Wireguard for Windows - local administrator necessary?

[zrm]

On 11/27/19 06:27, Simon Rozman wrote:
> Hi Chris!
> 
> This is WireGuard design. Reconfiguring network - which (dis)connecting 
> VPN is – is administrative task.
> 
> If your organization issues laptops to their employees, the corporate 
> VPN should be up at all times. You don't want them to disconnect from 
> VPN and use those laptops on compromised networks, do you?
> 
> I did have an issue when roaming laptops to and from corporate WiFi, as 
> the endpoint IP changes – restarting the tunnel helped, but adding a 
> scheduled task to reset endpoint IP every 2 minutes using wg.exe command 
> line works like a charm here. If that's the reason you would want your 
> users to manipulate WireGuard tunnels?
> 
> Best regards,
> 
> Simon

It makes sense that users shouldn't be able to manipulate WireGuard 
tunnels by default, but shouldn't it be possible to change the default 
through something less drastic than giving the user full administrator 
access?

For example, the registry in modern Windows is permissioned with ACLs. 
It could be made the case that modifying a WireGuard tunnel on Windows 
is done by writing to a particular registry location and then poking the 
service to prompt it to look there for new configuration. Then the 
administrator could explicitly give a user or group permission to modify 
that registry location if they should be able to modify WireGuard 
configuration. Or the same thing could also be done with a filesystem 
location.