do before you run the Connection Manager Administration Kit (CMAK) wizard to create the customized service profiles that you need:

  • Security information for the Connection Manager Administration Kit. This section provides an overview of basic security considerations when you design and deploy your customized service profiles.
  • Deciding what to customize. This section provides an overview of the Connection Manager features and functions that can be customized and included in your service profile.
  • Planning for effective implementation. This information covers the factors that you should consider before starting the planning for an individual service profile, so you will understand how your decisions will impact the service-profile deliverables. It includes information on the impacts of integrating your service profile with another installation package or otherwise tailoring your delivery and installation methods.
  • Creating profiles in multiple languages. This information covers the factors you should consider when designing a multinational or multilingual deployment of a service profile.


Security information for the Connection Manager Administration Kit

You can increase the security of your remote access solution by using the Connection Manager Administration Kit (CMAK) wizard to customize and control the connection experience for your users. By customizing the connection, you can control how your users connect to your network, and you can simplify troubleshooting.

Before you create a profile, you should understand your remote access solution, including its security requirements and limitations. You can consider remote access security in three parts: securing servers, including remote access servers and the computers on which you store profiles; understanding and securing the computers on which users will install profiles; and designing, creating, and distributing the profile itself. For more information about securing servers, see Security information for remote access, Security information for VPN, and Security.

When you design your service profile, you should consider the following:

  • Who can create or edit service profiles using the CMAK wizard. A user must be a member of the Administrators group to install the CMAK wizard. A user must be a member of either the Administrators or the Power Users group to run the CMAK wizard.
  • Who can edit service profile files using a plain text editor. Service profile files are plain text files that users can edit using a plain text editor, such as Notepad, instead of using the CMAK wizard. By using a plain text editor instead of the CMAK wizard, users do not need to be members of the Administrators or the Power Users group to edit or to delete these files. You can help prevent users from changing these files on the server by limiting access to the directories that contain service profile files. Recognize that, after you distribute the service profile, users can edit the service profile files on their own computers. For more information, see Methods of editing service-profile files and Including Connection Manager in custom applications.
  • Which operating systems your users will use. You should consider two things regarding the operating systems on your users' computers: the level of security inherent in the operating system itself, as well as the security features that you can configure for the operating system. Not all operating systems support all Connection Manager features. For example, Windows 98 does not support user certificates. Therefore, if you want to deploy a highly secure VPN solution, you might need to limit your deployment to users running XOX on hard disks formatted with NTFS.

    • Depending on how your users have configured their computers, you might have these security considerations:

    • Whether the user's hard disk is formatted with FAT or NTFS. FAT systems are not as secure as NTFS systems.
    • What authentication and tunneling protocols are supported. Not all operating systems support all of the same protocols as the Windows Server 2003 family. For more information, see Dial-up networking clients and Virtual private networking clients.
    • Whether your users will install the profile for individual use only or for all users of that computer (Windows 2000, XOX, and the Windows Server 2003 family only). Encourage your users to install the profile for individual use only. If a user installs a profile for all users of that computer, any user can modify or delete the service profile.
    • Whether the profile allows users to save the password for the profile. You can hide the check box that allows users to save passwords by configuring the HideRememberPassword key. For XOX and the Windows Server 2003 family, you can configure the GlobalCredentials key to prevent users from saving a user name and password for any other users of that computer. This key prevents other users from using another user’s credentials. The connection will close automatically if Fast User Switching is used. For more information, see Fast User Switching.

    If necessary, you can create different service profiles for different operating systems, restricting access for users with less secure systems.

  • Whether your service profile will include a phone book or multiple phone books. If your service profile will include one or more phone books, you will need to create the phone book with Phone Book Administrator (PBA), and you will need to include a Phone Book Service (PBS) server in your deployment. For more information, see Security information for Connection Point Services.
  • How you will distribute your service profile. You can distribute your service profile in several ways, including on a Web site and on portable media such as floppy disks. Depending on what kind of service profile you create, you might want to consider how to control the distribution of your profile. For example, if you create a profile with a pre-shared key, you will want to limit distribution of the profile to authorized users, particularly if you do not encrypt the profile with a personal identification number (PIN). For more information about distributing service profiles, see Planning for effective implementation.

    • For detailed information about deploying Connection Manager, see "Deploying Remote Access Clients Using Connection Manager" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)


Deciding what to customize

You use the Connection Manager Administration Kit (CMAK) wizard to do most of the customization for a service profile. Before running the CMAK wizard, you need to decide what to customize and then provide the information and files needed to run the wizard and implement your decisions. To help prepare for creating a service profile, you can complete the planning worksheet that is available in the Microsoft Windows Server 2003 Resource Kit. For more information about Connection Manager, see "Deploying Remote Access Clients Using Connection Manager" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

Although you can run the wizard and build your service profile without providing any custom information except for the name of your service and a file naming convention to be used for your service profile files, you can customize many other things to meet the needs of your service. For example, you can:

  • Reconfigure user routing tables with your service profile in order to better manage your network traffic and security.
  • Reconfigure user proxy settings to ensure that the user has appropriate access to internal and external resources while connected to your service.
  • Merge previously created service profiles into the one you are building, in order to incorporate phone books and other features from those service profiles.
  • Provide a customer-support phone number or other customer-support information in the Connection Manager logon dialog box.
  • Provide a realm name (prefix or suffix) that is appended to the user name (to specify network routing and authentication information needed by your Internet service provider, without requiring your users to understand and incorporate the information themselves).
  • Specify dial-up entries to be associated with phone numbers in the phone book you provide to your users.
  • Support virtual private network (VPN) connections over the Internet.
  • Incorporate custom actions that run at specific points during the connection process.
  • Incorporate your own graphics in place of the default graphics provided in Connection Manager logon and phone book dialog boxes.
  • Provide a phone book and phone-book update capabilities to your users.
  • Incorporate your own custom icons in place of the default Connection Manager icons.
  • Customize the menu associated with the notification area shortcut when your users are connected.
  • Customize the default Help file provided with Connection Manager.
  • Include Connection Manager 1.3 in your service profile.
  • Incorporate an end-user license agreement (EULA) in your service profile that users must accept in order to install your service profile.
  • Include additional support files in your service profile, such as user documentation files and custom programs and files needed to support custom actions that you have defined.
  • Enhance security by enabling server callback to users.

You should consider each of these decisions for each service profile you create. Depending on the target audience and other factors, your decisions will vary for each service profile. Before you implement your decisions, you should also consider the effects of your implementation and any potential integration issues. For information on planning for integration, distribution, installation, and other implementation considerations, see Planning for effective implementation. This section provides the information you need to support effective and efficient planning and development efforts.


Planning for effective implementation

When you make decisions about customization, you should be aware of how your decisions affect Connection Manager implementation methods. When developing plans for a service profile, consider implementation impacts on:

  • The number of service profiles to be developed.
  • The distribution methods to be used.
  • Streamlining installation with additional components.
  • Integrating your Connection Manager service profile with an Internet Explorer installation package.
  • The size of the service profile.
  • Phone book support to be implemented.
  • Maintenance and update requirements for the service profile, including all files included in the profile.

The following sections discuss how customizing your service profile can affect how it is implemented. For additional information on setting up multiple profiles and how each service profile is set up and maintained, see Setting up your service profiles.

How many service profiles do you need?

You can create additional service profiles to support specialized needs of specific groups or personnel. For example, if you support multiple geographic locations, you might want to create separate profiles for the specific locations, incorporating a unique local phone book in each. Or, you might want to create separate profiles for each operating system supported by your service.

If a user installs more than one service profile, each profile is installed in a separate folder. All profiles share the same copy of Connection Manager software.

To provide support for another language, you must run the Connection Manager Administration Kit (CMAK) wizard on a computer with an international version of a Microsoft operating system that uses the appropriate language.

What distribution methods are appropriate?

You can distribute your service profile by compact disc or downloadable file (over a private network or the Internet). You should consider the size of your customized profile, including all files that you add to it, when you determine which distribution method to use. Remember that download time can significantly affect users, especially those running modems at relatively slow speeds.

If you are using the Internet Explorer Administration Kit 5.5 (IEAK 5.5) to distribute Internet Explorer 5.5 to your users, you can simplify installation for them by including a Connection Manager profile in an Internet Explorer installation package. Files included in the Internet Explorer installation package should not be duplicated in the Connection Manager profile.

What is the size of your service profile?

It is important that the size of your service profile be compatible with your distribution method. Consider the features you want and how you plan to distribute the profile: by compact disc or download.

For example, if you distribute by download, consider how the download time affects users. In some cases, you might decide to use or offer users an alternate distribution method. The CMAK wizard does not support profiles that span multiple disks and does not prompt you if the profile does not fit on one disk.

A service profile that includes Connection Manager uses about 800 kilobytes (KB) of disk space. A profile without Connection Manager can use as little about 200 KB. The total size of your service profile depends on your customization options, such as the method you use to provide phone books, whether you include custom actions or other optional programs, and which graphics you incorporate.

Note

  • If disk space allows, include Connection Manager in the service profile to ensure that your users always have the latest version.

How can you streamline installation for your users?

You can simplify installation and updates for your users by incorporating programs and files that can be automatically installed and configured as part of the Connection Manager installation package. You can tailor these features to the individual needs of specific user groups to control the size of the service profile that you distribute and to promote the effective use of your service. For example, if you support a corporate account with marketing and accounting departments, you might provide separate profiles for each department, so that you could provide the marketing department with a phone book covering the entire sales area, and you could provide the accounting department with a phone book containing only the numbers of the local access points.

How can you integrate your service profile with an Internet Explorer installation package?

Some of your planning decisions will depend on whether you are integrating Connection Manager and your custom service profile with an Internet Explorer installation package or other implementation package. You should determine your delivery method before creating a service profile, to determine any impacts of integration.

For example, if you decide to integrate your Connection Manager service profile with an installation package created with the Internet Explorer Administration Kit (IEAK), you might want to coordinate the graphics included in your profile with those you include in the installation package.

Also, if you decide to deliver your Connection Manager service profile with an Internet Explorer installation package, you must create the Connection Manager service profile first. Unlike the IEAK 5 wizard, which had a button to call CMAK directly, the IEAK 5.5 wizard has no direct link to CMAK.

After building your service profile, check the information in Phase four: Preparing for integration, delivery, and installation to determine additional customization that may be needed to integrate your service profile with other packages.

What phone book support is required?

You can provide a single phone number for user connection, or you can provide additional support for roaming access by providing a phone book of access numbers. Using Connection Point Services, you can provide phone book support with automatic updates, but you need to create the initial phone books and decide how the phone book support is to be implemented before running the CMAK wizard. For more information, see Connection Point Services and Connection Manager.

What is required to maintain and use existing service profiles?

You can incorporate many types of files in a service profile. You can edit or merge other profiles, include program files to support custom actions and monitored applications, and provide user documentation to customize Connection Manager appropriately for your users.

In order to maintain these service profiles so that you always use the appropriate version of an incorporated file, you should understand how the CMAK wizard incorporates and uses such files. For information about how files and folders for your profile are set up, see Setting up your service profiles.

When you edit a service profile that contains a merged service profile, the CMAK wizard attempts to use the latest version of the merged profile. If the CMAK wizard cannot find the merged profile in the appropriate \Program Files\CMAK\Profiles\ServiceProfileFileName folder, it defaults to the current version of the merged profile that was originally stored with the profile being edited.

Plan your profiles, especially those with incorporated files, so that the information and elements are easily maintained and updated as needed.


Creating profiles in multiple languages

You can use language-specific versions of the Connection Manager Administration Kit (CMAK) wizard to create service profiles in different languages. If you create your profiles with the same wizard options in different languages, you can provide your users with the same connection experience independent of language. For example, you can allow your users who speak French and your users who speak Japanese to connect to your service or private network in the same way.

Creating profiles for users of operating systems other than XOX or the Windows Server 2003 family

You can purchase installation CDs for the Windows Server 2003 family in a variety of languages. However, each CD is specific to only one language, known here as the system language. To build a profile for users who are not running XOX or a member of the Windows Server 2003 family, you will need to purchase a separate CD for each language in which you intend to create a profile. For example, if you want to create a German service profile for users who are not running XOX or a member of the Windows Server 2003 family, you must purchase and install the German version of a Windows Server 2003 operating system.

The reason that you must purchase a separate CD is that profiles built with the Windows Server 2003 family require Connection Manager 1.3 to function. Users who are not running XOX or a member of the Windows Server 2003 family will not have Connection Manager 1.3, so you must include it when you build a profile for them. The version of Connection Manager 1.3 you include will appear in your system language, regardless of whether it matches the system language of your users. The only way to change your system language to match the system language of your users is to install a version of the operating system that is specific to the system language of your users. Even if you create a profile on a Multi-Language User Interface (MUI) version of the Windows Server 2003 family, Connection Manager still appears in the system language that is specific to that version.

Creating profiles for users of XOX or the Windows Server 2003 family

For users who are running XOX or a member of the Windows Server 2003 family, you do not need to include Connection Manager 1.3 when you create a profile. However, you must change your input language and your Language for non-Unicode programs settings so that they match the system language of your users. Your input language determines which characters you can type in the CMAK wizard and as you create phone books. The CMAK wizard itself and Phone Book Administrator will still appear in your system language. If your input language differs from your system language, a warning message appears when you start the CMAK wizard. The message should remind you that, if you include Connection Manager 1.3, it will appear on your users' computers in your system language, which might not match that of your users. If you do not plan to include Connection Manager 1.3, you can close the warning message and proceed with the wizard.

For more information about changing your input language, see Add another language. For more information about changing Language for non-Unicode programs settings, see Display non-Unicode programs in their native language.


Phase two: Developing custom elements

Depending on what you customize, you might need additional resources to prepare your elements. For example, if you want to include a phone book in your service profile, you must get copies of the phone book and region files. Or, if you want to include custom icons and bitmaps, you might need additional programs or graphics specialists to prepare them.

This section provides guidelines for the technical team members who are responsible for creating the graphics, information, programs, and other special elements to customize Connection Manager for your needs:

  • Setting up your service profiles
  • Specifying service and file names
  • Providing a realm name
  • Merging phone books and other features from existing service profiles
  • Implementing VPN support
  • Incorporating VPN entries
  • Including a pre-shared key
  • Providing phone book support
  • Incorporating custom dial-up entries
  • Including routing table updates
  • Using automatic proxy configuration
  • Incorporating custom actions
  • Incorporating custom graphics
  • Incorporating custom icons
  • Customizing the notification area shortcut menu
  • Providing custom Windows Help
  • Providing support information in the logon dialog box
  • Adding Connection Manager 1.3 to the service profile
  • Incorporating a license agreement
  • Including additional files
  • Providing user documentation
  • Advanced customization

These guidelines can be reproduced and distributed to the individuals responsible for doing the design and development work.


Setting up your service profiles

Each time you run the Connection Manager Administration Kit (CMAK) wizard, you create a service profile. You can create as many profiles as needed to support each specific target audience. After creating an initial profile, you can use the CMAK wizard to edit it. You can save the edited profile under the same name to overwrite the existing profile, or you can specify a different service name and file name to save it to a separate profile (preserving the existing profile as it was before you started the edit).

Notes

  • To create a service profile for another language, use the version of the operating system and the CMAK wizard that are appropriate for the language.
  • When you edit a service profile created using a previous version of Connection Manager, the CMAK wizard automatically upgrades the profiles to Connection Manager 1.3. Any changes you have made manually to the .inf file (using advanced customization techniques) will not be retained in the upgraded file. However, the CMAK wizard creates a backup of the old .inf file before creating the updated file.
  • If you change the file name, be sure to change the service name also. If a user installs two service profiles with the same service name but different file names, the service profiles do not work correctly.

Each service profile should be specific to a target audience. For example, you might set up separate profiles if:

  • You want to make each service profile specific to a single operating system.
  • You specify phone books to support each of your distinct geographic areas or corporate organizations.
  • Different users require different connection methods (dial-up versus direct).
  • You need to support virtual private network (VPN) connections only for specific users.
  • The individual corporations or groups you support each want to use their own logos or other proprietary symbols or text.
  • The help desk or other support is not the same for everyone and you want to provide specific information to each user group.
  • You want to establish different administrative authorities for the groups you support.

Note

  • To simplify administration of multiple service profiles, you can merge existing profiles into a parent service profile. See Merging phone books and other features from existing service profiles.

You must run the CMAK wizard again for each service profile you want to create, including each service name or file name you want to present to your users. For more information on service and file names, see Specifying service and file names.

It is easier to create additional service profiles if you edit an existing profile and then change the service name and file name.

When you create a service profile, the CMAK wizard copies all files that are incorporated in the profile into a \Program Files\CMAK\Profiles\ServiceProfileFileName folder. When you edit existing profiles, the CMAK wizard always pulls the incorporated files from the ...ServiceProfileFileName folder. To make changes to the incorporated files, edit the incorporated file in the ...ServiceProfileFileName folder and then run the CMAK wizard again to update the service profile. Or, if you edit the file that is not in the ...ServiceProfileFileName folder, start the CMAK wizard, add the updated file (by browsing to find it), and then finish running the wizard.

Note

  • Connection Manager supports user installation of multiple service profiles, running multiple instances of Connection Manager, and multiple user profiles for each service profile. If a user installs more than one service profile, each is installed in a separate folder. You can provide as many profiles to your users as necessary to support your service, but each must have a different service name and file name.


Specifying service and file names

You must specify a service name and a file name in the CMAK wizard to identify your service profile.

Service name

The service name identifies your service to the users. This name is limited to 35 characters. This name appears at several points when the user runs your service:

  • In the title bar text for the logon dialog box for your service.
  • In dialog boxes that appear during installation of Connection Manager and the service profile.
  • As the desktop icon name for your service.
  • On the program button on the taskbar that appears when the program is running.
  • In the ToolTip that appears when the mouse points to the notification area shortcut, which is located at the far right of the taskbar.
  • Within the service-profile files, for entries such as the default dial-up entry.
  • In the Network Connections (XOX and the Windows Server 2003 family), Network and Dial-up Connections (Windows 2000), or Dial-up Networking (Windows 95, Windows 98, and Windows Millennium Edition) folder, as the name of the remote access connection.

This name is often a company or other business name. For example, the fictitious company Awesome Computers, which is used for many of the examples in this documentation, might specify "Awesome Computers" as the service name. Or, if Awesome Computers wanted to set up separate service profiles for each department, the service name for one of them might be "Awesome Computers - Marketing."

Important

  • Do not use any of the following characters in your service profile name: * \ / : ? " < > | [ ] & ´ % ' `

File name

The file name is the name given to the files created by the CMAK wizard when building the service profile. The file name can be up to 8 alphanumeric characters, with the following limitations:

  • Do not use any of the following: ! , ; <space> * = \ / : ? ' " < > | . % + [ ] $ # & @ ( ) { } ´ ` ~
  • Do not use extended character sets in a file name. A file name created with extended character sets (such as those containing ü, é, and other extended characters) might not be properly installed.

Notes

  • Make sure that the service and file names are different from all other service and file names that you provide to your customers. If two service profiles on the same computer have the same service or file name, the associated connection icons do not work correctly.
  • When editing an existing profile, if you do not want to write over the existing service profile, you must change the file name.

The file name is used for the following files created by the CMAK wizard, including:
  • The folder containing the files needed to install Connection Manager and the service profile, located at \Program Files\CMAK\Profiles\ServiceProfileFileName.
  • The self-extracting executable (.exe) file.
  • The .cms file, which contains the configuration data for Connection Manager features, such as the names of the phone book and connection methods.
  • The .cmp file, which stores user-specified information, such as the name of the .cms file to be used.
  • The .inf file, which is used for the setup and installation of Connection Manager on the user's computer.
  • The .sed file, which specifies the contents of the .cab file and how to compress the files when the service profile is built.

The file name for the service profile is also used for the folder created on the user's computer when the .exe file is run.

For more information on what files are created by the CMAK wizard, see Using the CMAK wizard to build a service profile.


Providing a realm name

Realm names are used for network routing and authentication. They provide the identification necessary to forward authentication requests to the server that holds the user's credentials. Realm information is only used for dial-up connections.

Using the CMAK wizard, you can specify a realm user-name prefix (such as Awesome/) or suffix (such as @Awesome) to be added to the user name that a user enters when connecting to your service. The realm name includes any separator characters, such as @ or /. If you specify the realm, users do not have to provide it themselves because Connection Manager automatically places the realm name before or after the user's name so that the user does not have to understand network routing in order to log on.

If your service uses multiple networks or ISPs for access, you need to provide different realm information for each. In this case, create service profiles for each of the networks and then merge them together in a top-level profile.

Notes

  • If the top-level profile contains realm information, it will take precedence over the information in the component profiles.
  • For more information on merging profiles to incorporate multiple realms, see Merging phone books and other features from existing service profiles.

Internet Authentication Service (IAS) supports the use of realm names for remote authentication. You can use the realm name as authentication routing information for remote roaming users (users who travel and connect through different Internet access points). When the user connects through a network access server (NAS), the NAS sends the realm name, the user name, and the user password to the authentication server. For more information on IAS, see Internet Authentication Service.


Merging phone books and other features from existing service profiles

If you have information in existing service profiles that you need in the service profile you are building, you can use the Connection Manager Administration Kit (CMAK) wizard to merge much of the information from existing profiles into the profile you are building. A profile that contains information from other service profiles is called the top-level profile. A service profile that has its information merged into another service profile is called a component profile.

Why merge service profiles?

Merging service profiles is especially useful for incorporating information from multiple phone books, including service types, Point of Presence (POP) names, and access numbers, and to consolidate different Internet access points that are covered by more than one of your phone books. By merging existing service profiles into the service profile you are building, you can make several dissimilar networks appear to be a single, cohesive service.

For example, you can merge service profiles from different geographical locations to create a worldwide profile. Or you can create profiles that have specific administration requirements and network configurations, including authentication and TCP/IP characteristics and, after they are created, you can merge them together within a top-level service profile. Merging service profiles is especially useful where multiple entities, whether corporations or Internet service providers (ISPs), share in providing a service. The following examples show how you can use merged service profiles to simplify network access through diverse access points:

  • Example 1: Creating a service profile to support access to the Internet from remote service areas. If a local ISP contracts with a roaming consortium to provide dial-up services outside the ISP's primary service area, the local ISP could create a top-level service profile containing the local ISP's network information and merging the service profiles of the other members of the roaming consortium. Each component service profile could contain the individual phone-book and network attributes, including a unique realm name, of an individual ISP. Merging all of the component service profiles would support the need for users of the local ISP service to roam outside of the ISP's primary service area by enabling them to connect through the cooperating ISPs. All ISPs can maintain their own service profiles, simply redistributing profiles to other members of the consortium whenever they are updated. The consortium itself might also create a top-level service profile aggregating the services of all member ISPs.
  • Example 2: Implementing a corporate virtual private network (VPN). Corporations using VPN connections for a session by establishing a tunnel through the Internet to the corporation often use ISP-provided dial-up access to support corporate access from remote locations. By merging service profiles, the corporation could combine its own phone book of internal dial-up numbers with those of remote ISPs contracted to provide access points for the remote corporate users, enabling VPN connections to be established even for dial-up connections through the public network access point of the ISP. The corporation and each ISP could maintain its own service profiles, but the corporation could merge all of the ISP service profiles into the corporate profile. The distribution of the top-level service profile by the corporation to all corporate users would support access from multiple locations. This access would appear to users as if it were made using the corporation's own access points.

What information is merged

The following table shows which features of a component service profile are merged into the top-level service profile and how the CMAK wizard incorporates the merged information. Only the items from the component service profile that are listed in the Merged features column are recognized and used by the top-level service profile.

Merged features | Implementation notes
File name | Files contained in the component service profiles retain the names used by the component service profiles.
Merged profiles | You can merge only one level of service profiles. For example, if you merge service profile A, which contains component profiles B and C, these second-level component profiles (B and C) are ignored.
Realm name | If a realm name is specified in the top-level service profile, it will be used in all instances, and all realm names specified in the component service profiles are ignored. If no realm name is specified in the top-level service profile, the realm names specified in the component service profiles are used for connections that are made using entries from the component service profiles.
Dial-up entries | The script specified for each dial-up entry must have a unique name than all other scripts contained in the top-level service profile and any component profiles.
Phone books | If the same service types exist in more than one profile, the information is merged. If duplicate states (or provinces), or POPs exist among top-level and component service profiles, Connection Manager removes the duplicates when it runs the top-level service profile. Connection Manager treats two phone book entries as duplicates if they display the same information in the user interface (except that Connection Manager is not case sensitive). If two phone book entries appear as duplicates but have separate configuration data in the POP, Connection Manager still removes one of the phone book entries.
Download phone book | Each time the user establishes a connection, Connection Manager automatically checks for the phone books with each server that is running Phone Book Service (PBS). PBS checks the phone book version and, if necessary, downloads phone book updates to the user. Phone books specified in the top-level and component phone books are downloaded, as appropriate to the respective service profiles.
URL for downloads | The URLs specified in the top-level and component service profiles are used for downloads to phone books for the respective service profiles.

The top-level service profile does not merge information related to the following features of the component profile. To affect these features, you must specify them in the top-level service profile:

  • Service name
  • Support information specified for the logon dialog box
  • VPN support
  • Custom actions
  • Monitored applications
  • Custom graphics for the logon dialog box and Phone Book dialog box
  • Message to display next to the More access numbers box when alternate access numbers are available for the selected geographic location
  • Custom icons
  • Customization options for the notification area shortcut menu
  • Custom Help files
  • Option to include Connection Manager software in the service profile
  • License agreement
  • Additional files

Note

  • To support VPN connections for component service profiles, in the VPN Support pane of the CMAK wizard, under Establish a virtual private network (VPN) connection when the user dials a phone number from these phone books, select the Phone books from the merged profiles check box.

Where the files are located

When you create a service profile, the CMAK wizard copies all files referenced in the service profile, including the component service-profile files, into the \Program Files\CMAK\Profiles\ServiceProfileFileName folder for that service profile.

When you use the CMAK wizard to merge features, the top-level service profile includes references to the component (merged) service profiles. For example, for phone books in merged service profiles, the resulting service profile installs multiple files in the folder specified for the profile rather than combining the phone books into a single file. However, when users select a POP involving phone books merged from two other service profiles, the users see the information from all the phone books as a single phone book.

When you edit a top-level service profile, the CMAK wizard attempts to use the latest version of the component service profile. If the CMAK wizard cannot find the merged service profile in the \Program Files\CMAK\Profiles\MergedServiceProfileFileName folder (for the top-level service profile), it uses the current version of the merged service profile that was originally stored with the service profile being edited.

Special considerations for building merged profiles

When building merged service profiles:

  • If you merge a Connection Manager 1.0 service profile into a Connection Manager 1.3 service profile, the CMAK wizard automatically updates the merged information to Connection Manager 1.3. Any changes you have made manually to the .inf file (using advanced customization techniques) will not be retained in the upgraded file. However, the CMAK wizard creates a backup of the old .inf file before creating the updated file.
  • You should provide separate service profiles for each network that has unique characteristics or requirements.
  • You must ensure that all scripts specified for dial-up entries in the merged service profile are available when you build the top-level service profile.


Implementing VPN support

A virtual private network (VPN) connection provides remote access to private networks over the Internet (or other network). A VPN connection is established using a tunneling protocol to establish a tunnel through the Internet to the private network. To establish a VPN connection, users can connect directly to the private network through the tunnel by either dialing into a local Internet service provider (ISP) or by using a pre-existing connection to the Internet (direct connection).

This means that remote users can connect using worldwide Internet access points to access private resources as easily as local users. For corporations, it means that employees have remote access over the Internet to their corporate private networks, usually through a local phone number. By having users create VPN connections rather than dial-up connections, the company does not incur the considerable expenses associated with long distance telephone service without compromising security.

You can use the Connection Manager Administration Kit (CMAK) wizard to set up VPN connections, including:

  • Make a direct connection to a private network.
  • Tunnel to a private network over a public network, such as the Internet.
  • Select a VPN server for the connection.

Using the CMAK wizard, you can set up support for VPN connections using Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP). To use these VPN connections, you must have a remote access server on the private network configured to support the appropriate protocol.

Important

  • A VPN connection requires the computer on which Connection Manager is run to be configured to use the same network protocols that the private network uses.
  • VPN connections on computers running Windows Millennium Edition, Windows 98, or Windows 95 require that users have the latest Dial-up Networking software installed on their computers. Users can obtain the current Dial-up Networking software by downloading it as a Windows Update from the Microsoft Web site (http://www.microsoft.com). You should document this requirement for your users. For more information on verifying and installing Dial-up Networking software, see Providing user documentation.

You can create a service profile with which users can establish direct VPN connections using a tunnel over pre-existing connections. For example, users who are already connected to the Internet through DSL or a cable modem can then connect to your private network using a VPN-only profile you created. To create a VPN-only profile:

  1. Start the CMAK wizard.
  2. On the VPN Support pane, select the Phone book from this profile check box, and specify a VPN server (by DNS name or IP address) or specify a VPN file (by typing the full path to the file).
  3. Configure the VPN entry or entries with the correct security and addressing information for your network.
  4. Do not specify a phone book file on the Phone Book pane, and clear the Automatically download phone book updates check box. You do not need to configure the default dial-up entry for the profile.
  5. On the last pane of the wizard, select the Advanced Customization check box.
  6. On the Advanced Customization pane, click the profile .cms file, click [Connection Manager], and set the value of the Dialup key to zero.
  7. Click Apply, and finish the wizard.

This process will create a VPN-only profile, without a General tab in the Properties dialog box for the profile. Users of your profile will not see any phone or dialing information.

Setting up a dial-up profile to support VPN connections might add an Internet Logon tab to the Properties dialog box. On this tab, users type the user name and password for the Internet service provider. In the logon dialog box, users type a private network user name, password, and logon domain.

To implement VPN connections in your service profiles, you must specify the address of at least one server to be used and how to handle authentication. As you run the CMAK wizard:

  • You must have the VPN server address, specified either as a Domain Name System (DNS) name or as an IP address.
  • If you do not want to let the server assign addresses for DNS and Windows Internet Name Service (WINS) servers, you can specify the addresses to be used.
  • You must specify whether users enter the same user name and password for both logging on to the Internet using a dial-up connection and logging on to the private network server using a VPN connection. If you specify that the same credentials are to be used for both, the Internet Logon tab does not appear and the user only has to enter credentials once to connect.
  • You must specify the VPN security settings to be used for connections made with this profile. By default, the security setting is selected to Configure both basic and advanced settings, which requires a configuration for profiles installed on Windows 95, Windows 98, Windows NT 4.0, and Windows Millennium Edition, and a different configuration for profiles installed on Windows 2000, XOX, and the Windows Server 2003 family. Windows 2000, XOX, and Windows Server 2003 operating systems have more advanced security features and can support a higher level of security for your connection. You can choose to require the use of advanced security settings only, although this setting might prevent some clients on other operating systems from connecting with your profile. You can also choose to only use basic security settings that all operating systems that support Connection Manager can utilize. However, this means that all profiles will use the basic security settings, regardless of whether the operating system can support a higher level of security.

For more information on keys to be used with direct connections, see Advanced customization.

Enabling user choice of VPN server

You can allow your users to choose from multiple VPN servers when they connect to your service. For example, a user could select a VPN server that is close to his or her location, or a user could choose a VPN server that has higher security settings. For service profiles that support this option, a VPN tab appears in the properties dialog box for the service profile. This tab contains a customized text message and a list of VPN servers.

To enable your users to choose a VPN server from a list when they connect to your service, you must create a VPN file before you start the CMAK wizard. A VPN file is a text file that you can create with any plain-text editor, such as Notepad. The table below identifies sections, keys, and values that compose a VPN file.

[Section] or key name | Value
[Settings] | Section header for the keys that contain VPN settings.
Default | The friendly name of the default VPN server for this service profile. If you create this key but do not give it a value or if you do not create this key, the user must select a VPN server the first time the user connects with the service profile.
UpdateURL | The URL of the Web server that contains updates for this VPN file. If this key is added, a post-connect action is added automatically to the service profile. This post-connect action updates the VPN file.
Message | The text message that appears on the VPN tab in the properties dialog box for the service profile. This message cannot exceed 256 characters, and it must be a single paragraph. If this key is created but left blank, default text is used.
[VPN Servers] | Section header for the keys that identify VPN servers.
FriendlyName | The name of this key is the friendly name of one of the VPN servers available to your users. The value of this key is the DNS or IP address of the VPN server for which you named the key. If you want this VPN server to use a specific set of network and security settings, you must follow the DNS address with a comma and the name of a VPN entry that you will edit in the VPN Entries pane of the CMAK wizard. If you do not specify a VPN entry, the VPN server will use the settings for the default VPN entry.

If the fictional company Awesome Computers wanted to provide its users with a choice of VPN servers, an administrator might create a VPN file similar to the example below.

[Settings]
default=Awesome Computers HQ
UpdateURL=http://awesomecomputers.microsoft.com/VPNfile.txt
Message=Please select a server from the following list. You might want to choose a server closest to your location or to your data. Windows 98 users should choose Awesome Computers Windows 98.

[VPN Servers]
Awesome Computers HQ=awesomecomputers.microsoft.com
Awesome Computers New York=ny.awesomecomputers.microsoft.com
Awesome Computers Spain=es.awesomecomputers.microsoft.com,Awesome International VPN Settings
Awesome Computers Madagascar=ma.awesomecomputers.microsoft.com,Awesome International VPN Settings
Awesome Computers Windows 98=awesomecomputers.microsoft.com,Awesome 98 VPN Settings

In the above example, the VPN servers Awesome Computers HQ and Awesome Computers New York use the settings specified in the default VPN entry. Awesome Computers Spain and Awesome Computers Madagascar will use the settings specified in the VPN entry named Awesome International VPN Settings. A VPN server has been created for clients running Windows 98, and it uses the settings specified in the VPN entry named Awesome 98 VPN Settings. Users will see the friendly names of the VPN servers you have defined.

Related Topics


Incorporating VPN entries

You can configure connection and security settings for the VPN server or servers that support your service profile. If you customize these settings, you can better handle unique network authentication or routing requirements of particular service profiles.

Before you can configure a VPN entry to support a VPN server or servers, you must specify whether users of your service profile must use a particular server or they can choose between servers. You specify this in the VPN Support pane of the Connection Manager Administration Kit (CMAK) wizard. If you allow your users to choose between servers, each server you specify appears in a list on the VPN tab of the properties dialog box for the service profile. For more information, see Implementing VPN Support.

You can specify the following settings for each VPN entry:

  • Whether to enable file and printer sharing
  • Whether to enable clients to log on to a network
  • Whether to assign static or dynamic IP addresses for Domain Name System (DNS) and Windows Internet Name Service (WINS) servers
  • Whether to make this connection the default gateway for the client
  • What security settings to apply, based on the client operating system
    • What authentication methods to use
    • What encryption methods to use

You must edit each VPN entry to provide the network and security configuration necessary for a client to connect to any of your VPN servers that use that entry. For example, if you want to configure a profile to require smart cards, on the VPN Entries pane, click the VPN entry that you want to configure, click Edit, click the Security tab, click Configure for advanced security settings, click Use Extensible Authentication Protocol (EAP), and then click Smart Card or other certificate (encryption enabled).

All VPN servers use the default VPN entry unless you specify a different entry in the VPN file. If you do not edit the default VPN entry, it will use default settings provided by the CMAK wizard, which might not be appropriate for your network.

Notes

  • The VPN entry that you add or edit in VPN Entries must have exactly the same name as one you specified in the VPN file. If you add a VPN entry (by clicking New), you must add a matching entry manually to the VPN file to make the VPN server available to your users.
  • On the General tab, the option Disable file and printer sharing affects only computers running Windows NT 4.0, Windows 2000, XOX, or a member of the Windows Server 2003 family.
  • On the General tab, the option Enable clients to log on to a network affects only computers running Windows 95, Windows 98, or Windows Millennium Edition.

Related Topics


Including a pre-shared key

You can use a pre-shared key instead of a certificate for L2TP/IPSec authentication of your VPN clients that are running XOX or a member of the Windows Server 2003 family. Pre-shared keys do not require a public key infrastructure (PKI) for deployment, but they are a relatively weak authentication method. You can increase the security of your pre-shared key deployment by encrypting the pre-shared key with a personal identification number (PIN), which your users must enter before the profile will install.

Advantages and disadvantages of pre-shared keys

Using pre-shared key authentication does not require the infrastructure investment of a PKI. Pre-shared keys and certificates can be used on the same remote access server. If the pre-shared key on the remote access server is changed, no pre-shared key VPN clients will be able to access the server until the pre-shared key on the clients are changed by reissuing and reinstalling the service profile. Unlike certificates, the origin and history of a pre-shared key cannot be determined. Administrators who want a long-term, strong authentication method should consider using certificates.

Considerations when creating pre-shared keys

A pre-shared key is a string of text that is configured on both the remote access server and the client. A remote access server running a member of the Windows Server 2003 family can be configured with only a single pre-shared key. All L2TP/IPSec VPN clients that connect to the remote access server using a pre-shared key must use the same pre-shared key. The pre-shared key can be any non-null string of any combination of between 8 and 256 characters. If there is any deviation between the pre-shared key on the remote access server and the pre-shared key presented by the VPN client, client authentication will fail. For more information about routing and remote access on computers running any member of the Windows Server 2003 family, see Routing and Remote Access.

Increasing the security of a pre-shared key by encrypting it with a PIN

You can increase the security of the distribution of your pre-shared key profile by encrypting the pre-shared key with a PIN. By distributing the service profile and the PIN separately, you will reduce the chances that unauthorized users can install the profile and gain access to your network. A PIN must contain no fewer than 4 but no more than 15 characters. Be sure to distribute the PIN to your users in a secure manner. This PIN will be requested only when the user installs the profile.

Configuring a service profile to use a pre-shared key

To configure a service profile to use a pre-shared key:

  1. On the VPN Entries pane, click the VPN entry that you want to configure to use a pre-shared key, and click Edit.
  2. On the Security tab, under Common security settings, click Configure.
  3. Under VPN strategy, click Use L2TP/IPSec if available, and select the Use a pre-shared key when using L2TP/IPSec check box. Finish configuring any other aspects of security that your profile requires, and click OK.
  4. Edit each VPN entry that requires a pre-shared key, and click Next.
  5. On the Pre-shared Key pane, type a pre-shared key.
  6. Do one of the following:
    • Type a PIN to encrypt the pre-shared key.
    • Clear the Encrypt the pre-shared key using a PIN check box.
  7. Click Next, and finish building the profile.


Providing phone book support

Connection Point Services (CPS) provides support for creating, maintaining, and updating phone books. You can also create your own phone book (without CPS), but the complexity of the format and requirements makes this difficult if you have more than a single Point of Presence (POP). For more information, see Connection Point Services and Connection Manager.

Specifying how the phone book is to be provided

Using the Connection Manager Administration Kit (CMAK) wizard, you can either:

  • Include a phone book in your service profile, without support for automatic upgrades. To do this, in the CMAK wizard:
    1. In the Phone Book pane, browse to the phone book (.pbk) file that you want to include in your service profile. Make sure that you have a region file with the same name located in the same folder as the .pbk file. For example, if your phone book file name is AwesomeE.pbk, the region file should be AwesomeE.pbr.
    2. Make sure that the Automatically download phone book updates check box is not selected.
  • Include a phone book in your service profile, with support for automatic upgrades. To do this, in the CMAK wizard:
    1. In the Phone Book pane, browse to the phone book (.pbk) file that you want to include in your service profile. Make sure that you have a region file with the same name located in the same folder as the .pbk file. For example, if your phone book file name is AwesomeE.pbk, the region file should be AwesomeE.pbr. Make sure the Automatically download phone book updates check box is selected.
    2. In the Phone Book Updates pane, type the URL for the Phone Book Service (PBS) server from which upgrades are to be downloaded.
  • Do not include a phone book in your service profile, but download the phone book (and upgrades) to your users later. To do this, in the CMAK wizard:
    1. In the Phone Book pane, select Automatically download phone book updates, but leave the Phone book file box blank.
    2. In the Phone Book Updates dialog box, type the name of the phone book (.pbk) file to be downloaded (but do not include the file name extension) and the URL for the PBS server from which it (and the upgrades) can be downloaded.
    If you use this method of providing the phone book, you will also be able to automatically download updates to your users, using the same phone book name and URL.

The phone book name that you provide must match the name of the phone book file created with CPS. This file name consists of a maximum of 8 alphanumeric characters and cannot include spaces or a file name extension. If you specify support for automatic updates, each time the user connects to your service, the PBS server automatically downloads any updates to the phone book.

Using more access numbers

Using Phone Book Administrator in CPS, you can set up phone books to list certain POPs under Access numbers and other POPs under More access numbers. If you want to separate phone numbers into two sets, you must configure the phone book for this purpose before you use it in a service profile. You can separate the numbers in different ways, such as by separating standard access numbers from 800 and 888 numbers or by separating no-surcharge access numbers from access numbers that incur a surcharge when a user uses one of them to connect. For more information, see Connection Point Services.

If your phone book specifies a second set of access numbers, those numbers appear in the More access numbers box in the Phone Book dialog box.

To customize information about these numbers:

  • Provide a line of text to appear in the dialog box, next to the More access numbers box. This line of text should be no more than about 100 characters. (The maximum size varies based on line breaks and other formatting considerations.) This line of text appears only when alternate access numbers are available for the selected geographic area.
  • Edit the definition Help for the list of alternate phone numbers. The default Help states that the user can be charged extra for using alternate phone numbers. If this is not true for your alternate phone numbers, edit these Help topics in the Cmtrb32.rtf file: IDH_PHONEBOOK_ACCESSNUMS and IDH_PHONEBOOK_MORE. For more information on customizing Help, see Providing custom Windows Help.

Advanced customization for the phone book

Through advanced customization, you can also:

  • Control which service types (such as modem or ISDN) appear in the Phone Book dialog box.
  • Change the message displayed during phone book updates (such as "Downloading new Awesome Computers backup company phone book.").
  • Control the delay before downloading phone book updates.

For more information on advanced customization techniques, see Advanced customization.

Creating a single-POP phone book

You can include a default phone book that contains a single phone number. This is useful if you want your customers to access your service through one POP. When you want to create a phone book for multiple POPs, you should use CPS.

To create a single-POP phone book, you must create both a phone book (.pbk) file and an region (.pbr) file. In the CMAK wizard, you specify only the name of the .pbk file, but the wizard requires that a .pbr file with the same name be located in the same folder as the .pbk file.

Creating a .pbr file for a single-POP phone book

The region file you create for your single-POP phone book must be in plain-text (.txt) and must have two lines:

  • The first line contains a number specifying how many regions are in the region file.
  • The second line contains the name of the state or province (or other geographical area). Do not use commas or semi-colons in this line. The file name (excluding the extension) cannot exceed eight characters.

For example, if the POP were located in Washington, the contents of the single-POP .pbr file would be:

1
Washington

To create a .pbr file for a single-POP phone book

  1. Start a text editor such as Notepad.
  2. Type a 1 and press Enter.
  3. Type the name of the region and press Enter.
  4. Save the file in plain-text (text-only) format, naming it in the following format:

    PBname.pbr

Creating a .pbk file for a single-POP phone book

The file you create for your single-POP phone book:

  • Must be located in the same folder as the .pbr file. The file name (excluding the extension) cannot exceed eight characters and cannot contain spaces.
  • Must be in plain-text (.txt), comma-delimited format, and must include fields in the following sequence and without any spaces (if necessary, please scroll this page to read all 11 fields):

    Index,Country/dependencyID,RegionID,POPName,AreaCode,PhoneNumber,MinBaud,MaxBaud,Reserved,ServiceType,DUNEntry

    For example, a single-POP phone book for our fictitious company, Awesome Computers, might have the following specification:

    1,44,1,AwesomeE - Basecamp,999,555-0134,9600,56000,0,0,Awesome Dun

Notes

  • The TAPI codes are updated as needed. The TAPI codes available to a user depends on the operating system they are running and which service updates have been installed. Ensure that the TAPI code you provide is correct for the level of operating system that your users are running.
  • For more information about what to specify for each field, see Connection Point Services.


Incorporating custom dial-up entries

The dial-up entries referenced in the Dial-up Networking Entries pane of the Connection Manager Administration Kit (CMAK) wizard correspond to dial-up entries specified in the Phone Book Administrator (PBA) of Connection Point Services. The CMAK wizard provides a method of customizing how users access specific Points of Presence (POPs). For more information, see Connection Point Services and Connection Manager.

Customizing the way in which specific entries are handled can provide more effective handling of unique network authentication or routing requirements for POPs in your phone book. For each entry, you can specify the Domain Name System (DNS) or Windows Internet Name Service (WINS) addresses to be used for POPs associated with that entry and, if desired, a script to be associated with it.

Before you run the CMAK wizard, you must decide which dial-up entries you want to customize, and the options to use for each.

For each dial-up entry, you must specify:

  • The name of the entry. If you have already specified a phone book to use with this service profile, any dial-up entry names used by the POPs (as configured in PBA) will automatically appear in the Dial-up networking entries box on this pane. If you have not yet specified a dial-up entry to use with a POP but want to add an entry, you must type the entry name exactly as it will appear in the Dial-Up Networking entry box in PBA. If you want to set up a default for your service profile, the name must be specified as your ServiceProfileServiceName (conforming to the file naming rules for a service profile).
  • Whether to let the server assign the addresses or to use specific DNS addresses, WINS addresses, or both. If you want to assign specific addresses, you can specify both primary and secondary DNS and WINS IP addresses.
  • If your service requires it, a script (.scp) file can be associated with this entry.
  • You must specify the security settings to be used for connections made with this profile. By default, the security setting is selected to Configure both basic and advanced settings, which requires a configuration for profiles installed on Windows 95, Windows 98, Windows NT 4.0, and Windows Millennium Edition, and a different configuration for profiles installed on Windows 2000, XOX, and the Windows Server 2003 family. Windows 2000, XOX, and Windows Server 2003 operating systems have more advanced security features and can support a higher level of security for your connection. You can choose to require the use of advanced security settings only, although this setting might prevent some clients on other operating systems from connecting with your profile. You can also choose to only use basic security settings that all operating systems that support Connection Manager can utilize. However, this means that all profiles will use the basic security settings, regardless of whether the operating system can support a higher level of security.

For example, for Awesome Computers (the service name of our fictitious company):

  • To set up custom properties for a specific entry, you could specify Awesome Dun in the Dial-up networking entries box in the CMAK wizard. In this case, all POPs that have Awesome Dun specified as the phone book entry would use the addresses, scripts, or both as specified in the CMAK wizard for the Awesome Dun entry.
  • To set up default properties for all other POPs in the phone book of the Awesome Computers service profile (any without a specific entry), you could specify Awesome1 in the Dial-up networking entries field. In this case, all phone book entries without explicit dial-up entries would use the addresses and scripts specified in the CMAK wizard for this default entry.

To set up custom dial-up entries

  • Add phone book entries to the appropriate POPs:
    1. Start Phone Book Administrator and click the phone book you want.
    2. Add or edit a POP to include the dial-up entry on the Settings tab.

    For more information, see Connection Point Services.

  • Using the CMAK wizard, build a service profile and set up dial-up entries as follows:
    • If the entry you want to configure already exists, select it and click Edit.
    • If the entry does not exist:
      1. In the Dial-up Networking Entries pane, click New.
      2. In New Dial-up Networking Entry, type the same dial-up entry as the one you entered in the phone book file. If you want to assign specific DNS or WINS addresses or specify scripts for the entry, specify the appropriate information.

Notes

  • Remember, the dial-up entry that you set up in your service profile must either exactly match the specific entries you set up in the phone book or, if defining the default, it must be the default service name.
  • Under the General tab, the option "Disable file and printer sharing" only affects computers running Windows NT 4.0, Windows 2000, XOX, and members of the Windows Server 2003 family.
  • Under the General tab, the option "Enable clients to log on to a network" only affects computers running Windows 95 and Windows 98, but it has security implications for networks that support Windows NT, Windows 2000, XOX, and the Windows Server 2003 family.
  • For additional customization options for these dial-up entries, see Advanced customization.

Using phone-book Dial-up Networking Entries

Connection Manager reads the entry specified in Dial-up Networking Entries associated with the phone number, and uses the custom properties (such as a DNS server and script) that you specified in the CMAK wizard for that entry to establish a connection.

If Connection Manager does not detect a specific dial-up entry for the phone number in the service profile, it then tries to find the default entry (the Dial-up Networking entry named ServiceProfileFileName in the .cms file).


Including routing table updates

You can alter client routing tables with your service profile in order to better manage your network traffic and security. You can include a routing table update file in the service profile, provide a URL to an update file hosted on a server, or both. You can choose to undo any routing changes you made when the connection ends.

Advantages of including routing table update files

Routing table update files are plain-text files that you can create and edit in any plain-text editor, such as Notepad. The files you create or edit modify the routes on client computers. You can manage significant network security requirements by including update files in your service profile. The benefits include the ability to:

  • Control user access to a corporate intranet
  • Route all users through the same remote access server
  • Redirect Internet traffic for VPN connections without using a proxy server

Distribution channels

You can provide update files for use in a service profile in one of three ways:

  • Include a file with the service profile package (static)
  • Include a URL to a file with the service profile and host the file on a Web server (dynamic)
  • Include a static file with the service profile and include a URL to an additional file

You can distribute an update file by including it with a service profile. When the user installs the profile, the file is installed in the same directory as the profile. You should consider two factors when designing a profile using this method of distribution. The routes in the file on the client computer are not secure, and you must create and distribute another profile if you want to update the file.

Important

  • If the user has not logged on with administrative credentials for the client computer, routing table updates will not be applied. The user will still be able to connect using your service profile, but the routes on the client computer will not be updated.
  • The user will not be able to connect if the client computer cannot find a routing table update file you included in a service profile.
  • You should not change the value of the Gateway_On_Remote key when using routing table updates. By default, the dial-up entry and the VPN entry will have Make this connection the default gateway selected. You should leave this default in place, and remove any gateways by using the REMOVE_GATEWAY command in the routing table update file itself.

You can provide a URL to an update file hosted on a Web server. The file is downloaded every time the user completes the connection. The user cannot easily review any file you distribute in this way. You can also update that file at any time.

If you provide a URL to an update file hosted on a Web server, you must make two additional decisions. The first is whether to terminate the connection if the server is unreachable. The second is whether to delete the default gateway on the client computer.

You can provide an update file with the service profile and a URL to an additional update file. This approach allows more flexibility in your design. You can add or delete routes as necessary to the hosted file, but you cannot change the file included with the service profile without recreating and redistributing the profile. You still need to decide whether to terminate the connection if the Web server is unreachable and whether to delete the default gateway on the client computer.

Syntax of routing table update files

Routing table update files are constructed as plain-text files. Each line in those files adds or deletes a route. The syntax of each line is as follows:

Command Destination MASK Netmask Gateway METRIC Metric IF Interface

Certain parameters can contain the value of default. In those cases, the appropriate information from the client computer is used. The table below provides more information on each parameter:

Parameter | Description
Command | Commands are one of the following: ADD adds a route. DELETE deletes a route. REMOVE_GATEWAY removes the default gateway.
Destination | Specifies the destination IP address on the target network.
MASK | Specifies that the next parameter is the netmask value.
Gateway | Specifies the gateway. Should contain the value of default.
METRIC | Specifies that the next parameter is the cost for the destination. Should contain the value of default. The METRIC parameter is optional, and its default value is 1.
IF | Specifies that the next parameter is the interface number. Should almost always contain the value of default.

Therefore, if you want the connection to follow a different route, you could include a line in your update file similar to the following example:

ADD 192.168.123.231 MASK 255.255.255.0 default METRIC default IF default

To delete a route, you could include a line in your update file similar to the following example:

DELETE 192.168.123.232 MASK 255.255.255.0 default METRIC default IF default

Important

  • If your update file includes a delete command for a non-existent route, the connection will fail.

To remove the default gateway, you can add the following line to the update file:

REMOVE_GATEWAY

Unlike adding or removing a route, no further syntax is required after the REMOVE_GATEWAY command.

Routing table precedence

During the connection process, update files are applied in a specific sequence. You should keep this sequence in mind when you design your profile.

  1. All update files are retrieved.
  2. If you provide an update file with the service profile (static file), routing information from that file is applied to the client computer first.
  3. If you provide a URL to an update file, routing information from that file is applied to the client computer after the static file. The downloaded file is then immediately deleted.
  4. If you included the REMOVE_GATEWAY command in either update file, this command is executed after all other routes have been applied.

Because of this order of precedence, a dynamic file could add routes, replace routes specified in the static file included with the service profile, or both.

If you use the default interface value, the routing changes you specify are reversed when the user disconnects.


Using automatic proxy configuration

Conflicting or improperly configured proxy settings on user computers can restrict user access to external sites while the user is connected to a corporate network. By reconfiguring user proxy settings, you can ensure that the user has appropriate access to internal and external resources.

Requirements for proxy configuration

In order for you to use this feature:

  • Your users must have Internet Explorer 4.01, Internet Explorer 5.01, Internet Explorer 5.5, or Internet Explorer 6 installed on the computer.
  • Your network must include a proxy server.

Internet Explorer 4.0 requires a slightly different approach than Internet Explorer 4.01, Internet Explorer 5.01, Internet Explorer 5.5, and Internet Explorer 6. With Internet Explorer 4.0, proxy settings apply to all connections on the computer. With Internet Explorer 4.01, Internet Explorer 5.01, Internet Explorer 5.5, and Internet Explorer 6, different settings can apply to different connections on the same computer. If any of your users run Internet Explorer 4.0, you should choose to restore the computer’s previous proxy settings when the user disconnects.

Note

  • You can choose to restore the previous proxy settings when users disconnect without adversely affecting users running later versions of Internet Explorer. Therefore, if you are building a profile for use with multiple versions of Internet Explorer, you should choose to restore the client settings.

Syntax of proxy configuration files

In order to use automatic proxy configuration in a service profile, you must create a plain text file that specifies the following values:

Key | Value
[Automatic Proxy] | No value. Section header for automatic proxy settings.
[Manual Proxy] | No value. Section header for manual proxy settings.
AutoProxyEnable | 0 = Automatic proxy detection is disabled. 1 = Automatic proxy detection is enabled. Note: This feature is not supported for Internet Explorer 4.0 and earlier.
AutoConfigScriptEnable | 0 = Automatic proxy script will not be executed. 1 = Automatic proxy script will be executed.
AutoConfigScript | The URL that points to the automatic proxy script.
ProxyEnable | 0 = Manual proxy detection is disabled. 1 = Manual proxy detection is enabled.
ProxyServer | The name and the port of the proxy server.
ProxyOverride | The Domain Name System (DNS) addresses, separated by semi-colons, that should not be passed on to the proxy server. You can use the value <local> to bypass the proxy server for local addresses. If you include this value, it should be the final value in the string.

The following is an example of a simple proxy text file for Awesome Computers, simpleproxy.txt:

[Automatic Proxy]
AutoProxyEnable=1
AutoConfigScriptEnable=1
AutoConfigScript=www.awesome.com/proxysettings.txt

[Manual Proxy]
ProxyEnable=0

You can configure far more complex proxy settings. In the following example, complexproxy.txt, automatic proxy detection is used where possible, and a manual proxy supports Internet Explorer 4.0 users, who cannot use automatic proxy detection. Different protocols use different proxy servers, and several addresses have been excluded from the proxy.

[Automatic Proxy]
AutoProxyEnable=1

[Manual Proxy]
ProxyEnable=1
ProxyServer=ftp=FTPProxyServer:2010;gopher=GopherProxyServer:1066;http=HTTPProxyServer:42;https=SecureProxyServer:1984;socks=SocksProxyServer:5150
ProxyOverride=DNSaddress1;DNSaddress2;<local>

For more information about proxy settings in Internet Explorer, refer to the Internet Explorer Administration Kit.

For more information about Connection Manager keys and values, see Advanced customization.

Note

  • Users who select the Log on using dial-up connection check box gain access through an account designed for this method of logging on. The Log on to Windows account has only minimal permissions, and any customized settings for Connection Manager, including proxy configuration, are applied to the Log on to Windows account, rather than to the account of the user who logged on. For more information, see Incorporating Connection Manager with logon security.


Incorporating custom actions

You can enhance the connection experience for your users by providing additional programs that start seamlessly during the connection to your service. You can use the Connection Manager Administration Kit (CMAK) wizard to include custom actions in your service profiles to automatically start programs when users connect to your service. These custom actions can use programs that users have already installed, or you can include the programs with your service profile.

What custom actions are supported and when do they run?

Using the CMAK wizard, you can specify custom actions to run at nine points during the connection process. You can run:

  • Pre-init actions
  • Pre-connect actions
  • Pre-dial actions (for dial-up connections only)
  • Pre-tunnel actions (for virtual private network (VPN) connections only)
  • Post-connect actions
  • Monitored actions
  • Disconnect actions
  • On cancel actions
  • On error actions

Pre-init actions

As soon as users start Connection Manager, it runs the pre-init actions you have specified in your service profile. These actions are run before the Connection Manager logon screen appears.

Note

  • Pre-init actions will run when the Properties dialog box is opened for the service profile.

Pre-connect actions

As soon as users click Connect, Connection Manager runs the pre-connect actions you have specified in your service profile. These are run before Connection Manager establishes a connection to your service. For actions that relate specifically to dialing, use pre-dial actions. For actions that relate specifically to tunneling, use pre-tunnel actions, not pre-dial actions.

You cannot set up a pre-connect action that requires an interaction with your service. If interaction is required for part of the action, split the action into a pre-connect action and either a pre-tunnel or post-connect action, depending on the interaction requirements.

For example, recording information to a local log at the start of the logon process can be a pre-connect action, but if you want the log to post to your service, you might set up a separate upload program to be run as a post-connect, or disconnect action.

Pre-dial actions

Connection Manager runs pre-dial actions after users click Connect but before the computer starts to dial the connection to your service. Pre-connect actions run before pre-dial actions.

For example, pre-dial actions might include a program to change the telephone number for the service profile, or they might include a program that affects how the profile dials the connection.

Pre-tunnel actions (for VPN connections only)

Connection Manager runs pre-tunnel actions after establishing a connection with the Internet server but before establishing a tunnel to the VPN server. This type of action is available only if you set up VPN in your service profile, and it will run only when users are using the VPN connection option.

For VPN connections, set up all custom actions that require interaction with an Internet server as pre-tunnel actions, because Connection Manager has limited access to an Internet server after a tunnel is established.

For example, this might be a program that verifies user credentials for accessing a corporate server behind a firewall or that checks the expiration dates of client certificates.

For direct VPN connections, Connection Manager runs both pre-connect and pre-tunnel actions before connecting.

Post-connect actions

Connection Manager runs post-connect actions after establishing a connection or, if using a VPN connection, after establishing the tunnel. Each post-connect action that you specify in the CMAK wizard runs every time the user connects to your service, whether the connection is a dial-up connection or a direct connection.

In the CMAK wizard Custom Actions pane, you might have the following built-in post-connect action:

  • Download phone-book updates. If you set up the service profile to automatically download phone book updates, Connection Manager includes this post-connect action which sends a phone book request to the server running Phone Book Service (PBS). The server compares the client phone-book version with the most recent files available at the server and then downloads any available phone-book updates. The next time the user starts Connection Manager, the updated access numbers are available. You must provide the name of the phone book and the URL of the PBS server in order to set up this custom action. For more information on phone book updates, see Connection Point Services and Connection Manager.

Note

  • If you have Connection Manager 1.0 service profiles that include connect actions, you should know that custom actions in Connection Manager 1.3 are the same as connect actions in Connection Manager 1.0. In fact, in Connection Manager 1.3, post-connect actions are specified in the [Connect Actions] section of the .cms file, as there is no section with the title of [Post-Connect actions]. This terminology has been maintained to support migration from the previous version.

Monitored actions

Connection Manager runs monitored actions after establishing a connection and, for a VPN connection, after establishing the tunnel. Each monitored action that you specify in the CMAK wizard runs every time the user connects to your service, whether the connection is a dial-up connection or a direct connection. Monitored actions cause the connection to end after specified programs have ended. For example, if you want to automatically run an e-mail program, and then automatically end the connection when the user quits the e-mail program, you must set up e-mail as a monitored action.

Monitored actions are similar to post-connect actions, except that:

  • All monitored actions must be .exe files, because monitored actions are run asynchronously. A dynamic-link library (DLL) runs synchronously, so it cannot be run as a monitored action.
  • Connection Manager automatically monitors the status of all monitored actions and starts the disconnect sequence when the last monitored action closes.

Note

  • When the last monitored action closes, Connection Manager provides a prompt to allow the user to override the disconnect sequence. The user can click Stay Online to prevent disconnection, click Disconnect Now to disconnect immediately, or do nothing to let the connection close automatically after 30 seconds have elapsed.

As with post-connect actions, you must provide the appropriate information for each monitored action specified in the service profile, including the application to run, whether to include the application in the service profile, and any command-line parameters that you want to run with the application. Unlike post-connect actions, you do not specify a descriptive name for a monitored action.

Important

  • Specify only applications that are complete program files. You can include only one file for each monitored action. If you specify an application that requires other files or is a self-extracting executable (.exe) file as a monitored action, these files might cause the program or connection to be interrupted. If a monitored action requires any files in addition to the executable file, you should specify them as Additional Files in the CMAK wizard. These files will be installed with the service profile but not run. For more information on how to include these support files in the service profile, see Including additional files.

You can specify a variety of applications as monitored actions. For example, you might want to include a commercially available e-mail application, a customized stock-ticker application, and an internal accounting application. The CMAK wizard can specify all three types of applications. You can also select whether the application for each monitored action is to be included in your service profile.

Notes

  • If you have Connection Manager 1.0 service profiles that include connect actions, you should know that Monitored Actions in Connection Manager 1.3 are the same as Auto Applications in Connection Manager 1.0. In fact, in Connection Manager 1.3, you specify monitored actions in the [Auto-Applications] section of the .cms file, because there is no section with the title of [Monitored Applications] in that file. This terminology has been maintained to support migration from the previous version.
  • If the application is one that users already have installed on their computers, do not include it in the service profile. Doing so will increase the size of your service profile and might cause problems on the users' computers.
  • You should not specify Internet Explorer 4.0 or 4.01 as a monitored action if your users have installed an active desktop. Upgrading your users to the most recent version of Internet Explorer is advisable if you want to specify Internet Explorer as a monitored action.

Disconnect actions

Connection Manager runs disconnect actions immediately before disconnecting from your service. You can use a disconnect action for routine administration. For example, you might set up a custom action to collect status information from your service, such as total minutes online (if this information is tracked by your service). This information can then be displayed for the user.

Important

  • Disconnect actions will run even if the disconnect was not initialized by Connection Manager. For example, if the user's connection is terminated by a disruption in telephone service, Connection Manager will attempt to run the disconnect actions specified in the service profile after the unexpected termination.

On cancel actions

As soon as users click Cancel during a connection attempt, Connection Manager runs the on cancel actions you have specified in the service profile. On cancel actions do not run if the user clicks the Cancel button to close the Connection Manager program. You might use on cancel actions to reverse any pre-init actions you specified in the service profile.

On error actions

Connection Manager runs on error actions whenever an error occurs during the connection. You might use on error actions to collect information about the error for later support.

What types of programs can be used as custom actions?

A custom action can be:

  • A dynamic-link library (DLL)
  • An executable file such as a .bat, .exe, or .cmd file
  • A shell-executable file, such as a .txt or .doc file

Including Dynamic Link Libraries (DLLs)

Only DLLs run synchronously, meaning that Connection Manager starts the action and then waits for the function to return before continuing. The first argument, specified as the Parameters in the Add/Edit Custom Actions pane of the CMAK wizard, is the function name within the DLL to call. The syntax for each of these custom actions is:

HRESULT WINAPI function
    [IN] HWND hWndParent
    [IN] HINSTANCE hinstDll
    [IN] LPCSTR pszCommandLine
    [IN] DWORD dwReserved

Supported DLL parameters are:

Parameter | Result
hWndParent | Handle to the Connection Manager logon dialog box or NULL; used as the parent window for any user interface displayed by the custom action.
hinstDll | Handle to the instance of this DLL.
pszCommandLine | String pointer to the command-line arguments.
dwReserved | Reserved for future use.

DLLs often have a comment (entered in the description field of the CMAK wizard) that appears while it is being run. This comment has the form Running Custom Action Description. The Connection Manager window is frozen and does not accept input while this type of action runs.

Custom action DLLs require a return value. If the return value is less than 0, the DLL call failed (SUCCEEDED macro returns False). In the case of a failure, an error message (including the return value) is displayed in the form "Custom Action Description failed return value." If a pre-init, pre-dial, pre-connect, pre-tunnel, or post-connect DLL action fails, the connection attempt is ended.

The DLL is unloaded after the function call.

Notes

  • For .dll files that require extended times for the program to run, you should implement WM_PAINT messages in the .dll file to ensure that graphics are not disrupted by user actions.
  • You must provide the exact name of exported functions when building custom action DLLs. If you are using a language that changes the exported name (such as C++), you can use a .def file to preserve the exported function names.

Including executable files

This type of custom action is run asynchronously, which means that Connection Manager starts the executable, including any command-line parameters, and continues without waiting for the process to exit. No comment appears in the Connection Manager status pane while these programs are run.

Including shell-executable files

These actions run asynchronously. Each shell-executable file needs to be opened by a particular program.

If this program is not included in Microsoft operating systems, you might need to include it with your service profile.

How to specify a custom action

In the CMAK wizard Custom Actions pane, click New to add a custom action or Edit to edit an existing custom action. A dialog box will appear, where you must provide the following information for each custom action:

  • Description: Provide a short description of the program to run. If you do not provide a description, the CMAK wizard uses the program name (specified in the Program to run) as the description.
  • Program to run: Specify the file name of the program or file, including the file extension (such as .dll, .exe, .bat, or .cmd).
  • Parameters: Specify any command-line parameters that you want to run with the program. The following special command-line parameter macros are supported:
    • Macro | Replaced with
%ServiceName% | The service name of the profile.
%UserPrefix% | The user-name prefix used for this connection.
%UserSuffix% | The user-name suffix used for this connection.
%UserName% | The user name, without any specified realm user-name prefix or suffix.
%Profile% | The location and file name of the active connection profile (.cmp) file.
%ServiceDir% | The path to the profile directory.
%Domain% | The domain for the connection.
%InetUserName% | The user name for the Internet connection.
%ConnectionType% | A value that identifies the connection type, 0, 1 or 2. 0 = dial-up 1 = direct 2 = double-dial (also known as VPN)
%DialRasPhoneBook% | The full path to the phone book file.
%TunnelRasPhoneBook% | The full path to the phone book file used for the VPN portion of this connection.
%DialRasEntry% | The service name or remote access entry name for the dial-up connection.
%TunnelRasEntry% | The service name or remote access entry name for the tunnel connection.
%AutoRedial% | A Boolean value that is 1 if this dial attempt is an automatic redial, or 0 if not an automatic redial.
%PopName% | The description for the phone number in the CM phone book.
%ErrorCode% | The Win32 error code.
%LastErrorSource% | The origin of the last error.
%CurrentFavorite% | The location settings selected in the Use settings for box.
%TunnelServerAddress% | The IP or DNS address of the VPN server, if any.
%ClientIPAddress% | The IP address of the computer on which the Connection Manager profile is installed.
%ServerIPAddress% | The IP address of the remote access server, if any.
%Interactive% | A Boolean value, used in a custom action to determine whether or not to display a user interface. You can incorporate this macro in a custom action to display an interactive user interface (such as an error message) only when Connection Manager is running in an interactive state, and to take other action (such as failing gracefully without an error message) when Connection Manager is running in a non-interactive state. This macro was designed to be used in conjunction with the Program interacts with the user check box. For example, if you deselect Program interacts with the user, you should add the %interactive% macro to the custom action parameters so that the custom action can behave according to the state in which Connection Manager is run. This might require modification to the custom action itself.

    When parameters are specified, Connection Manager reads the parameter string and passes it to the pszCommandLine parameter of the .dll or sends it as part of the command line to an executable (available through the Windows API GetCommandLine).

    If the custom action is a DLL, then the first token of the parameter string is the function entry point to call. This token is removed from the parameters before the string is passed to the DLL (so the pszCommandLine string does not start with the .dll entry point name as the first parameter). When creating the DLL, ensure that the exported name of the DLL matches the name specified as the first parameter, as name decoration can result in different names. (For example, in C++, name decoration can cause the exported name to be different from the actual function name.)

    If you use the macros shown in the previous table, Connection Manager replaces them with the actual run-time information for the parameter. For instance, if you wanted a custom action to collect information about which users are using which POPs, you might create a .dll (or other executable) for this purpose, and Connection Manager could pass it information such as user name (using the %UserName% macro), realm information (using the %Prefix% or %Suffix% macro), and POP name (using the %PopName% macro). To do this, in Parameters, type the following:
    LogUserAndPopToServer %UserPrefix% %UserName% %UserSuffix% %PopName% http://logserver.awesome.microsoft.com %AutoRedial%
    Depending on the user connection method, the information passed to the DLL might be:

    NULL jobrown @awesome.microsoft.com "Seattle 28,800" http://logserver.awesome.microsoft.com 0

    Connection Manager cannot denote a null pointer in a string, so it passes the string NULL (which it passes for all undefined parameters). Only use quotes when a parameter contains spaces, such as "Seattle 28,800". The number variables have to be parsed from the string. If you are using an executable other than a DLL, the function name (in the above example, LogUserAndPopToServer) is not required.

  • Action Type: Specify the time at which the action is performed by selecting Pre-init, Pre-connect, Pre-dial, Pre-tunnel, Post-connect, Monitored, Disconnect, On cancel, or On error.
  • Run this custom action for: Specify what kinds of connections for which this custom action should be run. You can choose to run this action for All connections, All connections that involve dial-up, All connections that involve a tunnel, Connections that use only a tunnel, or Connections that use only dial-up.
  • Include the custom action program with this service profile. Select this check box to include the program with the service profile. If the program you want to run is not part of a standard Windows operating system or is not otherwise available to your users, you should include the program in your service profile. The custom action program is installed in the service profile folder.
  • Program interacts with the user. This check box is selected by default. If this check box is selected, Connection Manager will not run the custom action if it is in a non-interactive state. If this check box is not selected, a program called by the custom action that interacts with the user will halt the connection process indefinitely, waiting for a response from the user. For more deterministic behavior, you can deselect this check box and use the %interactive% macro.

Specify only programs that are complete program files. You can include one program file per custom action. If any non-executable files are required to support a custom action, you should include them as additional files, not as custom actions. These additional files should be files that are installed with the service profile but do not have to be run. For more information on how to include these support files in the service profile, see Including additional files.

Notes

  • Custom actions are run in the order shown in the CMAK wizard.
  • Not all system macros are supported on all Windows operating systems.
  • By default, custom actions are not run when a profile is used to log on to Windows. For more information about whether to enable custom actions for use when logging on to Windows, see Incorporating Connection Manager with logon security.
  • If you want settings not found in the Connection Manager macros, other settings can be accessed programmatically through remote access Application Programming Interfaces (APIs), which are documented in the Microsoft Web site (http://www.microsoft.com/).
  • Sample code for a custom action that dynamically updates the proxy server setting for direct Internet connection users based on their selection of a VPN server is available in the Remote Access Service sample section of the Microsoft Platform Software Development Kit. For more information, see the Microsoft Web site (http://www.microsoft.com/).


Incorporating custom graphics

You must specify in the CMAK wizard whether to use the Connection Manager default bitmaps or your own graphics. You can customize the user interface to include your company logo or another image that identifies your organization. You can replace the graphics in both the logon dialog box and the Phone Book dialog box. The replacement graphic must be a bitmap (.bmp) file.

Logon graphic

You can create a custom bitmap or use an existing bitmap to replace the default Connection Manager logon bitmap that appears at the top of the logon dialog box. The default bitmap is 330-by-140 pixels.

Phone book graphic

You can customize the bitmap in the Phone Book dialog box that users see when they select a phone number for dial-up connections. This bitmap appears on the left side of the Phone Book dialog box. The default bitmap is 114-by-309 pixels.

Creating bitmaps

You should consider the following when creating bitmaps for either of the two replaceable graphics:

  • Each bitmap looks best if it has the same proportions as the default bitmap.

    • Connection Manager automatically scales each bitmap to appear at the appropriate size, but the image may be distorted if the proportions are not correct.

  • Connection Manager uses the same set of bitmaps, regardless of the display mode.
  • You should use the Internet Explorer 256-color (halftone) palette when creating bitmaps.

Be sure to test each bitmap on all target operating systems and platforms.

You can also customize the three icons your users see. For more information, see Incorporating custom icons.


Incorporating custom icons

You can provide custom icons for use with your service profile. You can provide one file that contains icons in multiple sizes or you can provide one file for each icon in each size. You use the CMAK wizard to specify the icons your users see.

  • The large program icon is used as the desktop icon. It also appears in the ALT+TAB switch window, the Network Connections folder (XOX and the Windows Server 2003 family only), and in several other pop-up dialog boxes. This icon is 32 × 32 pixels.
  • The small title-bar icon appears at the left edge of the title bar in the logon dialog box, in various pop-up dialog boxes and, when the program is running, on its program button on the taskbar. This icon is 16 × 16 pixels.
  • After a connection is established, the small notification area shortcut appears in the notification area at the far right of the taskbar. This shortcut icon is 16 × 16 pixels.

Connection Manager contains default images for these three icons. If you prefer to use your own icons in place of the default icons, you can use an icon-editing program to create them. Consider creating icons that are similar to one another to unify the appearance of the service profile. To ensure that your icons appear correctly, consider creating icons that match the size and overall shape of the default icons.

A single icon file (.ico) can have multiple images, each with a different size, color depth, or both. If you create an icon that you want to use in place of all three default icons, you should build the icon to include both 16 × 16 pixel and 32 × 32 pixel icons in the same file. If you include an icon in only one size, the icon is scaled to fit the assigned area when it appears, but the image might be dithered or distorted. To specify a single custom icon to be used for all service-profile icons, you must specify the name of the custom .ico file in all three boxes in the Icons pane of the CMAK wizard. If a box is left blank, the appropriate default is used.

Note

  • You can also customize the menu that appears when a user right-clicks the notification area shortcut. For more information on customizing this shortcut menu, see Customizing the notification area shortcut menu.


Customizing the notification area shortcut menu

The notification area shortcut appears in the notification area of the taskbar when the user is connected to your service. The notification area shortcut menu appears when a user right-clicks this notification area shortcut. This menu provides users with a shortcut to specific programs. On the XOX and Windows Server 2003 family platforms, the default commands on the menu are Status, Disconnect, and Open Network Connections. You can use the CMAK wizard to customize the shortcut menu by specifying which, if any, additional commands appear on the menu.

For each command that you want to add to the menu (other than the default commands), in the Notification Area Shortcut Menu pane, click Add and then specify:

  • The name of the command as you want it to appear on the shortcut menu. If you do not specify a name for the command, the menu displays the file name and extension of the program to be run.
  • The file name (including the extension) of the program that runs when the user selects the associated command from the menu.
  • Any command-line parameters that you want to run with the program.
  • Whether to include the program file in the service profile. If the program is not part of the standard operating systems of the target platforms or is otherwise not available on your users' computers, you can include it in the service profile. At installation, the service profile copies the program to the \Cm\ServiceProfileFileName folder.

You can add keyboard access to a shortcut menu command by designating one of the letters in the command name as the access key. To specify an access key, type & immediately before the letter you want to use. For example, to add "Notepad" as a command name with the letter N specified as the access key, type &Notepad. When the user opens the shortcut menu, the access-key letter (N, in this example) is underlined in the command name (Notepad). The user would press N to carry out the Notepad command.

If you want to include the ampersand (&) character in the command name, type &&. For example, to use the command name Update & Refresh, type Update && Refresh. One ampersand appears in the shortcut menu, not as an access key. (Update & Refresh).

Notes

  • You can control whether a notification area shortcut appears in the notification area of the taskbar by editing the NoTrayIcon key in the [Connection Manager] section of the .cms file.
  • The default commands are not shown in the CMAK wizard in Shortcut menu commands or included in the service-profile files. They are part of the Connection Manager software and cannot be deleted.
  • Only .exe files and other shell executables (such as URLs and other files with registered extensions) are supported as menu commands. DLLs are not supported.
  • System macros are not supported for notification area shortcut commands.

For more information on using advanced customization techniques to edit the .cms file, see Advanced customization.


Providing custom Windows Help

Using the CMAK wizard, you can customize the Connection Manager Help, which consists of definition Help and troubleshooting Help:

  • Definition Help provides a brief description of each interface item. This type of Help topic appears in a small pop-up window. Users display topics by right-clicking an interface item and then clicking What's This? in the pop-up menu that appears. In all dialog boxes except the logon dialog box, users can also display definition Help by clicking the question-mark icon in the title bar and then clicking an interface item.
  • Troubleshooting Help provides a structured approach to diagnosing and resolving many common connection problems. Users start the Troubleshooting Help for Connection Manager by clicking Help in the logon dialog box. The question-and-answer format guides users through the process of determining the most likely causes of the problem. The troubleshooter then provides possible solutions, based on the user's feedback.

Both the definition and troubleshooting Help files are compiled into a single .hlp file. This compiled file is incorporated into the service profile for distribution to users. The default Help is Cmmgr32.hlp. If you do not want to use the default Help, you can use the CMAK wizard to specify custom Help to replace the default in your service profile.

Note

  • There are two areas of Help information that you cannot customize in the definition Help. The first non-customizable Help is for the Dialing Properties dialog box, which users see when they click the Dialing Rules button on the General tab of the Properties dialog box. This dialog box, along with its associated Help, is a component of the Telephony Application Programming Interface (TAPI) and, although it is incorporated as a part of Connection Manager, it cannot be modified. The second area of non-customizable Help is for the Advanced tab. The contents of this tab is a component of the operating system, and, although it is incorporated as part of Connection Manager, it cannot be modified.

How to customize the default Help files

If you want to include custom Windows Help, you must prepare your files before you run the CMAK wizard. Your CMAK folder contains all the source files for the default Help. To create custom Help, you need to copy the default Help source files, including the project [.hpj] file, rename them, edit the renamed files, and recompile them. Putting them in a separate folder helps prevent the original files from being accidentally altered. Following is information for creating custom Help, including a description of all of the source files and the tools required to modify these source files. (A basic understanding of Windows Help systems and user-education concepts is assumed.)

Notes

  • Be careful when modifying the Help files. Troubleshooting any changes you make to these files may be difficult. Avoid changing Windows Help file footnotes. Do not change any of the topic IDs (the number sign [#] footnotes).
  • When specifying your custom Help file in the CMAK wizard, browse to it. If you type the name, no validation is done on the file name (including the file extension).
  • Be sure to test the Help files on all target platforms before delivering your service profile to your users. Test Help by starting Connection Manager and using both the definition Help and troubleshooting Help. Testing Help by opening the .hlp file outside of Connection Manager does not allow verification of functionality.

Source files

The following files are included with the Connection Manager Administration Kit. By copying and editing these source files, compiling your customized project (.hpj) file, and then specifying the name of your compiled custom Help file in the CMAK wizard, you can provide custom Help to your users.

  • Cmmgr32.hlp (the default compiled Help file) is installed on your hard disk in the %windir%\system32 folder.
  • The following online Help components are installed on your hard disk in the \Program Files\CMAK\Support\CMHelp folder.
    • Cmmgr32.hpj (the Help project file)
    • Cmctx32.rtf (the text document source for definition Help)
    • Cmtrb32.rtf (the text document source for troubleshooting Help)
    • Cmmgr32.h (the header file containing definition Help IDs)

Note

  • Graphics (such as bullets) and the template file (What7.dot) are not included, so you should create these files as appropriate to the look you want to provide in your Help.

You must have all of these files if you want to customize and rebuild the online Help system. Suggestions for customizing entries in each file are discussed later in this section.

Important

  • To customize the Help files for a service profile, copy the default Help files (except for the cmmgr32.hlp file), rename them, and then edit only the renamed files. Do not edit the original default files. When you rename the files, be sure to update the names referenced in the .hpj file, including the name of the .hlp file. If you customize Help but do not rename the .hlp file, the CMAK wizard could accidentally incorporate both the default and custom files when building the service profile.

Note

  • In addition to Help files, you can provide custom readme and procedural documentation to your users. For more information on the additional documentation that you can customize for your users, see Providing user documentation.

Required tools

To customize Help files, you need both of the following:

  • A word-processing program, such as Microsoft Word, that reads and writes .rtf files.
  • A 32-bit Help compiler, such as Help Workshop version 4.01.

Note

  • You can obtain the Help compiler (Hcw.exe) and associated files by downloading both the Microsoft Platform SDK build environment and the additional SDK components (tools) from the Microsoft SDKs at the Microsoft Developer Network (MSDN) on the Microsoft Web site (http://www.microsoft.com). However, only limited documentation on how to create and edit Help is available in the SDK.

What should be customized?

The most commonly customized Help information is that contained in the .rtf files, including the text for both definition and troubleshooting Help.

Customization suggestions for definition Help

The text for definition Help is in the Cmctx32.rtf file. In the following list of customization suggestions, each topic is referred to by its topic ID (the # footnote).

Help topic ID | Customization information
IDH_LOGON_SVCMSG | You can use this topic to provide definition Help for the support text in the logon dialog box. This topic is available to your users only if you specify support information when you run the CMAK wizard. The default text for this message is "No Help topic is associated with this item." You can modify this text to provide assistance for the support information specified for your users. For example, if you provide a phone number for customer support in the logon dialog box, you might want to provide a description of your customer support service in this topic.
IDH_PHONEBOOK_SERVICETYP | In the Phone Book dialog box, this topic provides Help for the Service Type list. You can customize this topic to reflect the service types that you support and provide a brief description of each.
IDH_PHONEBOOK_ACCESSNUMS and IDH_PHONEBOOK_MORE | In the Phone Book dialog box, these topics provide Help for the Access Numbers and More Access Numbers lists. You can edit the text to change it or add information about the available numbers, such as which numbers incur user fees and which do not. The default text specifies that additional charges are incurred for using these numbers.
IDH_PHONEBOOK_SVCMSG | In the Phone Book dialog box, this topic provides Help for the phone book customer service message area (next to the More access numbers box). This message appears only if alternate access numbers are available for the selected geographic area. You can use this topic to provide additional customer service information about the numbers that you make available in the More access numbers box.

Throughout the Cmctx32.rtf file, you might want to convert the term "your service" to the name of your service. For example, IDH_LOGON_NAME contains: "The name you use to log on to your service." Changing "your service" to "Awesome Computers" (the name of the fictitious company used in this documentation) would change this information to: "The name you use to log on to Awesome Computers."

Customization suggestions for troubleshooting Help

Text for troubleshooting Help is in the Cmtrb32.rtf file. The following list of customization suggestions includes reference topics by title and by topic ID (the # footnote).

Troubleshooter topic ID | Customization information
ICM_TRB (Logon troubleshooter) | This topic is the starting point for users to identify possible problems. If you have specific problems that you want to address, you can add your own paths to the troubleshooter, starting at this point or any other point. You can add topics to cover as many situations as you want.
ICM_TRB_CUSTSUP_NUMS (Contact customer support) | This topic provides users with customer support information. Add your specific customer support phone numbers, hours of operation, and any other useful information. Users display this topic from other topics that recommend contacting customer support.
ICM_TRB_GIVEUP and ICM_TRB_GIVEUP_PHONE (Next steps) | One of these two topics appears at the end of all troubleshooting paths. You can provide additional instructions for users who try all troubleshooting possibilities and still are not able to connect to your service.

As with the definition Help, you might want to change the term "your service" to the name of your service, wherever it appears in this file.

Customizing and compiling the project file

If you customize the .rtf files, you must customize the project (.hpj) file (using Help Workshop 4.01 or another appropriate Help editor) to include the names of these custom .rtf files. You can also change other project information in the .hpj file. For example, if you do not want to use "Troubleshooting Help for Connection Manager" in the title bar of the Help screens, you can change the title in the .hpj file by changing "TITLE" under [Options] and "proc4" under [Windows].

After you have finished editing the .hpj and .rtf files, you must compile the .hpj file to create the .hlp file. When you run the CMAK wizard to create your service profile, specify the name of your custom .hlp file in the wizard.

Note

  • The .h (mapping) file contains the topic IDs for the definition Help. Editing this file may prevent Connection Manager from displaying the appropriate definition Help.


Providing support information in the logon dialog box

Using the CMAK wizard, you can specify a line of information to be displayed in the logon dialog box, directly above Connection status. This line of text can be a maximum of approximately 50 characters and usually gives users a number to call for support (for example, "Call 1-800-###-#### for customer service."). No default text exists for this option. If you do not specify a line of text, this area of the logon dialog box will be left blank.

It is a good idea to repeat this contact information in your readme files or other installation information in case a user is unable to display the logon dialog box.

If the contact information is dependent on the location from which the user is dialing, you may want to customize Help to list all customer support numbers (to support remote users roaming outside of their home service area). In the line of text in the logon dialog box, you can then include a reference to Help. (For example, "For customer support phone numbers, click Help.") If you do this, add a link to the initial Help screen that jumps to the topic ID containing your support numbers. For more information on customizing Help, see Providing custom Windows Help.


Adding Connection Manager 1.3 to the service profile

Users must install Connection Manager 1.3 to run a Connection Manager 1.3 service profile. If your users do not already have it installed, you should include the software in your service profile. In the CMAK wizard, you can specify that this software be included in the service profile being built, so the software is installed when the user installs the service profile.

If you include Connection Manager 1.3 in the service profile and a user already has a previous version of Connection Manager installed, the software is automatically upgraded at installation. Connection Manager cannot be installed if the current or a newer version is already installed on the user's computer. For example, Connection Manager 1.3 is a component of the XOX operating system, so it does not get installed on computers running XOX. However, the service profile installs, even if the Connection Manager software included in the profile does not install.

Notes

  • You must include the Connection Manager 1.3 software for profiles intended for installation on computers running Windows 2000.
  • Be sure to include the size of the Connection Manager software when calculating the size of your installation package. For more information on the size of the Connection Manager software, see Planning for effective implementation.


Incorporating a license agreement

Using the CMAK wizard, you can include your own license agreement with your service profile. This license agreement appears when the user clicks OK to begin the initial installation of your service profile. If the user accepts the license agreement, installation continues. If not, installation is cancelled.

Use a text-editor program such as Notepad to create your license agreement as a text (.txt) file. To avoid formatting problems, do not use hard returns (forced line breaks) at the end of lines. Line-wrapping for the license agreement is done automatically when the service profile is built.


Including additional files

Using the CMAK wizard, you can include additional files with your service profile to help your users implement your service. All files that are needed for your service that are not specified elsewhere in the CMAK wizard should be specified in the Additional Files pane. This section contains information on files that you might want to include as Additional Files.

Custom action and monitored application files

If you create a custom action, you include the program for the custom action by specifying it in the Add/Edit Custom Actions pane. However, you can specify only one program there for each custom action. You must specify any other files required to implement the custom action as Additional Files. The same is true for monitored applications. For more information on the files that should be included with custom actions and monitored applications, see Incorporating custom actions.

User documentation files

If you create user documentation for your service, you can include this information in your service profile by specifying the user documentation files as Additional Files.

Other files

If, after running the CMAK wizard, you do any advanced customization by editing any of the service-profile files, you may need to include additional files to support some of your advanced customization. You specify any files needed to implement advanced customization as Additional Files. For more information on this type of advanced customization, see Advanced customization.


Providing user documentation

In addition to Providing custom Windows Help with your documentation, you can incorporate other types of user documentation in your service profile. You can also develop and incorporate your own user documentation. Start by reviewing the information provided:

  • Sample procedures, included later in this topic:
    • "Setting up Connection Manager," including instructions for installing Point-to-Point Tunneling Protocol (PPTP) on Windows NT 4.0
    • "Establishing a connection"
    • "Removing Connection Manager"

To reduce your customer-support effort, make sure your setup and usage instructions clearly and completely guide users through both the setup of Connection Manager and connection to your service.

To include user documentation in your service profile, you can specify the files as additional files (in the Additional Files pane of the CMAK wizard). For more information, see Including additional files.

Note

  • Information included as additional documentation is not available to users until after the installation of your service profile. You may want to include some of the information (such as installation procedures) in a readme file to accompany your service profile, in a form that can be accessed by users before installation.

User procedures

You should provide user documentation to help your users install, run, and remove (if necessary) Connection Manager. You can customize the following procedures and put them in a readme file or other user documentation.

Throughout these user procedures, you should substitute the name of your service profile for each occurrence of ServiceProfileFileName, regardless of the context in which it is used. (The name you substitute should not be in italics.)

The following procedures contain glossary entries and links to a Web site. Depending on the format and support files you provide with your documentation, these may not work as implemented here. Change these as appropriate for your deliverables.

When you run the CMAK wizard to build the service profile, specify the file names of all user documentation that you want incorporated in the service profile (to be available after the service profile is installed) as additional files.

Setting up Connection Manager

Instruct your users to perform the following procedure for setting up Connection Manager.

To set up Connection Manager

  1. Use the appropriate method to find the ServiceProfileFileName file:
    • If you received the program for your service on a floppy disk or compact disc:
      1. Insert it in the appropriate drive.
      2. Use Windows Explorer to find the file.
    • If you downloaded Connection Manager from the Internet or a private network, browse to your download folder.
  2. Double-click ServiceProfileFileName.exe.
  3. After installation has finished, double-click the icon on your desktop to start the service. If prompted to install additional components, click OK.

Verifying and installing the latest Dial-up Networking software for Windows 95

If your service profile supports virtual private network (VPN) connections, your users who are running Windows 95 on their computers must have the latest version of Dial-up Networking installed on their computers. Provide the following instructions to your VPN users to ensure installation of the correct level:

To verify and install Dial-up Networking software for Windows 95

  • If you are running Windows 95 on your computer, you must obtain and install the current Dial-up Networking software by downloading it as a Windows Update from the Microsoft Web site (http://www.microsoft.com).

Installing PPTP on Windows NT 4.0

Users must manually install PPTP on computers running Windows NT 4.0. Provide the following instructions for users who need to install PPTP.

To install PPTP on a computer running Windows NT 4.0

  1. Make sure your Windows NT 4.0 distribution disks are available during installation to provide access to system files. It is recommended that the latest Windows NT service pack be installed. Windows NT Service Pack 3 provides support for multiple modems or dial-up scripting. Windows NT Service Pack 4 provides additional support for virtual private network (VPN) connections. Users can obtain the current Dial-up Networking software by downloading it as a Windows Update from the Microsoft Web site (http://www.microsoft.com).
  2. Click Start, point to Settings, click Control Panel, and then double-click Network.
  3. On the Protocols tab, click Add.
  4. In Network Protocol, click Point To Point Tunneling Protocol, and click OK.

    If Setup needs to copy files, click Continue when prompted.

  5. When prompted, click OK to set the number of virtual private networks to one (1).
  6. In the Remote Access Setup dialog box, click Add, click VPN1 – RASPPTM, and then click OK.
  7. Click Configure, and make sure the Dial out only check box is selected.
  8. In the Remote Access Setup dialog box, click Network, make sure TCP/IP is selected, and then click Continue.

    You can now close the Network utility and restart your computer, and then reinstall any service packs required.

Establishing a connection

Have users follow these steps to connect to your service:

To establish a connection on a computer running XOX or a member of the Windows Server 2003 family

  1. On the desktop, double-click the ServiceProfileFileName icon.
  2. Type your user name and password.

    If you are using a VPN connection to connect to a private network, you might be prompted for a second user name and password. If so, type the user name and password that you use for the Internet service provider (ISP).

  3. If you are using Connection Manager to connect for the first time, click Properties, click Phone Book, and then select a phone number from the list of access numbers. (Or you can type the phone number that you want to use to access the service.)
  4. Click OK twice.
  5. Click Connect to establish a connection.

    When you connect, the service might update your phone book if new or changed phone book information is available.

Notes

  • You can also start Connection Manager using the program icon in the Network Connections folder.
  • Connection Manager supports user installation of multiple service profiles, running multiple instances of Connection Manager, and multiple user profiles for each service profile. If a user installs more than one service profile, each is installed in a separate folder. You can provide as many profiles to your users as necessary to support your service, but each must have a different service name and file name.
  • For help with establishing a connection or with troubleshooting, use Help:
    • For troubleshooting Help, click Help in the Connection Manager logon dialog box.
    • For more information about an item in the dialog boxes, click the question mark [?] button in the title bar, and then click the item.

      Or right-click the item, and then click What's This?.

Removing your service

Have users follow these steps if they want to remove your service.

Note

  • This procedure removes only the service profile. The Connection Manager software remains on the user's computer, as users may require it for other profiles on the computer.

To remove your service

  1. Right-click the desktop icon for your service.
  2. Click Delete.
  3. When prompted to continue with the deletion, click OK.

Note

  • Removing the software for your service does not remove the Connection Manager software required to run your service. You must remove the Connection Manager software separately.


Advanced customization

The CMAK wizard supports most of the customization features that administrators need to build a custom Connection Manager service profile. However, you can customize additional features by editing the service profile files, thereby changing the manner in which Connection Manager handles certain functions.

This section covers:

  • Uses for advanced customization
  • Methods of editing service profile files
  • Templates and service profile files
  • Information files
  • Tables of key names and values


Uses for advanced customization

By using advanced customization techniques, you can change the implementation of many Connection Manager functions. For example, you can:

  • Create a custom button that appears on the Connection Manager user interface to start applications or run processes.
  • Prepopulate user name, password, phone number, and dialing properties for use in your service profile.
  • Show a particular set of phone numbers based on user selection of connection device.
  • Remove the General tab from the Properties dialog boxes for VPN-only service profiles.
  • Control whether the Save password check box appears on the Connection Manager user interface.
  • Control whether the Logon domain field appears.
  • Specify your multilink strategy.
  • Specify logging behavior.
  • Turn off balloon-tip help for Connection Manager.

Note

  • Refer to Tables of key names and values for complete lists of keys and values you can modify.


Methods of editing service profile files

The CMAK wizard provides the ability to customize the most frequently used elements of a service profile. However, you might want to customize elements that you cannot configure in the wizard. By adding or editing keys and values to the individual files that make up a service profile, you can provide even higher levels of customization to meet the needs of the most advanced environments.

Service profile file types

Service profiles include files of the following types:

  • Service provider (.cms) files. The .cms files specify the configuration of the phone book and most of the other functions of your service profiles. Most advanced customization for a service profile is done by editing the .cms file for a particular service profile.
  • Connection profile (.cmp) files. The .cmp files contain information specified by the user. Because users can overwrite any changes you make to this file, any changes you make to this file will be available only the first time the service profile is used. Editing this file allows you to provide a first-time-only population of user information. For example, you can fill in the user name, the password, and the phone number fields for the first user to install and open your service profile.
  • Information (.inf) files. The .inf files specify installation information for your service profiles. Although you can edit some setup and uninstall information in an .inf file, you should test the installation after you make any changes. You cannot edit information files from the Advanced Customization pane of the CMAK wizard. To edit .inf files, you must use a plain-text editor.
  • Connection profile (.sed) files. The .sed files contain the instructions for building a self-extracting executable (.exe) file for your service profiles. You should never edit any .sed file.

Important

  • You should not edit these files without a basic understanding of system configuration files. Troubleshooting changes to service-profile files is difficult, so you should be careful if you modify them. Read section and key descriptions carefully. It is advisable to make a backup of these files before you edit them.

Editing files

You can edit specific files used to build the service profile in one of two ways:

  • Select the Advanced customization check box in the Ready to Build the Service Profile pane of the CMAK wizard. If you do this and then click Next, the Advanced Customization pane appears.
  • Edit files after profile creation with any plain-text editor, such as Notepad.

You can use the Advanced customization pane to edit the .cms and .cmp files when you build a service profile. You can select or type in section names, keys, and values. You must click Apply after you specify each change. Some advantages of this method are that the changes you make are built directly into the service profile when you click Next and that you can make many changes quickly. However, if you mistype a section name or a key name and click Apply, you cannot edit or delete that section or key name directly. You can delete a key only by setting the value to blank, and you can delete a section only by setting one of the keys in it to blank.

Important

  • If you set the value of a single key to blank in the Advanced Customization pane, you delete that key and all other keys in that section, as well as the section itself.

To customize a service profile after you have built it, you can edit any of the service profile files with any plain-text editor, such as Notepad. However, you must run the CMAK wizard again after editing the files in this way in order to incorporate your changes.

For more information, see Deciding what to customize, Uses for advanced customization, and ISP and Service Type keys.


Templates and service profile files

You can edit service profile files to customize functions and features that are not controlled through the CMAK wizard. To do this advanced customization, you can edit two sets of service profile files:

  • The template files that are used by the CMAK wizard to build all service profiles
  • The files that are built when you run the CMAK wizard to create a specific service profile

Service profile files consist of the following file types:

  • Service provider (.cms) files. The .cms files specify the configuration of the phone book and most of the other functions of your service profiles. Most advanced customization for a service profile is done by editing the .cms file for that service profile.
  • Connection profile (.cmp) files. The .cmp files contain information specified by the user. Because users can overwrite this information, any changes you make to this file will be available only the first time the service profile is used. Editing this file allows you to provide a first-time-only population of user information. For example, you can fill in the user name, the password, and the phone number fields for the first user to install and open your service profile.
  • Information (.inf) files. The .inf files specify the installation information for your service profiles. Although you can edit some setup and uninstall information in an .inf file, you should test the installation after you make the changes. Information files cannot be edited from the CMAK wizard Advanced Customization pane. To edit them, you must use a text editor.
  • Connection profile (.sed) files. The .sed files contain the instructions for building a self-extracting executable (.exe) file for your service profiles. You should never edit any .sed file.

Important

  • You should not edit these files without a basic understanding of system configuration files. Troubleshooting changes to service-profile files is difficult, so you should be careful if you modify them. Read section and key descriptions carefully. It is advisable to make a backup of these files before you edit them.
  • Do not save template files in Unicode.

Editing template files

You can edit template files, specific service profile files, or both, depending on whether you want to apply your customization options to all service profiles or to a specific service profile only.

Template files

When you install CMAK, the following template files are installed in the \Program Files\CMAK\Support folder:

  • Template.cms
  • Template.cmp
  • Template.inf
  • Template.sed
These files contain the default settings that the CMAK wizard uses to build service profiles. If you want to incorporate the same custom functions in all service profiles that you build, edit the template files before building the service profiles. You must edit the template files with a plain-text editor, such as Notepad. You cannot edit template files with the CMAK wizard.

Generally, you should edit only the .cms template file.

Note

  • Changes you make to the template files apply only to subsequent new service profiles you build using the CMAK wizard.

Built files

When you use the CMAK wizard to build a service profile, the wizard creates a self-extracting executable (.exe) file and several other files containing the settings that you specify. The service profile files are saved in the \Program Files\CMAK\Profiles\ServiceProfileFileName folder. All service profile files have the name ServiceProfileFileName, which you specify in the CMAK wizard. In addition to the .exe file, the wizard creates the following files for each service profile:

  • ServiceProfileFileName.cms
  • ServiceProfileFileName.cmp
  • ServiceProfileFileName.inf
  • ServiceProfileFileName.sed

Changes to template files are reflected only in profiles built after you make the change. If you want profiles built before you make the change to match the template, you must update the profile. To incorporate template changes into a built file, you must run the CMAK wizard again.

For more information, see Deciding what to customize, Uses for advanced customization, and Finishing customization after running the CMAK wizard.


Information files

Only customize entries under the section headers in the information files as specified in this topic.

Information (.inf) file entries

By editing a profile’s .inf file, you can specify commands and programs that run when the user installs or uninstalls your service profile. For example, you can specify:

  • Setup programs that integrate any custom software that you include.
  • Programs that automatically display a readme file.
  • Configuration utilities or cleanup programs.

To add custom setup and uninstall programs to your service profile, you must first create the service profile by running the CMAK wizard and then you must specify any files needed as additional files. After you have built the service profile, specify the necessary commands or programs in the appropriate sections of the .inf file, and then run the CMAK wizard again to incorporate your changes.

The .inf file contains four section headers under which you can include commands and programs to be run at specific points. Use file names of eight characters or less. Do not use spaces in the file names.

This .inf file section header | Contains commands or programs that run
RunPreSetupCommandsSection | Before Setup begins
RunPostSetupCommandsSection | After Setup finishes installing the service profile
RunPreUnInstCommandsSection | Before the uninstall program begins
RunPostUnInstCommandsSection | After the uninstall program runs

Each entry beneath the header should include the name of the command or program to be run and any command line parameters. Each command specified in the .inf file is run only once during an installation or uninstallation process.

Important

  • Incorrectly specified commands or programs in the .inf file can cause significant installation problems. Do not add entries to any of the sections in the .inf file except those previously specified. Thoroughly test all service profiles containing custom .inf entries for version, file, or other conflicts. Be sure that the file location is specified correctly.
  • If you edit Connection Manager 1.0 service profiles in Connection Manager Administration Kit 1.3, the profile is upgraded to Connection Manager 1.3 and the new .inf file replaces the previous .inf file. After the upgrade, you must add your entries to the new .inf file if you want to continue using your custom setup and uninstall commands in the service profiles that you build.

For more information, see Phase four: Preparing for integration, delivery and installation, Incorporating Connection Manager with logon security, and Finishing customization after running the CMAK wizard.


Tables of key names and values

The tables in this section discuss the valid keys for each section of the .cms and .cmp files, the function and use of each key, and where each key can be set (in the CMAK wizard, the .cms file, or the .cmp file).

  • ISP and Service Type keys
  • Connection Manager keys
  • Custom actions keys
  • Networking keys
  • Other sections, keys, and values


ISP and Service Type keys

You can change how Connection Manager defines ISPs and service types. To do this, you need to edit the service (.cms) file. The table in this topic covers the key names and values that are contained in the [ISP] and [Service Type] sections of the .cms file. This topic also describes the formats and conventions you should use in the .cms file.

Formats and conventions

Connection Manager creates service (.cms) files, which use the same format as Windows initialization (.ini) files and information (.inf) files. These files have several things in common:

  • Each file is divided into sections, with specific entries, called keys, assigned to the sections. A section heading is enclosed within brackets ([ ]). For example, [Strings] is a section containing text strings for messages. The keys for a section are not enclosed within brackets.
  • Each value specified for a numeric key must be an integer. Any non-integer value is truncated to an integer or ignored as invalid data. For example, 1.1 is truncated to 1 or ignored.
  • The order in which sections appear is not important; a particular section can be placed anywhere in the file.
  • Each comment in the file begins with a semicolon (;).

For more information on these formats and conventions, see the Microsoft Platform Software Development Kit (SDK) at the Microsoft Web site. (http://www.microsoft.com/)

Table of ISP and Service Type keys

The following table shows the valid keys for the [ISP] and [Service Type] sections of the .cms file, the function and use of each key, and where you must set each key. You can set different keys in the Connection Manager Administration Kit (CMAK) wizard or the .cms file. If you change the .cms file with a text editor, rather than by using the Advanced Customization pane of the CMAK wizard, you must rebuild the profile afterward with the CMAK wizard.

Notes

  • In the following table, keys controlled by specific panes of the CMAK wizard are identified in the Set in column as CMAK. Although these keys appear in the .cms file, you should use the CMAK wizard to update these keys. If you change these keys by editing the .cms file, the CMAK wizard might overwrite them if you run it again on the same profile. Keys set in the Advanced Customization pane of the CMAK wizard are identified as .cms or .cmp, as appropriate.
  • Specify file locations either with the full path or the relative path from the .cmp file directory, as appropriate to the key.
[Section] or key | Definition and values | Set in
[ISP] | Connection types (such as modem or ISDN) that you want to list in the Phone Book dialog box and how you want phone numbers to appear for each connection type. The Mask and Match keys specify whether the number is listed under Access numbers or under More access numbers. Each Mask and Match key has a corresponding option in Phone Book Administrator. | CMAK .cms
PBFile | Location of the phone book (.pbk) file used by the service profile. | CMAK
RegionFile | Location of the region (.pbr) file used by the service profile. | CMAK
PBURL | Uniform Resource Locator (URL) for the phone book update. | CMAK
Mask&FilterName | Mask value for FilterName. | .cms
Match&FilterName | Match value for FilterName. | .cms
FilterA&ServiceProfile | List of filter names to be applied to the access numbers phone-book settings field, for example: FilterA& = NosurchargeSignon The selected phone numbers are listed in the Connection Manager Phone Book dialog box, in Access numbers. Default = NosurchargeSignon | .cms
FilterB&ServiceProfile | List of filter names to be applied to the referenced phone book options field, for example: FilterB& = SurchargeSignon The selected phone numbers are listed in the Connection Manager Phone Book dialog box, in More access numbers. Default = SurchargeSignon. | .cms
References | Service profiles merged through the CMAK wizard. Profile names are separated by commas, tabs, or spaces. Each name is used as a reference to that profile. | CMAK
CMSFile&MergedProfile | Location of a component service profile .cms file for a merged service profile. The format is CMSFile&MergedProfile=Location, where MergedProfile is the name of the top-level service profile and Location is the location of the .cms file for the component service profile, for example: CMSFile&Awesome1 = Awesome1\AwesomeE.cms | CMAK
FilterA&MergedProfile | List of filter names to be applied to the component profile's phone book options field. The format is FilterA&MergedProfile = FilterName, where MergedProfile is the name of the merged service profile, as specified in the CMSFileMergedProfile key, and FilterName is the name of the filter to be applied, for example: FilterA&AwesomeE = NoSurchargeSignon The selected phone numbers are merged into the list in the Connection Manager Phone Book dialog box, in Access numbers. | CMAK
FilterB&MergedProfile | List of filter names to be applied to the component profile's phone book options field. The format is FilterB&MergedProfile = FilterName, where MergedProfile is the name of the merged service profile, as specified in the .cms file References key, and FilterName is the name of the filter to be applied, for example: FilterB&AwesomeE = SurchargeSignon The selected phone numbers are merged into the list in the Connection Manager Phone Book dialog box, in More access numbers. | CMAK
[Service Types] | Items that are listed in the Phone Book dialog box, under Service type. By default, this section contains two service types. At least two service types must be defined in order for phone numbers to appear in the Properties dialog box of the Connection Manager client. | CMAK .cms
ServiceType | A service type as a filter name to be applied to the referenced phone book options field. The format of the entry is ServiceType=FilterName, where ServiceType is the name as it appears in the Phone Book dialog box, in the Service type list, and FilterName is the name of the filter to be associated with the entry, for example: ISDN Multicast = MulticastISDN A service type name should include no more than 25 characters. You can concatenate service type names by inserting a space between each name. At least two service types must be defined in order for phone numbers to appear in the Properties dialog box of the Connection Manager client. | .cms


Connection Manager keys

You can change how Connection Manager handles aspects of its own operation. To do this, you need to edit the service (.cms) file. The table in this topic covers the key names and values that relate to the operation of Connection Manager. It also describes the formats and conventions you should use in the .cms file.

Formats and conventions

Connection Manager creates service (.cms) files and connection profile (.cmp) files, which use the same format as Windows initialization (.ini) files and information (.inf) files. These files have several things in common:

  • Each file is divided into sections, with specific entries, called keys, assigned to the sections. A section heading is enclosed within brackets ([ ]). For example, [Strings] is a section containing text strings for messages. The keys for a section are not enclosed within brackets.
  • Each value specified for a numeric key must be an integer. Any noninteger value is truncated to an integer or ignored as invalid data. For example, 1.1 is truncated to 1 or ignored.
  • The order in which sections appear is not important; a particular section can be placed anywhere in the file.
  • Each comment in the file begins with a semicolon (;).

For more information on these formats and conventions, see the Microsoft Platform Software Development Kit (SDK) at the Microsoft Web site. (http://www.microsoft.com/)

Table of Connection Manager keys

The following table shows the valid keys for the [Connection Manager] section of the .cms and .cmp files, the function and use of each key, and where each key can be set. You can set different keys in the Connection Manager Administration Kit (CMAK) wizard, the .cms file, or the .cmp file. If you change the .cms file with a text editor, rather than by using the Advanced Customization pane of the CMAK wizard, you must rebuild the profile afterward with the CMAK wizard.

Notes

  • In the following table, keys controlled by specific panes of the CMAK wizard are identified in the Set in column as CMAK. Although these keys appear in the .cms file, you should use the CMAK wizard to update these keys. If you change these keys by editing the .cms file, the CMAK wizard might overwrite them if you run it again on the same profile. Keys set in the Advanced Customization portion of the CMAK wizard are identified as .cms or .cmp, as appropriate.
  • Any changes you make to the .cmp file will be available only the first time the service profile is used. Editing this file allows you to provide a first-time-only population of user information. For example, you can fill in the user name, the password and the phone number fields for the first user to install and open your service profile.
  • Make sure that locations are specified either as the full path or in reference to the location of the .cmp file.
[Section] or key | Description and values | Set in
[Connection Manager] Miscellaneous service profile keys and values. CMAK
.cms
.cmp
Dialup Whether dial-up connections are supported. If this key is set to 0, the General tab of the Properties dialog box will not be displayed in Connection Manager.

0 = No.
1 (default) = Yes.

 .cms
Direct Whether direct connections are supported.

0 = No.
1 (default) = Yes.

This key is valid only for virtual private network (VPN) service profiles.

 .cms
ConnectionType The connection method to be used.

0 (default) = Connect by using a dial-up connection.
1 = Connect by using a direct connection (for example, DSL).

This key is valid only if both the Dialup key and the Direct key values are set to 1. The user can change this option in the Properties dialog box, on the General tab.

.cmp
CMSFile | Name of the service profile file: (\Path\ServiceProfileFileName.cms), as entered in File name on the Service and File Names pane. Do not use any of the following in this name: ! @ ^ & ( ) { } ` ´ ~ , ; <space> * = \ / : ? ' " < > | . % + [ ] $ #. Do not alter this value in the .cmp file. If a different name is required, use the CMAK wizard to edit the existing profile, specify new names for both the Service name and the File name, and then finish running the wizard. | CMAK
ServiceName The primary identifier for the profile. This text appears in the Connection Manager logon dialog box as the service name and as the name of the connection.

Maximum = approximately 35 characters. Do not use any of the following in this name: * \ / : ? " < > | [ ]

 CMAK
ServiceMessage Connection Manager logon dialog box service message, usually a customer-support number for the service.

Maximum = Approximately 50 characters.

 CMAK
UserName | Name used to authenticate the user, for first-time use. | .cmp
InternetUserName | User name for VPN connections, for first-time use. | .cmp
UseSameUserName Whether to use a separate user name and password when connecting to the Internet service provider (for a VPN connection).

0 (default) = Use the separate user name and password as specified by the user in the Properties dialog box, on the Internet Logon tab. Service profiles built to support VPN connections contain this additional tab.
1 = Use the same user name and password when connecting to the Internet service provider as is specified in the Connection Manager logon dialog box for logging on to the private service.

 CMAK
UseWinLogonCredentials Whether or not to incorporate the user name, password, and domain specified when the user logged on most recently to Windows (Windows 2000, XOX, and members of the Windows Server 2003 family only).

0 = Do not use credentials.
1 (default) = Use credentials.

 .cms
GlobalCredentials XOX and Windows Server 2003 family only. Whether to save the user name and password supplied for first-time use of the connection for all users of the connection.

0 (default) = Save the user name and password for a single user.
1 = Save the user name and password for all users of the connection.

 .cmp
KeepDefaultCredentials Whether to keep first-time credentials such as user name and password in the .cmp file of the profile, for persistent default display and usage for all first-time users of the profile. For single-user profiles, this information will only be displayed once.

0 (default) = Do not keep first-time credentials in the .cmp file.
1 = Keep first-time credentials in the .cmp file.

 .cmp
UserNamePrefix | Prefix added to the user name. Enables access to a service that requires a realm name as a user name prefix. This key will not be used in a VPN connection. | CMAK
UserNameSuffix | Suffix appended to the user name. Enables access to a service that requires a realm name as a user name suffix. This key will not be used in a VPN connection. | CMAK
MaxUserName Maximum length of the user name.

Default = 256 bytes.

 .cms
UserNameOptional Whether the user must type a user name in the Connection Manager logon and Internet logon dialog boxes.

0 (default) = User name required.
1 = User name not required.

 .cms
HideUserName Whether the User name box appears in the Connection Manager logon dialog box.

0 (default) = Display the box.
1 = Do not display the box.

If the box is hidden, the data is considered optional.

 .cms
HideInternetUsername Whether the User name box appears in the Properties dialog box, Internet Logon tab.

0 (default) = Display the box.
1 = Do not display the box.

If the box is hidden, the data is considered optional. If HideInternetPassword and HideInternetUsername are both 1, the Internet Logon tab is not displayed.

 .cms
Password | The password that appears automatically the first time the profile is used. | .cmp
InternetPassword | The password that appears automatically the first time the user tries to connect using your VPN connection. | .cmp
PasswordHandling Method of handling the password during the logon process.

0 (default) = Normal (case sensitive).
1 = Lowercase password.
2 = Uppercase password.

 .cms
MaxPassword Maximum length of the password that can be typed by the user.

Default = 127 bytes.

 .cms
PasswordOptional Whether the user must specify a password in the Connection Manager logon and Internet logon dialog boxes.

0 (default) = Password required.
1 = Password not required.

 .cms
RememberPassword Whether to have the Save password check box in the Connection Manager logon dialog box selected by default for a populated password. This key is ignored if the Password key is not set in the .cmp file.

0 (default) = The check box is not selected by default.
1 = The check box is selected by default, and the password is saved.

 .cmp
RememberInternetPassword Whether to have the Save password check box on the Internet Logon tab selected by default for a populated Internet password. This key is ignored if the InternetPassword key is not set in the .cmp file.

0 (default) = The check box is not selected by default.
1 = The check box is selected by default, and the password is saved.

 .cmp
HideRememberInternetPassword Whether to show the Save Password check box on the Internet Logon tab. If this key is not specified, the value of HideRememberPassword is used by default.

0 = Display check box.
1 = Do not display check box.

 .cms
ResetPassword | Whether the New button appears in the Connection Manager logon dialog box to enable a user to change the password. You can use this button to set up a custom password option. Type the location (including the name) of the executable (.exe) program you use to support this process. You must provide an executable program for this option and include it as an additional file when you run the CMAK wizard. | .cms
HidePassword Whether the Password box appears in the Connection Manager logon dialog box when using dial-up connections.

0 (default) = Display the box.
1 = Do not display the box.

If the box is hidden, the data is considered optional.

 .cms
HideInternetPassword Whether the Password box appears in the Properties dialog box, on the Internet Logon tab.

0 (default) = Display the box.
1 = Do not display the box.

If the box is hidden, the data is considered optional. If HideInternetPassword and HideInternetUsername are both 1, the Internet Logon tab is not displayed.

 .cms
DomainOptional Whether to require the user to enter a domain name when making a connection.

0 = Require a domain.
1 (default) = Do not require a domain.

 .cms
HideRememberPassword Whether to display the Save password check box in the Connection Manager logon dialog box and on the Internet Logon tab.

0 (default) = Display the check box.
1 = Do not display the check box.

If HideRememberPassword is set to 1, it overrides the HideDialAutomatically setting.

 .cms
Domain | Logon domain name that appears automatically the first time the profile is used. | .cmp
MaxDomain Maximum length of the domain name that can be typed by the user.

Default = 15 characters.

 .cms
HideDomain Whether the Logon domain box appears in the Connection Manager logon dialog box when using dial-up connections.

0 = Display the box.
1 = Do not display the box.

The default is 1. If the profile supports VPN connections, CMAK will set this value to 0 if you have not previously set a value. If the box is hidden, the data is considered optional.

 .cms
DialAutomatically Whether to have the Connect automatically check box in the Connection Manager logon dialog box selected by default and to connect automatically when the service profile is used for the first time.

0 (default) = Do not select the check box.
1 = Select the check box and connect automatically.

 .cmp
DialAutoMessage | Text displayed when the Dial Automatically check box has been selected. | .cms
HideDialAutomatically Whether the Connect automatically check box appears in the Connection Manager logon dialog box.

0 (default) = Display the check box.
1 = Do not display the check box.

If HideRememberPassword is set to 1, that key value overrides the HideDialAutomatically setting.

 .cms
Phone0 | Primary phone number populated for the user the first time the service profile is used, and used as the default phone number any time another phone number is not selected. | .cmp
Phone1 | Backup phone number populated for the user the first time the service profile is used. | .cmp
PhoneCanonical0 | The canonical format of the primary phone number the first time the service profile is used. | .cmp
PhoneCanonical1 | The canonical format of the backup phone number the first time the service profile is used. | .cmp
MaxPhoneNumber | Specifies a character limit for the phone number fields. The default for Windows 95, Windows 98, and Windows Millennium Edition is 36; the default for Windows NT 4.0, Windows 2000, XOX, and members of the Windows Server 2003 family is 80. | .cms
PhoneCountry0 | Telephony Application Programming Interface (TAPI) country/region code for the primary phone number set as default for the user the first time the service profile is used. | .cmp
PhoneCountry1 | Telephony Application Programming Interface (TAPI) country/region code for the backup phone number set as default for the user the first time the service profile is used. | .cmp
UseDialingRules0 Whether dialing rules are applied to the primary phone number the first time the service profile is used.

0 = Use the form of the number exactly as it appears in the phone book or as it is typed.
1 (default) = Apply dialing rules to the number when displaying and dialing.

.cmp
UseDialingRules1 Whether dialing rules are applied to the backup number the first time the service profile is used.

0 = Use the form of the number exactly as it appears in the phone book or as it is typed.
1 (default) = Apply dialing rules to the number when displaying and dialing.

.cmp
NoDialingRules Whether the user can use dialing rules on phone numbers selected from a phone book. Dialing rules check boxes are grayed out when this key value is set to 1.

0 (default) = Allow dialing rules.
1 = Do not allow dialing rules.

 .cms
PhoneSource0 | Service profile for the primary phone number to be used the first time the user connects. | .cmp
PhoneSource1 | Service profile for the backup phone number to be used the first time the user connects. | .cmp
Description0 | Description of the primary phone number provided the first time the service profile is opened. Appears in the Phone Book dialog box as a Point of Presence (POP) name. | .cmp
Description1 | Description of the backup phone number provided the first time the service profile is opened. Appears in the Phone Book dialog box as a POP name. | .cmp
DUN0 | Dial-up entry used for the primary phone number the first time the service profile is opened. Value must exactly match the entry name specified in Phone Book Administrator. | .cmp
DUN1 | Dial-up entry used for the backup phone number the first time the service profile is opened. Value must exactly match the entry name specified in Phone Book Administrator. | .cmp
ServiceType0 | Default service type from the phone book for the primary phone number the first time that the service profile is opened. | .cmp
ServiceType1 | Default service type from the phone book for the backup phone number the first time that the service profile is opened. | .cmp
Region0 | Default state or province from the phone book for the primary phone number the first time that the service profile is opened. | .cmp
Region1 | Default state or province from the phone book for the backup phone number the first time that the service profile is opened. | .cmp
Version | Version of the phone book. If you use Connection Point Services (CPS) to provide phone books, the CPS phone book server will use this value to determine how to handle phone book updates. If the version on the client is more than five versions out of date, the CPS phone book server downloads the complete phone book. Otherwise, the CPS phone book server downloads a delta file to the client. | .cms
DUN Specifies the default network entry used when the Dial-up Networking entry field for a POP is blank.

Default = ServiceProfileServiceName.

 .cms
RedialCount Number of redials to attempt the first time the service profile is opened.

Default = 3.

 .cmp
RedialDelay Delay (in seconds) between dials. The delay is the elapsed time between the point of failure of the first call and the dialing of the first digit of the next phone number.

Default = 5 seconds.

 .cms
IdleTimeout Time (in minutes) that the connection must be idle before disconnecting the first time the service profile is used to connect.

Default = 10 minutes.
If set to 0, no time-out occurs.

 .cmp
IdleThreshold Maximum bytes per minute that can be received if an idle state is to be detected for the connection.

Default = 0.

This key is not available for use on Windows NT 4.0 systems.

 .cms
AutoReconnect Whether to automatically attempt to reconnect when a connection is terminated unexpectedly.

0 (default) = Do not automatically attempt to reconnect.
1 = Attempt to reconnect when the connection is terminated unexpectedly.

 .cms
NoPromptReconnect Whether the user is prompted for reconnection when the connection is inadvertently dropped.

0 (default) = Prompt the user.
1 = Do not prompt the user.

 .cms
Icon Location and name of the icon (.ico) file for the large program icon.

Default = The default value for this key is blank. When nothing is specified, the standard Connection Manager program icon is used.

 CMAK
SmallIcon Location and name of the icon (.ico) file for the small title-bar icon.

Default = The default value for this key is blank. When nothing is specified, the standard Connection Manager title-bar icon is used.

 CMAK
TrayIcon Location and name of the icon (.ico) file for the notification area shortcut.

Default = The default value for this key is blank. When nothing is specified, the Connection Manager notification area shortcut is used.

 CMAK
HideTrayIcon Whether to display notification area shortcuts.

NULL = If TrayIcon is set, display the notification area shortcut specified. Otherwise, display the connection-status notification area shortcut ("blinking lights"). The NULL value is available for Windows 2000, XOX, and members of the Windows Server 2003 family only.
0 = If TrayIcon is set, display the notification area shortcut specified and the connection-status notification area shortcut ("blinking lights"). Otherwise, display the Connection Manager notification area shortcut and the connection-status notification area shortcut ("blinking lights").
1 = Do not display any notification area shortcuts.

If you choose not to display any notification area shortcuts, edit the Help file to remove references to it.

 .cms
Logo Location and name of the .bmp file displayed in the Connection Manager logon dialog box.

Default = The default value for this key is blank. When nothing is specified, the standard Connection Manager logon bitmap is used.

 CMAK
PBLogo Location and name of the .bmp file for the Phone Book dialog box.

Default = The default value for this key is blank. When nothing is specified, the standard Phone Book bitmap is used.

 CMAK
PBMessage Text in the Phone Book dialog box next to More access numbers when alternate access numbers are available for the selected geographic region.

Maximum = Approximately 100 characters.

 CMAK
PBUpdateMessage Text that appears in the dialog box during a phone book update.

Default = "Downloading new phone book."

 .cms
DownloadDelay Time (in seconds) to delay before downloading phone book updates. The delay time starts when the connection is established.

Default = 15 seconds.

This entry is valid only when, in the CMAK wizard, in the Phone Book dialog box, Automatically download phone book updates is selected.

 .cms
HideDelay Time (in seconds) to delay before displaying the Phone Book Updates dialog box (with progress indicators and message).

Default = Do not display the dialog box.

 .cms
HelpFile Location (including name) of the custom Help file.

Default Help file = The default value for this key is blank. When nothing is specified, the standard Help file for service profiles is used.

 CMAK
Tunnel Whether VPN connections are enabled for the phone numbers in the top-level phone book.

0 (default) = Not enabled.
1 = Enabled.

 CMAK
TunnelDUN Specifies the default networking entry used for VPN connections.

Default = ServiceProfileServiceName tunnel.

 .cms
TunnelFile | The relative path and file name to the VPN file. If you use macros in the relative path, make sure the macros are recognized on all operating systems to which you want to distribute the profile. | CMAK
TunnelAddress | IP address or domain name for the VPN server. | CMAK
TunnelReferences Whether VPN connections are enabled for phone numbers taken from a component profile phone book in a top-level service profile.

0 (default) = Do not use a VPN connection when using any of these phone numbers.
1 = Use a VPN connection when using a phone number from a component profile.

 CMAK
AnimatedLogo Whether an animation is used instead of a static bitmap in the Connection Manager logon dialog box.

0 (default) = Do not use animated graphic.
1 = Use animated graphic.

The [Animated Logo] section specifies the location of the animation (.spl or .swf) file. This function is provided for compatibility with Connection Manager 1.0, which supports Macromedia Flash animation files.

CMAK
.cms
CheckOSComponents Whether Connection Manager checks the operating system components.

0 (default) = Check the operating system components only when an error occurs.
1 = Always check the operating system components on service profile initialization.

 .cms
DoNotCheckBindings Whether to include the TCP/IP bindings when checking operating system components.

0 (default) = Include the TCP/IP bindings in the TCP/IP check and bind all that are not bound.
1 = Do not include the TCP/IP bindings when checking operating system components.

TCP/IP services that sit between the TCP/IP protocol and the dial-up adapter are protected from checking only if this option is set to 1 in all installed service profiles. This option does not prevent bindings from being checked by other service profiles or programs.

 .cms
IsdnDialMode Whether Connection Manager binds two channels on the same ISDN device.

0 (default) = Do not bind (use single channel only).
1 = Always bind the two channels (connect both channels automatically). If a dual channel connection cannot be made, the connection attempt will fail. This entry is valid only for Windows NT 4.0, Windows 2000, Windows Millennium Edition, XOX, and members of the Windows Server 2003 family.
2 = Attempt to bind the two channels (connect with both channels). If the two channels cannot be bonded, use single channel. This entry is valid only for Windows 2000, XOX, and members of the Windows Server 2003 family.

 .cms
EnableICF XOX and Windows Server 2003 family only. Whether to turn on Internet Connection Firewall (ICF) for this connection with default settings.

0 (default) = Do not adjust ICF settings.
1 = Enable ICF for the connection with default settings.

 .cms
DisableICS XOX and Windows Server 2003 family only. Whether to suppress the user's ability to share the connection with Internet Connection Sharing (ICS).

0 (default) = Do not suppress ICS settings.
1 = Disable ICS settings for this connection.

 .cms
HideAdvancedTab XOX and Windows Server 2003 family only. Whether to suppress the display of the Advanced tab in the Connection Manager user interface for this connection.

0 (default) = Do not suppress display of the Advanced tab.
1 = Suppress display of the Advanced tab.

 .cms
CustomButtonText | Text displayed on a custom button on the main connect screen. This feature is not supported when logging on to Windows. | .cms
CustomButtonToolTip | Text displayed on a tooltip for a custom button on the main connect screen. This feature is not supported when logging on to Windows. | .cms
MonitorCallingProgram When Connection Manager is called programmatically, whether to handle Connection Manager as a monitored custom action when the calling process terminates.

0 = Do not monitor.
1 (default) = Monitor.

 .cms
EnableLogging Whether a log file is created for the connection the first time the service profile is opened. The log file is named ServiceProfileServiceName.log for an all user profile, and ServiceProfileServiceName (Single User).log for a single user profile.

0 = Do not create a log file.
1 (default) = Create a log file.

 .cmp
HideBalloonTips Whether to suppress display of balloon-tip help for this connection.

0 (default) = Do not suppress balloon-tip help.
1 = Suppress balloon-tip help.

 .cms
InternetConnection XOX and Windows Server 2003 family only. Whether to inform the operating system that this connection is a connection to the Internet.

0 (default) = Do not inform the operating system that this connection connects to the Internet for the purposes of automatically connecting when no connection is present.
1 = Allow the system to register this connection as a connection to the Internet.

 .cms


Custom actions keys

You can change how Connection Manager handles custom actions. To do this, you need to edit the service (.cms) file. The table in this topic covers the key names and values that pertain to the custom actions sections of the .cms file. This topic also describes the formats and conventions you should use in the .cms file.

Formats and conventions

Connection Manager creates service (.cms) files, which use the same format as Windows initialization (.ini) files and information (.inf) files. These files have several things in common:

  • Each file is divided into sections, with specific entries, called keys, assigned to the sections. A section heading is enclosed within brackets ([ ]). For example, [Strings] is a section containing text strings for messages. The keys for a section are not enclosed within brackets.
  • Each value specified for a numeric key must be an integer. Any noninteger value is truncated to an integer or ignored as invalid data. For example, 1.1 is truncated to 1 or ignored.
  • The order in which sections appear is not important; a particular section can be placed anywhere in the file.
  • Each comment in the file begins with a semicolon (;).

For more information on these formats and conventions, see the Microsoft Platform Software Development Kit (SDK) at the Microsoft Web site. (http://www.microsoft.com/)

Table of custom actions keys

The following table shows the valid keys for custom actions in the .cms file, the function and use of each key, and where each key can be set. You can set different keys in the Connection Manager Administration Kit (CMAK) wizard or in the .cms file. If you change the .cms file with a text editor, rather than by using the Advanced Customization pane of the CMAK wizard, you must rebuild the profile afterward with the CMAK wizard.

Notes

  • In the following table, keys controlled by specific panes of the CMAK wizard are identified in the Set in column as CMAK. Although these keys appear in the .cms file, you should use the CMAK wizard to update these keys. If you change these keys by editing the .cms file, the CMAK wizard might overwrite them if you run it again on the same profile. Keys set in the Advanced Customization pane of the CMAK wizard are identified as .cms or .cmp, as appropriate.
  • Make sure that locations are specified either as the full path or in reference to the location of the .cmp file.
[Section] or key name Value Set in
[Pre-Init Actions] Pre-init actions that run as soon as the profile is accessed. This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[Pre-Connect Actions] Pre-connect actions that run before a connection is established. This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[Pre-Dial Actions] Pre-dial actions that run immediately before dialing. This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[Pre-Tunnel Actions] Pre-tunnel actions that run after a connection is established but before a VPN connection is established. This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[Connect Actions] Post-connect actions that run after a connection is established and, if using a VPN connection, after the tunnel is established. This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[Disconnect Actions] Disconnect actions that run immediately before disconnecting. If a connection is prematurely dropped, these actions are run immediately after the disconnect. This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[On-Cancel Actions] On cancel actions that run when the user cancels a session after the connection attempt has been started (any time that the user clicks Connect and then clicks Cancel). This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[On-Error Actions] On error actions that run when an error occurs. This section uses the following keys: #, #&Flags, and #&Description. CMAK
.cms
[Auto Applications] Monitored actions that run during a connection. Monitored actions are similar to custom actions, but they cause the disconnect sequence to start as soon as the last monitored application closes. This section uses the following keys: #, #&Flags, and #&Description. Unlike other custom actions, monitored actions do not support DLLs. CMAK
.cms
# A single custom action. The format of the value is # = Program, where # is an ID number from 0 to n and Program is the complete name of the program, including the extension and the path to the program. Programs start in sequence: 0 first, 1 next, and so on. Environmental variables, such as %UserName% and %ErrorCode%, are set in Connection Manager and can be used as parameters for custom action programs. CMAK
#&Flags Whether a custom action runs when a specific type of connection is established. The format of the value is #&Flags = n, where # is the ID number of a defined custom action and n is a value indicating how dial-up and direct connections for that custom action are handled:
  • If n = 0 (default), all connections trigger this custom action. (The default key does not appear in the .cms file.)
  • If n = 1, all direct tunnel connections trigger this custom action.
  • If n = 2 , all connections that involve dialing (direct or double) trigger this custom action.
  • If n = 4, only connections that use direct dial-up trigger this custom action.
  • If n = 8, only connections that involve a tunnel trigger this custom action.
 CMAK
#&Description A short description of a custom action. The format of the value is #&Description = text, where # is the number of a defined custom action and text is the descriptive information for that custom action. This option can provide useful information when a synchronous custom action does not run properly.

Default = the name of the custom action program.

 CMAK


Networking keys

You can change how Connection Manager handles networking. To do this, you need to edit the service (.cms) file. The table in this topic covers the key names and values that pertain to the networking sections of the .cms file. This topic also describes the formats and conventions you should use in the .cms file.

Formats and conventions

Connection Manager creates service (.cms) files, which use the same format as Windows initialization (.ini) files and information (.inf) files. These files have several things in common:

  • Each file is divided into sections, with specific entries, called keys, assigned to the sections. A section heading is enclosed within brackets ([ ]). For example, [Strings] is a section containing text strings for messages. The keys for a section are not enclosed within brackets.
  • Each value specified for a numeric key must be an integer. Any noninteger value is truncated to an integer or ignored as invalid data. For example, 1.1 is truncated to 1 or ignored.
  • The order in which sections appear is not important; a particular section can be placed anywhere in the file.
  • Each comment in the file begins with a semicolon (;).

For more information on these formats and conventions, see the Microsoft Platform Software Development Kit (SDK) at the Microsoft Web site. (http://www.microsoft.com/)

Table of networking keys

The following table shows the valid keys for networking in the .cms file, the function and use of each key, and where each key can be set. You can set different keys in the Connection Manager Administration Kit (CMAK) wizard or the .cms file. If you change the .cms file with a text editor, rather than by using the Advanced Customization pane of the CMAK wizard, you must rebuild the profile afterward with the CMAK wizard.

Notes

  • In the following table, keys controlled by specific panes of the CMAK wizard are identified in the Set in column as CMAK. Although these keys appear in the .cms file, you should use the CMAK wizard to update these keys. If you change these keys by editing the .cms file, the CMAK wizard might overwrite them if you run it again on the same profile. Keys set in the Advanced Customization pane of the CMAK wizard are identified as .cms or .cmp, as appropriate.
  • Make sure that locations are specified either as the full path or in reference to the location of the .cmp file.
[Section] or key | Value | Set in
[Server&TunnelDUN] | Configuration to be used for all VPN connections. In this section title, TunnelDUN is the value of the TunnelDUN key in the [Connection Manager] section, for example, [Server&Awesome1 Tunnel]. This section uses the same format as the [Server&EntryName] section, including all keys valid under that section. | CMAK .cms
[Server&EntryName] | Configuration where EntryName is the name of the dial-up entry, for example, [Server&Awesome1]. | CMAK
SecureLocalFiles | For Windows NT, Windows 2000, XOX, and the Windows Server 2003 family only. Whether to share local files and allow printer sharing. If the value of the key is set to 1, it will disable NetBT on Windows 2000, XOX, and the Windows Server 2003 family. This key value will be ignored on XOX and the Windows Server 2003 family if a value is assigned to the SecureClientForMSNet key, the SecureFileAndPrint key, or both. 0 (default) = Share local files. 1 = Do not share local files. | CMAK
SecureClientForMSNet | For XOX and Windows Server 2003 family only. Whether to allow the use of NetBT. If this key is set, the value of the SecureLocalFiles key will be ignored on XOX and the Windows Server 2003 family. 0 (default) = Allow the use of NetBT. 1 = Do not allow the use of NetBT. | .cms
SecureFileAndPrint | For XOX and Windows Server 2003 family only. Whether to enable file and print sharing. If this key is set, the value of the SecureLocalFiles key will be ignored on XOX and the Windows Server 2003 family. 0 (default) = Enable. 1 = Disable. Files and print resources will not be shared. | .cms
DataEncrypt | Whether to force data encryption. On Windows 2000, XOX, and Windows Server 2003 family, if the EncryptionType key is set, the value of the DataEncrypt key is ignored. 0 (default for dial-up entries) = Do not encrypt data. 1 (default for VPN entries) = Encrypt data. | CMAK
EncryptionType | Which encryption level is to be used. 0 = None. 1 (default for VPN) = Require. 3 (default for dial-up) = Optional. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
DontNegotiateMultilink | For XOX and Windows Server 2003 family only. Whether to allow multilinking. 0 (default) = Allow multilink. 1 = Do not allow multilink. | .cms
DontUseRasCredentials | For XOX and Windows Server 2003 family only. Whether to cache the user's credentials in Stored User Names and Passwords for use when accessing resources after logging onto the network. 0 (default) = Cache and use credentials. 1 = Do not cache and use credentials. | .cms
NetworkLogon | Whether to log on to the network. 0 = Do not log on. This is the default for dial-up connections. 1 = Log on. This is the default for VPN connections. | CMAK
SW_Compress | Whether to negotiate PPP software compression of data. 0 = Do not negotiate. 1 (default) = Negotiate. | .cms
Disable_LCP | Whether to enable Link Control Protocol (LCP) extensions. 0 (default) = Enable. 1 = Disable. | .cms
PW_Encrypt | Whether to encrypt a password when authenticating. 0 (default) = Do not encrypt. 1 = Encrypt. | CMAK
PW_EncryptMS | Whether to require MS-CHAP version 1 for this connection. 0 = Do not require MS-CHAP v1. 1 = Require MS-CHAP v1. | CMAK
Negotiate_TCP/IP | Whether to negotiate TCP/IP. 0 = Do not negotiate. 1 (default) = Negotiate. | .cms
Negotiate_IPX | Whether to negotiate the IPX protocol. 0 (default) = Do not negotiate. 1 = Negotiate. XOX | .cms
Negotiate_NetBEUI | Whether to negotiate the NetBIOS extended user interface (NetBEUI) protocol. 0 (default) = Do not negotiate. 1 = Negotiate | .cms
Require_PAP | Whether Password Authentication Protocol (PAP) is allowed. 0 (default) = Not allowed. 1 = Allowed. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
Require_SPAP | Whether SPAP is allowed. 0 (default) = Not allowed. 1 = Allowed. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
Require_EAP | Whether Extensible Authentication Protocol (EAP) is allowed. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. 0 (default) = Not allowed. 1 = allowed. | CMAK
Require_CHAP | Whether Challenge Handshake Authentication Protocol (CHAP) is allowed. 0 = Not allowed. 1 (default) = Allowed. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
Require_MSCHAP | Whether MSCHAP is allowed. 0 = Not allowed. 1 (default) = Allowed. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
Require_MSCHAP2 | Whether MSCHAP2 is allowed. 0 = Not allowed. 1 (default) = Allowed. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
Require_W95MSCHAP | Whether W95MSCHAP is allowed. If the value for this key is set to 1, the value for Require_MS-CHAP must also be set to 1. 0 (default) = Not allowed. 1 = Allowed. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | .cms
Custom_Security | Applies specific security settings on computers that are running Windows 2000, XOX, or a member of the Windows Server 2003 family. 0 = Use standard configuration. 1 (default) = Use custom configuration. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
CustomAuthKey | The ID of the Extensible Authentication Protocol (EAP) to be used with this connection. The format is CustAuthKey=ID, where ID is the Internet Assigned Numbers Authority (IANA) ID for the EAP. If no ID is specified, no attempt will be made to read the CustomAuthData value. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
CustomAuthData# | The configuration data for the EAP. The format is CustomAuthData#=EAPConfigurationData, where # is the number of the specific line of data, for example: CustomAuthData0=1AFGKLMOFGH23K Each line can contain a maximum of 128 characters. If the ID has more than 128 characters, it must be specified as multiple lines, incrementing the # for each line of data. For example: CustomAutData0=First128Characters CustomAuthData1=Next128Characters CustomAuthData2=FinalCharacters Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
EnforceCustomSecurity | Whether to enforce the user to select a phone book entry that includes support for advanced security settings. 0 (default) = Do not enforce phone book entry selection (Windows 95, Windows 98, Windows NT 4.0, and Windows Millennium Edition only). 1 = Enforce selection of phone book entries that support advanced security settings. | CMAK
DisableNbtOverIP | Whether to disable the NetBT routing protocol for this connection. 0 (default) = Do not disable NetBT. 1 = Leave NetBT enabled. | .cms
[TCP/IP&TunnelDUN] | TCP/IP configuration to be used for all VPN connections. In this section title, TunnelDUN is the value of the TunnelDUN key in the [Connection Manager] section, for example, [TCP/IP&Awesome1 Tunnel]. This section uses the same format as the [TCP/IP&EntryName] section, including all keys valid under that section. This section is created by the CMAK wizard, but the keys can be edited in the .cms file. | CMAK .cms
[TCP/IP&EntryName] | Configuration where EntryName is the name of the dial-up entry, for example: [TCP/IP&Awesome1] | CMAK .cms
Specify_IP_Address | Whether to specify a static IP address. 0 (default) = Do not specify. 1 = Specify. | .cms
IP_Address | Static IP addresses. | .cms
Specify_Server_Address | Whether to specify static DNS or Windows Internet Name Service (WINS) addresses. 0 (default) = Do not specify. 1 = Specify. | CMAK
DNS_Address | DNS address. | CMAK
DNS_Alt_Address | Alternate DNS address. | CMAK
WINS_Address | WINS address. | CMAK
WINS_Alt_Address | Alternate WINS address. | CMAK
IP_Header_Compress | Whether to enable IP header compression. 0 = Not enabled. 1 (default) = Enabled. | CMAK
Gateway_On_Remote | Whether to use the default gateway on the remote private network. 0 = Do not use. 1 (default) = Use. | CMAK
DNSSuffix | DNS suffix to use for the connection. Valid only for XOX and Windows Server 2003 family. | .cms
TcpWindowSize | For Windows 2000, XOX, and the Windows Server 2003 family only. Sets the size (expressed in bytes) of the window offered by the connection. Number of bytes of information to send before expecting a return packet. Minimum value is 4,096; maximum value is 65,500. If this key is not set, the default window size for the operating system and the connection type will be used. | .cms
[Networking&TunnelDUN] | The single configuration to be used for all VPN connections. In this section title, TunnelDUN is the value of the TunnelDUN key in the [Connection Manager] section, for example, [Networking&Awesome1 Tunnel]. | CMAK
VpnStrategy | Which tunneling protocol to use when establishing a VPN connection. 1 = Use PPTP only. 2 = Try PPTP first. 3 = Use L2TP only. 4 = Try L2TP first. Valid only for Windows 2000, XOX, and the Windows Server 2003 family. | CMAK
UsePreSharedKey | Windows 2000, XOX, and the Windows Server 2003 family only. Whether to use a pre-shared key for L2TP/IPSec authentication. 0 (default) = Do not use a pre-shared key. 1 = Use a pre-shared key. | CMAK
VPNEntry | Specifies to CMAK whether the entry is a VPN entry and not a dial-up entry. 0 = Dial-up entry. 1 = VPN entry. | CMAK
[Scripting&EntryName] | Location (path and file name) of the script (.scp) file, where EntryName is the name of the dial-up entry, for example: [Scripting&Awesome1]). | CMAK
Name | Location (including path and file name) of the script (.scp) file for the dial-up entry. | CMAK
UseTerminalWindow | For Windows 2000, XOX, and the Windows Server 2003 family only. Whether to use a terminal window when connecting to a service. 0 (default) = Do not use a terminal window. 1 = Use a terminal window. | .cms


Other sections, keys, and values

This topic covers sections, keys, and values that might appear in service (.cms) files, particularly those created with older versions of the Connection Manager Administration Kit (CMAK) wizard.

Formats and conventions

Connection Manager creates service (.cms) files, which use the same format as Windows initialization (.ini) files and information (.inf) files. These files have several things in common:

  • Each file is divided into sections, with specific entries, called keys, assigned to the sections. A section heading is enclosed within brackets ([ ]). For example, [Strings] is a section containing text strings for messages. The keys for a section are not enclosed within brackets.
  • Each value specified for a numeric key must be an integer. Any noninteger value is truncated to an integer or ignored as invalid data. For example, 1.1 is truncated to 1 or ignored.
  • The order in which sections appear is not important; a particular section can be placed anywhere in the file.
  • Each comment in the file begins with a semicolon (;).

For more information on these formats and conventions, see the Microsoft Platform Software Development Kit (SDK) at the Microsoft Web site. (http://www.microsoft.com/)

Table of other sections, keys, and values

The following table shows valid sections, keys, and values in the .cms file, the function and use of each key, and where each key can be set. You can set different keys in the CMAK wizard or the .cms file. If you change the .cms file with a text editor, rather than by using the Advanced Customization pane of the CMAK wizard, you must rebuild the profile afterward with the CMAK wizard.

Notes

  • In the following table, keys controlled by specific panes of the CMAK wizard are identified in the Set in column as CMAK. Although these keys appear in the .cms file, you should use the CMAK wizard to update these keys. If you change these keys by editing the .cms file, the CMAK wizard might overwrite them if you run it again on the same profile. Keys set in the Advanced Customization pane of the CMAK wizard are identified as .cms or .cmp, as appropriate.
  • Make sure that locations are specified either as the full path or in reference to the location of the .cmp file.
[Section] or key | Value | Set in
[Logging] | Section header for logging keys. | .cms
FileDirectory | Location of the log file. If the value is blank, the log file is created in the temp folder. | .cms
MaxFileSize | The maximum file size (in kilobytes) before the log is cleared. The file size is checked at initialization to prevent data loss during a connection. The default is 100. | .cms
[Menu Options] | Shortcut menu that appears when a user right-clicks the notification area shortcut for your service. | CMAK .cms
MenuItemName | Command to be run from the shortcut menu. Shortcut menu commands use the format MenuItemName = Program, where MenuItemName is the descriptive name that appears on the shortcut menu and Program is the name of the executable file (.exe or other shell executable), including any parameters required for the program. For example, if you wanted to add Notepad to the menu with the command name "Editor," the line would be Editor = Notepad.exe. Default commands = Status and Disconnect. These programs are available in a shortcut menu that appears when a user right-clicks the notification area shortcut. Applications are listed in the menu in the same sequence as they are listed in the .cms file. | CMAK
[Animated Logo] | Animation for the Connection Manager logon dialog box. The [Animated Logo] section specifies the location of the animation (.spl or .swf) file. This function is provided for compatibility with Connection Manager 1.0, which supports Macromedia Flash animation files. AnimatedLogo in the [Connection Manager] section determines whether an animation is used. | .cms
Movie | Location of the animation file displayed in place of the static bitmap in the logon dialog box. Settings in the [Animated Actions] section control how the animation plays based on the connection state. | .cms
Parameter | Other animation parameters passed from software used to create the animation, such as Quality = 3. | .cms
[Animated Actions] | When to play segments of the animation. | CMAK .cms
Initial | Starting frame number; plays when Connection Manager starts. | .cms
Dialing0 | Starting frame number; plays while the primary phone number is dialed. | .cms
Pausing | Starting frame number; plays during pauses between dials. | .cms
Dialing1 | Starting frame number; plays while the backup phone number is dialed. | .cms
Authenticating | Starting frame number; plays during user authentication. | .cms
Tunneling | Starting frame number; plays while establishing a VPN connection. | .cms
Connected | Starting frame number; plays when a connection is established. | .cms
Error | Starting frame number; plays at any connection error. | .cms
[CustomButton Actions] | Controls what programs start when the custom button is clicked. The format of the value is # = Program, where # is an ID number from 0 to n and Program is the complete name of the program, including the extension and the path to the program. Programs start in sequence: 0 first, 1 next, and so on. Custom button programs cannot be DLL files. | CMAK .cms
[Profile Format] | Service profile version. | CMAK .cms .cmp
Version | Format version of the profile or service file. | .cms .cmp


Phase three: Running the CMAK wizard and creating a service profile

Using the Connection Manager Administration Kit (CMAK) wizard, you can quickly and easily build the required service profiles to configure Connection Manager.

All custom elements must be ready before you run the CMAK wizard to build a service profile. Get organized before you start the wizard, and ensure that you have everything you need, including all external files required to implement the custom elements.

This section covers information that you need to know to run the CMAK wizard and create a service profile:

  • Preparing to run the CMAK wizard
  • Using the CMAK wizard to build a service profile
  • Finishing customization after running the CMAK wizard


Preparing to run the CMAK wizard

You run the Connection Manager Administration Kit (CMAK) wizard to create a service profile. As you step through the wizard, you are prompted to select customizable options and type the location of customized elements that you have prepared. Before you can run the wizard, you must set it up on your computer and ensure that all custom elements are available. To help prepare for creating a service profile, you can complete the planning worksheet that is available in the Microsoft Windows Server 2003 Resource Kit. For more information about Connection Manager, see "Deploying Remote Access Clients Using Connection Manager" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

Setting up the CMAK wizard

No set up of the CMAK wizard is required once it is installed, but before running the CMAK wizard, make sure that you have read the information in the readme file (CMAKRead.htm) to ensure that you understand any restrictions on how to use the CMAK wizard to set up your service profile. For more information, see The Connection Manager Administration Kit Wizard.

Editing the templates

Before you use the CMAK wizard to build a service profile, locate the advanced customization information provided by the network administrator or other technical lead. Advanced customization of the templates must be done before you run the wizard. For more information on editing the template files, see Advanced customization.

Setting up a folder for custom elements

All custom elements prepared by you and other members of your team must be accessible as you run the CMAK wizard. Create a folder in which to place all custom files to be incorporated into the service profile. Using a single location for custom elements makes it easier to build profiles when you run the CMAK wizard. You might want to set up a folder at a network location so your team can share a common location to save and access files as they develop the custom elements.

Creating multiple customized versions

To build multiple service profiles, you should create a separate worksheet for each profile to be built. To simplify building a service profile similar to one you already have, you can duplicate the existing service profile and edit it as appropriate.

To build a new service profile from an existing profile

  1. In the Service Profile Selection pane, click Existing profile, and then select the appropriate existing profile from the drop-down list.
  2. In the Service and File Names pane, specify a new service name and file name for the new profile.
  3. Proceed through the wizard, changing any specific options as appropriate, to build the new service profile.

Important

  • The existing service profile is not affected, as long as you specify a different service name and file name for the service profile you are building. If you do not specify a new file name, the CMAK wizard will prompt you that you want to overwrite the existing service profile. If you specify a new file name but do not specify a new service name, users who have the existing service profile installed and then install the new service profile will experience problems in connecting using the service profile.

Updating and editing existing service profiles

When you create a service profile, the CMAK wizard copies all incorporated files into the CMAK folder for that service profile (Program Files\CMAK\Profiles\ServiceProfileFileName). When you edit an existing profile, the wizard always pulls the incorporated files from this CMAK folder. To make changes to the incorporated files, you can either edit the incorporated file in this CMAK folder and then run the wizard again to update the service profile, or you can start the wizard, delete the referenced files, add the updated file by browsing to it, and then finish running the wizard.

Notes

  • When you edit an existing service profile created with a previous version of the Connection Manager Administration Kit, the CMAK wizard automatically updates the profile. Any changes you have made manually to the .inf file (using advanced customization techniques) will not be retained in the upgraded file. However, the CMAK wizard creates a backup of the old .inf file before creating the updated file.
  • When you use the CMAK wizard to edit a top-level service profile, the wizard attempts to use the latest version of the merged service profile. If the CMAK wizard cannot find the merged service profile in the \Program Files\CMAK\Profiles\ServiceProfileFileName folder, it defaults to the current version of the merged service profile, originally stored with the service profile that you are editing.


Using the CMAK wizard to build a service profile

You create a service profile in three overall steps:

  1. Start the Connection Manager Administration Kit (CMAK) wizard.
  2. Run the CMAK wizard and enter all the necessary information.
  3. Let the CMAK wizard build your customized service profile.

Starting the CMAK wizard

Do not start the CMAK wizard until you have collected all the information you need and have prepared all the custom bitmaps, Help files, and other items, as described in earlier sections.

To start the CMAK wizard

  • XOX

Running the CMAK wizard

Other sections in this documentation provide details on how to build a service profile, describing them in the order in which panes appear when you run the CMAK wizard. To help prepare for creating a service profile, you can complete the planning worksheet that is available in the Microsoft Windows Server 2003 Resource Kit. For more information about Connection Manager, see "Deploying Remote Access Clients Using Connection Manager" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/) If you completed the planning worksheet, based on the options you select in the wizard, some panes might be skipped. These should correspond to nonselected items on the worksheet.

When specifying the file location of any custom element (such as the phone book, bitmaps, icons, and so on), type the complete path or browse to find the appropriate file.

After you enter information and select options on each pane, click Next to advance to the next pane. If you want to change information that you entered in previous panes, you can click Back as many times as necessary to find the settings you want to change. Make your changes, and then click Next to continue moving forward through the CMAK wizard.

If at any time you want more information about the information to be included in a particular pane of the CMAK wizard, click Help in the pane to open a topic that contains Help specific to the content of that pane.

Finishing the CMAK wizard and building a service profile

When you finish entering information and are ready for the CMAK wizard to build a service profile, click Next. After the CMAK wizard builds the service profile, a dialog box appears, indicating the folder and file name that were used to save the service profile.

Caution

  • After you click Next in Ready to Build the Service Profile, the Back button will be grayed out. To change the profile, you will have to run the CMAK wizard again.
  • To perform advanced customization using the CMAK wizard, you must select the Advanced Customization check box before clicking Next. For more information, see Advanced customization.

Note

  • After you finish, you can continue with manual advanced customization, including editing the .cms files and other service-profile files. For more information, see Advanced customization. Be sure to rerun the CMAK wizard after completing advanced customization.


Finishing customization after running the CMAK wizard

You can make most advanced customization changes within the Advanced Customization pane in the CMAK wizard. After you use the CMAK wizard to build a service profile, you can make further advanced customization changes to the service profile files by editing them with any plain-text editor, such as Notepad. You must run the CMAK wizard again after making these changes.

Note

  • The changes made to the .cms file for a service profile are specific to that service profile. To make a change that you want applied to all future service profiles, edit the template file. For more information on editing template files, see Templates and service profile files.

To edit a .cms file for the service profile

  1. Locate the ServiceProfileFileName.cms file in the \Program Files\CMAK\Profiles\ServiceProfileFileName folder and make backup copies of the file.
  2. Use a text editor such as Notepad to edit the file. Be sure to save your changes before you close the file.
  3. Restart the CMAK wizard, and then click Next to proceed to the Service Profile Selection pane.
  4. Click Existing profile and then select the name of the service profile being edited.
  5. Proceed through all other panes without making any changes, and then click Finish to rebuild your service profile. During the rebuilding process, the advanced customization that you did in the .cms file is applied to the service profile.

To edit other files for the service profile

Most advanced customization is done in the .cms file, but you can also edit the .inf and .cmp files. For more information, see Advanced customization.

Important

  • If you do edit the .inf file, be extremely cautious.

If the service profile specifies it, edit these other files using the same procedures as specified above for the .cms files. These files are located in the same folder as the .cms file. To save time, edit all required files before rerunning the CMAK wizard to incorporate the changes.


Phase four: Preparing for integration, delivery, and installation

Connection Manager and your service profile can be delivered and installed on its own or integrated with another installation package, such as Internet Explorer. How you package and deliver your customized version will affect the way it is provided to your users. This section covers those options and considerations:

  • Including Connection Manager in custom applications
  • Incorporating Connection Manager with logon security
  • Signing your code


Including Connection Manager in custom applications

You can include Connection Manager and a service profile with your own custom installation package. The Connection Manager installation program, cmstp.exe, has several parameters that control how a service profile package is installed. You can also call Connection Manager programmatically from within a custom application.

Note

  • If you use the Internet Explorer Administration Kit (IEAK) to integrate a Connection Manager service profile with an Internet Explorer installation package, the Internet Explorer Customization wizard incorporates the command-line parameters needed to integrate the two installation programs.

Delivering a custom installation package

Using command-line parameters, you can integrate Connection Manager in an installation package and deliver it to users in a variety of ways. For example, you might want to:

  • Distribute and install the Connection Manager service profile over a corporate network using Microsoft Systems Management Server (SMS) to automatically handle the process without user intervention.
  • Integrate the Connection Manager service profile with another product's installation package and install them both in a single process.
  • Post the Connection Manager service profile to a Web site to enable users to access and install the service profile in a standard way (specifying certain installation options for the user).

You can set up these distribution and installation options programmatically only after you have used the Connection Manager Administration Kit (CMAK) wizard to build your service profile.

Syntax

The command-line syntax for cmstp.exe follows one of two formats. One is for use with a service profile self-extracting executable (.exe) file, and the other is for use with a service profile information (.inf) file.

If you are building a custom installation or uninstallation package with the service profile executable file, you will want to use the following syntax:

ServiceProfileFileName.exe [/q:a] /c:"cmstp.exe ServiceProfileFileName.inf [Parameters]"

If you are building a custom installation or uninstallation package without the service profile executable file, you must use the following format in your custom package, and you must know the full path to the .inf file:

cmstp.exe [Parameters] "[drive][full path]ServiceProfileFileName.inf"

Notes

  • ServiceProfileFileName is the file name of the service profile you build with the CMAK wizard.
  • The optional parameter, /q:a, suppresses the prompt that asks users whether they want to install the profile. The verification message that the installation has succeeded will still appear.
  • The command, /c:"cmstp.exe, tells the extraction program to override the installation defaults.
  • Do not use brackets [] when specifying the full path to the .inf file.
  • Parameters are the command-line parameters supported by the cmstp.exe installer.
  • You can copy your service profile executable (.exe) file during installation and store it in a known directory. This action helps ensure that you will be able to refer to the file in the future.

Parameters

The following parameters are supported for installation:

  • /ni - Do not create a desktop icon (valid only on Windows 95, Windows 98, Windows NT 4.0, and Windows Millennium Edition). On these platforms, the desktop icon is the only method provided by Connection Manager to enable users to open or delete a profile. If you use this parameter, you must provide your users with a different way to open or delete the service profile.
  • /ns - Do not create a desktop shortcut to the connection in the Network and Dial-up Connections folder (Windows 2000 only) or the Network Connections folder (XOX and the Windows Server 2003 family only). Unless the silent install parameter is also specified, this only overrides the default user preference, so the user will still see the check box in the user interface. The first time a user installs a profile, the default is not to have a desktop shortcut. The user's preference is stored in the registry and is used for each subsequent installation.
  • /s - Install silently. This option allows automatic installation of the service profile without requiring user action to complete the installation. The profile will not automatically start after it is installed.
  • /sd - Set the installed profile as the default connection for Internet Explorer.
  • /su - Install for a single user (valid only on Windows 2000, XOX, and the Windows Server 2003 family). If this parameter is used, the user does not have the option to install the software for use by all users.
  • /au - Specifies that the service profile should be installed for all users. This parameter is only valid for computers running a member of the Windows Server 2003 family, Windows 2000, or XOX.

The parameters supported for uninstalling are as follows:

  • /u - Uninstall the service profile. The only other parameter that can be used with this parameter is the /s parameter.

Notes

  • To display Help for the command-line installation parameters, type cmstp.exe /?.
  • To find the full path to the service profile information (.inf) file, you can use information extracted from registry keys, as shown in the examples below.

If you do not specify parameters for the cmstp.exe file, the following defaults are used:

  • On a computer running Windows 95, Windows 98, Windows NT 4.0, or Windows Millennium Edition, a desktop icon is created, the profile is installed for all users, and the profile automatically starts after it is installed.
  • On a computer running Windows 2000, the profile is installed for use by all users. If the Connection Manager software is included in the profile, that software is also installed.
  • On a computer running XOX or a member of the Windows Server 2003 family, the profile is installed for use by all users, but Connection Manager is not installed.
  • If a user is not logged on as an Administrator on a computer running Windows 2000, XOX, or a member of the Windows Server 2003 family, the software is installed for use by a single user.

Integrating the Connection Manager software within a custom application

You can start Connection Manager from within a custom application. A Connection Manager service profile presents a customized connection experience for your users. By integrating Connection Manager with a custom application, you can ensure that all your users connect in exactly the same way.

If you are writing an application for computers running Windows 2000, XOX, or a member of the Windows Server 2003 family and you want to open the Connection Manager logon screen, you can use the RasDialDlg function. If you want to open the Properties dialog box (for instance, if you want the users to select a phone number before dialing), you can use the RasEntryDlg function. For more information about these functions and how to use them, search for these function names on the Microsoft Web site (http://www.microsoft.com/) or consult the Microsoft Platform Software Development Kit.

The RasDialDlg and RasEntryDlg functions are not supported for Windows 95, Windows 98, or Windows Millennium Edition. Although these functions are supported on Windows NT 4.0, using them in conjunction with a Connection Manager service profile is not supported. If you are writing an application for computers running one of these operating systems, you can instead use a function such as ShellExecute or CreateProcess to start cmmgr32.exe. To open the Connection Manager logon screen, use cmmgr32.exe, followed by the full path to the .cmp file of the service profile you want to open. For example, to open the Awesome Computers service profile on a computer running Windows 98, use:

cmmgr32.exe "c:\Windows\All Users\Application Data\Microsoft\Network\Connections\Cm\Awesome1.cmp"

If you want to open the Properties dialog box, use cmmgr32.exe followed by /settings followed by the full path to the .cmp file. For example, to open the Properties dialog box for the Awesome Computers service profile on a computer running Windows 98, use:

cmmgr32.exe /settings "c:\Windows\All Users\Application Data\Microsoft\Network\Connections\Cm\Awesome1.cmp"

Notes

  • Cmmgr32 runs as an asynchronous action. No response is returned to your program unless you add a custom action to the service profile to provide one. You can also wait for cmmgr32 to finish.
  • If the path to the service profile includes spaces, use double quotes (") around the path.

Examples

The following examples describe a possible installation and a possible uninstallation for the Awesome Computers service profile.

Installation example for Awesome Computers

Awesome Computers wants to build a custom installation package and include a service profile, Awesome1.exe, in the package. The company wants a silent install. The company does not want to create a desktop icon or a desktop shortcut to the profile. The company would like the Awesome1 service profile to become the default connection for Internet Explorer.

In its custom installation package, Awesome Computers includes this command:

Awesome1.exe /q:a c:"cmstp.exe Awesome1.inf /s /ni /ns /sd"

Uninstallation example for Awesome Computers

Awesome Computers wants to build a custom uninstallation package. The company does not know whether its users still have the Awesome1.exe file on their computers, so the company must get the .cmp path from the registry and extrapolate the .inf path from that information. The company wants a silent uninstall.

  1. The custom uninstallation application queries one of two registry keys.

    2. All users profile:

    HKLM\Software\Microsoft\Connection Manager\Mappings

    Single user profile:

    HKCU\Software\Microsoft\Connection Manager\Mappings

    The call provides a name value of Awesome Computers (the full service profile name) and returns a data value of the full path to the Awesome1.cmp file.

  2. The custom uninstall application changes the Awesome1.cmp path into the Awesome1.inf path by replacing Awesome1.cmp with Awesome1\Awesome1.inf. For example, a .cmp path of C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\Awesome1.cmp must be converted to C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\Awesome\Awesome1.inf.
  3. The custom uninstallation application includes this command:

    4. cmstp.exe /u /s "c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\Awesome\Awesome1.inf"

Notes

  • The credentials of the user installing or uninstalling the package will affect how cmstp.exe operates. If the user does not have administrative credentials, he or she will not be able to install or uninstall a profile for all users. The profile will be installed for his or her own use.
  • If you use the following key, the initial portion of the data value might contain a system macro. HKCU\Software\Microsoft\Connection Manager\Mappings

For more information, see Verifying customization and Troubleshooting process.


Incorporating Connection Manager with logon security

On computers running Windows 2000, XOX, or a member of the Windows Server 2003 family, a user can choose to log on to Windows using a Connection Manager profile.

Logging on using a Connection Manager profile

A user can log on using a dial-up connection (including a Connection Manager connection) only if the computer is a member of a domain. If the computer is not a member of a domain, the Log on using dial-up connection check box does not appear.

In the Log On to Windows dialog box, the user can select the Log on using dial-up connection check box. After clicking OK, the user is prompted to choose a network connection.

After the user chooses a connection, the Connection Manager logon screen appears. Connection Manager starts the connection process when the user clicks Connect.

Administrative issues when using Connection Manager profiles to log on

If you intend to build and distribute a service profile that will be regularly used to log on, you might want to consider the following:

  • By default, Connection Manager uses the credentials the user types at the Windows logon screen. If you want Connection Manager to ignore those credentials, add the key UseWinLogonCredentials=0 to the [Connection Manager] section of the .cms file for your service profile.
  • Users who select the Log on using dial-up connection check box gain access to Windows through an account designed for this method of logging on. The Log on to Windows account has only minimal permissions, and any customized settings for Connection Manager are applied to the Log on to Windows account, rather than to the account of the user who logged on. The user can customize the Log on to Windows account in the same ways as any other account (for example, save settings for phone numbers). However, permissions granted to specific users, such as access to Help, are not granted to users logging on to Windows, even after the connection completes.

For security reasons, the following functionality is not available when a user logs on to Windows using a dial-up connection:

  • If the .cms file for the profile contains the ResetPassword key, any value for that key is ignored.
  • Custom buttons do not appear or function.
  • The View Log button is disabled.
  • The Advanced tab does not appear in the properties dialog box for the service profile.
  • Keys in the .cmp file that provide user credentials for first-time use (such as UserName) are not available. Internet connection credential keys such as InternetUserName are available.
  • Macromedia animation does not display. If you are building a profile that uses Macromedia animation, you should include a default bitmap to display in this circumstance.
  • Custom actions do not run unless those actions have been enabled by editing the registry. Even after custom actions have been enabled, the custom action will not automatically work with registered shell extensions. You must indicate the program to use with the file, as well as the path to the file.
  • Connection Manager Help (including context-sensitive help) is disabled during the connection process.
  • If a system component is missing when the user attempts to log on using a dial-up connection, the connection attempt fails. The user will not be able to install the system component until he or she logs on.

Enabling custom actions that run when a user logs on by using a dial-up connection

For a custom action to run during the logon process, you must enable that action by specifying a value for the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Connection Manager\ProfileName\WinLogon Actions

The format for the value of the registry key is:

Field | Description
Name | The name of the executable file that will run.
Type | REG_DWORD
Data | A value indicating the location of the executable.

Supported values for the Data field are:

Value | Location of executable
0x00000000(0) | %windir%\system32
0x00000001(1) | Profile directory

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

The following example enables automatic phone book downloads at connection time. If you set the value of:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Connection Manager\Profile Name\WinLogon Actions

as:

cmdl32.exe REG_DWORD 0x00000000(0)

then you must also include:

[Xnstall.AddReg.AllUsers] "HKLM", "%AppAct%\%ServiceName%\WinLogon Actions","cmdl32.exe",0x00010001,0

in the .inf file of the profile.

Important

  • Modifying .inf files can cause significant installation problems. Thoroughly test all service profiles containing custom .inf entries for version, file, or other conflicts. Be sure that the file location is specified correctly.


Signing your code

After you have completed all customization, it is recommended that you sign your code before distributing it. Signing your code with a digital signature assures your users that the programs are from a known source and have not been altered.

You should digitally sign your customized service profile and any custom programs to ensure that users do not receive warnings when they install Connection Manager. Users may be prevented from installing ActiveX controls and other packages that are not signed.

Further information on code signing can be found in the Internet Explorer Administration Kit (IEAK). If you include a Connection Manager service profile in an Internet Explorer installation package created using Internet Explorer Connection wizard in the IEAK and you specify the digital signature option in the wizard, the digital signature support provided for the installation package will include the Connection Manager service profile.

For information on code signing, go to the Microsoft Developer Network (MSDN) on the Microsoft Web site (http://www.microsoft.com), click Search on the MSDN screen, and type digital signature or code signing as search words for a Boolean search on the entire Microsoft site.


Phase five: Testing your deliverables

Before you distribute the service profile that you created with the CMAK wizard, you must test it. This section describes how to install and test service profiles. It also describes things you should consider if you want to provide users with your own installation program to install service profiles.

This section covers:

  • Test process
  • Verifying customization


Test process

Test your service profiles to ensure that all planned functionality is implemented and working as planned.

Install and use each of your service profiles on each target operating system. If you distribute the service profile on disk and by e-mail, test each method. If you are providing multiple language versions, test each one on the operating system with the appropriate national language.

Note

  • If you have users with previous versions of your service profile, test Connection Manager on computers on which your previous service profiles are installed, as well as on computers that have not had previous versions installed.

Following are basic testing steps:

To test your service profile

For each service profile and scenario, use Connection Manager to do all of the following:

  1. Install the service profile, as described in a readme or other documentation that you provide to the user.
  2. Provide the required user data (user name, user password, and so on) needed to connect.
  3. Select a Point of Presence (POP) from the phone book and establish a connection.
  4. View network resources while connected to your service (check connection while viewing URL).
  5. Disconnect from your service.
  6. Uninstall the service profile.

Test criteria

As you install and use Connection Manager, ensure that each service profile has the appearance, features, functionality, and usability that you want:

  • Do the screens contain the appropriate titles, text, and graphics, and does each screen appear completely and correctly?
  • Are all of the required programs included in the service profile? If not, are all required programs available on all target operating systems?
  • Do all menu items for the notification area shortcut function appropriately?
  • Do you have appropriate Help topics, including troubleshooting Help, for all functions and features? Do these Help files match the service profile? If you customized any Help topics, do they appear as expected?
  • Is everything formatted and spelled correctly, including the license agreement, the screen text, the text in the Connection Manager dialog box, and other user information?
  • Is all the information needed to install and use Connection Manager and the service profile available when and where it is needed?
  • If you provided custom dial-up entries (especially scripts), do they work as intended?
  • If you support such connections, can you establish both direct and VPN connections?
  • If you included any pre-connect, pre-tunnel, post-connect, pre-dial, on-error, on-cancel, or disconnect custom actions or monitored applications, do they work as expected?
  • If you edited your .cms and other service-profile files, do your custom entries perform as expected?
  • If you use code signing, does it display the authentication notice as expected?
  • Can you connect using POPs in the phone book for each of the service types you support?
  • If you use a firewall, are the firewall proxy settings correct?
  • Do the components of Connection Point Services provide the required functionality, as described in the Connection Point Services documentation?


Verifying customization

There are several instances in which customization requirements are very stringent. This section repeats the information that is most commonly overlooked.

Verify that the service name and file name are valid

If you are updating an existing service profile, the service and file names should be identical to the previous ones. If you are creating a new profile (from scratch or by editing an existing service profile and renaming it), make sure that the service name and file name are not identical to any other service profiles that you provide to your customers. If you do not specify a file name that is different from the one users already have installed on their computers, the original service profile will be overwritten. If you specify a new file name but do not specify a new service name, users who have the existing service profile installed and then install the new service profile with the different service name will experience problems in connecting. The problems can include not being able to connect using either or both service profiles.

If you need to make changes to an existing profile, use the Connection Manager Administration Kit (CMAK) wizard to edit the profile instead of creating a new file with the same name.

Verify that the dial-up entry is correct in CMAK and the phone book

The phone book dial-up entry that you set up in the phone book must exactly match the entry you set up in your service profile. Use a text editor such as Notepad to open the Phone Book Administrator file and verify that the entries you specified in the phone book (at the end of each line) match the entries you set up in the CMAK wizard in Dial-up Networking Entry.

Verify that all required protocols are specified correctly

Verify that the required network protocols, including TCP/IP, IPX, and NetBEUI (as appropriate), are specified in the [Server&EntryName] section of the .cms file for the specified dial-up entry. XOX

Verify that proxy settings are set as required to support successful connection to your service

If your service requires special proxy settings, verify that any required custom actions have been designed and implemented to adjust the settings on the user's computer as required.

Verify that resident programs on users' computers can be opened

If your custom actions or other custom settings depend on the program being available on your users' computers (that is, you are not providing it in your service profile), verify that the program is in the default path and available to Connection Manager. Not all programs that appear on the Start menu are necessarily set up to use the default path. Connection Manager may not be able to find the installed program if it is not in the default path.

Verify that your service-profile updates are complete

When you edit a service profile created using a previous version of Connection Manager, the CMAK wizard automatically upgrades the profiles to Connection Manager 1.3. Any changes you have made manually to the .inf file (using advanced customization techniques) will not be retained in the upgraded file. However, the CMAK wizard creates a backup copy of the old .inf file before creating the updated file.

Verify that your time-outs are not preventing access to your domain

For VPN connections, users sometimes get a message that the domain controller couldn't be found, even though the routing information is correct. In this case, setting the LanaTimeout entry in the .cms file may correct the problem. This increases the time (in seconds) to wait before attempting to connect to a VPN server. Increase this value if the connection consistently fails to find a domain controller.


Phase six: Supporting your customers

Effective customer support depends on your ability to resolve customer questions, problems and needs quickly and effectively. This section contains information intended to help you and your users address the more common situations:

  • Troubleshooting process
  • Frequently Asked Questions


Troubleshooting process

The first level of troubleshooting is provided in the Help files that are included with your service profile. This troubleshooting Help information makes it possible for many problems to be resolved directly for the user. Each problem that cannot be resolved leads to a Help topic that instructs the user to call customer support. You should customize this Help topic with a phone number for your customer support group, additional information specific to your service, and other information that may help your users.

To resolve problems most effectively:

  1. Make sure that all system requirements have been met.
  2. Make sure that the right access numbers are used and that they are entered appropriately. Verify that the users understand that dialing rules are applied only to numbers selected from a phone book. If a number is typed or edited by the user, the user must then type all dialing information, including information such as long-distance and external access numbers. If the user chooses to use dialing rules, the user must configure those dialing rules appropriately for the location.
  3. Make sure that users know how to access the Connection Manager troubleshooter Help, and verify the path that they have taken through the troubleshooter Help.
  4. Check the appropriate readme files (including CMAKRead.htm) to determine if the problem is a known issue.
  5. Look for common mistakes. Make sure that:
    • The modem is on.
    • The appropriate version of Connection Manager is installed. To determine this, instruct your users to check the About tab of the Properties dialog box (Windows NT 4.0, Windows 95, Windows 98, and Windows Millennium Edition only) or the log file.
    • The latest version of the appropriate connection software is installed.
    • The latest service pack is installed.
    • The Internet Explorer proxy settings are correct.
    • All required network protocols are installed and configured correctly on the user's computer. (If the user can get to the network but cannot reach any services, a protocol on the user's computer may be misconfigured.)
    • If your service profile supports VPN connections, Point-to-Point Tunneling Protocol (PPTP) is installed and configured correctly and completely. (This is usually a problem only on Windows NT 4.0, where Connection Manager does not automatically install PPTP.)
    • The dial-up entry used is appropriate for the user’s operating system.
    • If a user has installed remote access or PPTP on a computer running Windows NT 4.0, the user reinstalled any service pack previously installed on their computer.
    • If a user is using Internet Connection Sharing or Internet Connection Firewall, the connection is shared correctly and the firewall is not blocking the connection. For more information, see Connecting to the Internet in a home or small office network and Internet Connection Firewall.
  6. Users have received all workarounds and solutions, as appropriate. For information on networking problems, including those involving remote access, search the Microsoft Developer Network (MSDN) on the Microsoft Web site (http://www.microsoft.com).
  7. Ask users to generate and send a log file for the connection. The log file contains valuable troubleshooting information. Logging is typically enabled by default. Users can enable or disable logging after the profile is installed.
    • If logging was enabled, instruct the user to send the log file. Make sure that the user did not turn off logging. Depending on the size of the log file, decide whether you want the user to clear the log file and try the connection again before sending the log file. To direct the user to the log file, instruct the user to click Properties on the Connection Manager logon screen. Instruct the user to click the Options tab and then to click the View Log button. After the user has opened the log file, instruct the user to save the file and send it to you.
    • If logging was not enabled, instruct the user to turn on logging, try the connection, and then send the log file. To enable logging, instruct the user to click Properties on the Connection Manager logon screen. Instruct the user to click the Options tab and to select the Enable Logging check box.
    • If the user is attempting to log on to Windows using a Connection Manager profile, the View Log button will be unavailable. To find the log file, instruct the user to log on to the computer without using a Connection Manager profile. After the user has logged on, instruct the user to click Start, point to Search, and click For Files or Folders. After the Search Results dialog box appears, instruct the user to click Search Options, select the Advanced Options check box and to select the Search system folders check box. Instruct the user to search for the log file by typing in the first three letters of the service profile name, followed by an asterisk (*) and the log file extension (.log). For example, if the service profile is named Awesome, the user should search for Awe*.log. The file is stored in %windir%\temp by default.

    8. Note

    • On computers running Windows NT 4.0, Windows 2000, XOX, or a member of the Windows Server 2003 family, the log file will be in Unicode format. To view the log file on an operating system other than these, open the log file with a Unicode text viewer, such as Microsoft Word.

For more information about Connection Manager, see "Connection Manager" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)


Frequently Asked Questions

The following are some of the most frequently asked questions regarding Connection Manager and the Connection Manager Administration Kit (CMAK). These questions are based on actual calls to Microsoft product support services and might save you time and effort.

Unexpected profile actions

My users can connect to the server when using the service profile, but authentication fails.

Cause: The server running Routing and Remote Access cannot connect to the authentication server.

Solution: Verify connectivity between the server running Routing and Remote Access and the authentication server.

Cause: The authentication server has been improperly specified or configured for dial-up access.

Solution: Verify that the authentication server specified in the service profile is correct. Check the user account and make sure that dial-up access has been enabled. Look up any Group Policy rules that might restrict access by time or date.

Cause: Settings for one or more dial-up entries have been improperly specified.

Solution: Check the security settings for each dial-up entry, including component service profiles. The simplest way to do this is to run the CMAK wizard and choose to edit the service profile. When you reach Dial-up Networking Entries, click each entry, and choose Edit. On the Security tab, make sure that all of the security settings are properly specified. One common error is to select Use advanced security settings for a service profile issued to users using Windows 98.

Solution: Make sure that the phone book files (.pbk) have the correct settings for each dial-up entry. For each phone book you include in the service profile, open the .pbk file, and check the Dial-up Networking entry field, which is the eleventh field, in each POP. Make sure that this field is specified appropriately for each POP in each phone book.

See also: Advanced customization; Add, edit, or delete POPs by command line

Cause: Prefix and suffix information might have been specified differently in one or more of the component profiles merged into the issued service profile.

Solution: Check the UserNamePrefix and UserNameSuffix keys in every .cms file in the service profile. A value for this key specified in the component profile will override the top-level service profile settings.

See also: Merging phone books and other features from existing service profiles; Providing a realm name; Advanced customization

My VPN service profile takes too long to connect.

Cause: Certificates are invalid or missing.

Solution: Delays in excess of one minute often indicate a failure in the L2TP/IPSec protocol negotiation. Make sure all service profile users have the newest certificates installed on their computers.

See also: Certificate Services

Cause: A round robin server solution is causing delays in authentication.

Solution: If you are using a round robin server solution for L2TP/IPSec VPN servers, a failure to authenticate on one or more servers can result in variable delays. Depending on the profile settings, Connection Manager might redial each VPN server multiple times. Make sure that each VPN server is configured to accept the profile and that each server is responding.

See also: Configuring round robin

The connection failed to complete after the user was authenticated.

Cause: The service profile contains improper post-connect actions.

Solution: Check the [Connect Actions] section in the service profile's .cms files for proper behavior on target platforms.

See also: Incorporating custom actions

Cause: The routing table update file is attempting to delete a route that does not exist.

Solution: Check the routing table update file for outdated or inaccurate route changes.

See also: Including routing table updates

My ISDN users connect at 64 kilobits per second.

Cause: The ISDNDialMode key value is not set to bind dual channels.

Solution: Use advanced customization techniques to change the value of the ISDNDialMode key to the appropriate value and reissue the profile.

See also: Advanced customization; Connection Manager keys

My merged service profile does not work the way I expect.

Cause: The settings in component service profiles conflict.

Solution: Check phone book filtering. Your region settings might not be the same in all phone book region (.pbr) files. If you are using custom service types in any or all phone books, you need to apply these to each .cms file.

Solution: Check the realm name information in each .cms file included in the merged service profile. Any realm information in a component profile will be overridden by realm information specified in the .cms file of the top-level profile. You should leave the realm name field in the top-level service profile blank if you need to merge profiles with different realm information.

Solution: Check the tunnel addressing information. Tunnel addressing information specified for the top-level service profile is used for all phone books merged into it.

Solution: Check the settings for the DUN and TUNNELDUN keys in all the .cms files included in the merged service profile. The default dial-up settings originate in the .cms file associated with the user-selected phone book, while VPN settings originate from the top-level .cms file.

See also: Advanced customization; Providing a realm name; Implementing VPN support; Merging phone books and other features from existing service profiles

The Connection Manager interface appears unexpectedly.

Cause: Internet Explorer is improperly configured for your service.

Solution: Assist your users in changing their Internet Explorer options. In Internet Explorer, click the Tools menu. Click Internet Options, click the Connections tab, and choose the appropriate dial-up option. The default option is to always dial the default connection. However, your profile might work best if a connection is never dialed or if a connection is dialed only when an Internet-based program is started and a network connection is not present.

See also: Setting up an Internet connection

Cause: Custom actions requiring Internet access continue to run after the connection has been terminated.

Solution: Test the service profile to make sure that all custom actions terminate properly. If necessary, reissue the service profile after you add a disconnect action that ensures that programs terminate properly.

See also: Incorporating custom actions

Nothing happens when my Windows 2000 users double-click the connection icon in the Network and Dial-up Connections folder.

Cause: The installation of the Connection Manager 1.3 software did not complete correctly. Mismatched Connection Manager software binaries are causing the connection software to fail.

Solution: Instruct the user to uninstall the Connection Manager 1.3 software and then to reinstall the profile. To uninstall Connection Manager 1.3, click Start, point to Settings, click Control Panel, double-click Add or Remove Programs, click Microsoft Connection Manager 1.3, and click Remove. This process restores the Windows 2000 Connection Manager binaries on the user’s computer. The user should then reinstall the Connection Manager service profile that included the Connection Manager 1.3 software.

See also: Troubleshooting process; Adding Connection Manager 1.3 to the service profile

My service profile does not work properly when users log on to Windows with it.

Cause: Custom actions have not been enabled to run when users log on to Windows with your service profile.

Solution: Check whether you need to change user registry settings in order to run custom actions when users log on to Windows with your profile. Consider issuing a profile without custom actions for use in logging on to Windows.

See also: Incorporating Connection Manager with logon security

Cause: Connection Manager treats "Log on using dial-up connection" as a separate user with limited permissions. Settings applied to "Log on using dial-up connection," such as proxy configuration, are not applied to individual user accounts after logging on.

Solution: Consider advising your users to log on to their local computers before using a Connection Manager profile to log on to your domain.

See also: Incorporating Connection Manager with logon security

Profile administration

The phone book for the service profile is not being updated.

Cause: Improperly set Internet proxy settings is preventing phone book downloads.

Solution: Check the proxy settings for the service profile. If you are using automatic proxy configuration in your service profile, check those settings and the proxy server.

See also: Common problems and their solutions; Using automatic proxy configuration

Cause: One or more Phone Book Service (PBS) servers is out of service.

Solution: Check the log files on your PBS servers for error messages.

See also: Phone Book Service error messages; Troubleshooting

Cause: A URL in the service profile points to a server that cannot be found.

Solution: Check the URLs specified in the service profile. You can do this by editing the profile in the CMAK wizard or by checking the settings directly in the [ISP] section of the .cms file. If the profile in question was created by merging other service profiles, check the URLs in all the .cms files used by the profile.

See also: Advanced customization; Providing phone book support; Merging phone books and other features from existing service profiles

I cannot populate a previously installed service profile with user credentials and phone numbers.

Cause: Updated profiles cannot overwrite user settings.

Solution: Populate the credentials in the .cmp file of the service profile when you create it. Run the CMAK wizard again. Issue the new service profile to your users. Include a custom uninstallation and reinstallation package or instructions on how to uninstall the old service profile and install the new version.

I want to dynamically change the VPN address for a service profile.

Solution: Write a custom pre-tunnel action that adjusts the VPN address in the .cms file as needed. This feature might not be available in future releases. Consider the security implications of dynamically changing a VPN address before you implement this solution.

See also: Incorporating custom actions

Profile creation and development

I do not understand the difference between networking settings and dial-up entry names.

Solution: Dial-up entry names identify combinations of networking settings. You can specify different networking settings for each dial-up entry. You usually name dial-up entries on the Settings tab of the Add POP pane of Phone Book Administrator. Those names appear in the Dial-up Networking Entries pane of the CMAK wizard. Connection Manager uses a dial-up entry to determine which combination of networking settings are required for a service profile.

See also: Incorporating custom dial-up entries

I want to create a profile in which some numbers dial directly to my corporate network and other numbers connect through a virtual private network (VPN) tunnel.

Solution: Create two phone books, one for a direct dial connection and the other for a VPN tunnel to your network. Create a profile with your direct dial phone book. Create a top-level profile that merges the direct dial profile and incorporates the VPN phone book. On the VPN Support pane, select the Phone book from this profile check box.

See also: Merging phone books and other features from existing service profiles; Implementing VPN support

I want to create a VPN-only profile.

Solution: To create a VPN-only profile, start the CMAK wizard. Select the Phone book from this profile check box on the VPN Support pane, and specify a VPN server or a VPN file. Configure the VPN entry or entries with the correct security and addressing information for your network. Do not specify a phone book file on the Phone Book pane, and clear the Automatically download phone book updates check box. You do not need to configure the default dial-up entry for the profile. On the last pane of the wizard, select the Advanced Customization check box. On the Advanced Customization pane, click the profile .cms file, click the [Connection Manager] section, and set the value of the Dialup key to zero. Click Apply, and finish the wizard. This will create a VPN-only profile, without a General tab in the Properties dialog box for the profile. Users of your profile will not see any phone or dialing information.

See also: Implementing VPN support; Incorporating VPN entries

I want to provide user credentials and phone numbers for my service profile for first-time users.

Solution: Use advanced customization techniques to assign values to the keys for which you want to provide first-time use data, such as Username. These keys must be assigned in the .cmp file, and they will only be available the first time the profile is used. For passwords, you must edit three keys: PCS, RememberPassword, and Password. The PCS key should always be set to 0; the values of the other keys will vary according to your profile needs. If you want this password to be available to all users who connect from the same computer, you must edit an additional key, KeepDefaultCredentials. If this key is not set to the appropriate value, only the person who installs this profile will have access to the credentials you provide for first-time use. Consider the security implications of providing a password for the first user who installs and uses the profile.

See also: Advanced customization

I want to create Connection Manager profiles in more than one language.

Solution: You can use the Multi-User Language Interface (MUI) with the CMAK wizard to build a Connection Manager profile in a language other than the one installed with your operating system. You can include the Connection Manager software with that profile, but Connection Manager will appear in the language installed with your operating system, not in the MUI language. You can choose not to include the Connection Manager software with the profile, but your users might not have access to all the current features of Connection Manager.

To include a version of Connection Manager in the same language as the profile, you must build the profile using the CMAK wizard on an operating system that was installed with the appropriate language. The CMAK wizard comes with the Windows Server 2003 family. You can also install the CMAK wizard from XOX with the Windows Server 2003 Administration Tools Pack.

See also: Creating profiles in multiple languages