Windows Pre-Login Connect (PLC)
Pre-Login Connect (PLC) is a feature in OpenVPN Connect for Windows that establishes a VPN connection at the Windows sign-in screen, before a user signs in to the operating system. It uses the Windows Pre-Login Access Provider (PLAP), which is built into Windows 10 and Windows 11.
This feature is intended for system administrators managing business VPN environments. Common use cases include:
Environments that require access to Active Directory or network resources before a user account can complete login.
Windows clients joined to a domain that need to have VPN connectivity established before credentials are validated against a domain controller.
Environments that run logon scripts requiring network access.
We also have a tutorial you can follow for setting up Pre-Login Connect:
Before you begin
Ensure the following requirements are met before proceeding:
OpenVPN Connect version 3.9 or higher is installed.
Windows 10 or 11.
An administrator shell (Command Prompt or PowerShell, run as administrator).
System profiles prepared as
.ovpnfiles and stored in an accessible directory.
Install and configure Pre-Login Connect
Location
Run all commands from the OpenVPN Connect installation directory:
C:\Program Files\OpenVPN ConnectSteps
Open the Command Prompt as an administrator.
Navigate to the OpenVPN Connect installation directory:
cd "%ProgramFiles%\OpenVPN Connect"Install the PLC system service:
ovpn_system_service.exe installConfigure the directory containing system profiles:
ovpn_system_service.exe set-config system-profiles <path-to-profiles>(Optional) Configure a custom log file location:
ovpn_system_service.exe set-config log <path-to-log>Start the PLC service:
ovpn_system_service.exe start
Connect before Windows sign-in
After the service is installed and running:
Sign out of Windows or restart your device.
On the Windows sign-in screen, click the Network Sign-in icon in the bottom-left corner.
Select a VPN profile from the list.
Authenticate as required.
Once connected, proceed with Windows sign-in.
Usage details
Profiles configured via ovpn_system_service.exe are treated as system profiles and are available at the Windows sign-in screen. Profiles imported through the OpenVPN Connect UI are user profiles and aren't available at the sign-on screen.
When you start a VPN connection using a system profile:
The connection can persist after signing out of Windows.
The connection may remain active even when the OpenVPN Connect app isn't running.
To disconnect:
Use the Disconnect button on the Windows sign-in screen, or
Disconnect from within the OpenVPN Connect app after signing in to Windows.
Configuration options
Use the following command to configure additional settings:
ovpn_system_service.exe set-config <option> <value>To reset an option to its default:
ovpn_system_service.exe unset-config <option>Option | Values | Description | Default |
|---|---|---|---|
system-profiles |
| Directory containing system profiles. |
|
log |
| Log file location. |
|
vpn-protocol |
| VPN protocol section. |
|
dco |
| Enable data channel offload |
|
security-level |
| Set security level. |
|
seamless-tunnel |
| Enable seamless tunnel |
|
enforece-tls-1-3 |
| Enforce TLS 1.3. |
|
allow-local-dns |
| Allow local DNS resolvers. |
|
google-dns-fallback |
| Enable Google DNS fallback |
|
Example: Enable DCO
ovpn_system_service.exe set-config dco trueLogs and service management
Logs
Standard logs are written to the configured log file.
Critical logs are written to:
Event Viewer → Windows Logs → ApplicationEvent source:
OVPNSystemService
Service management
You can manage the PLC service using Windows services (services.msc) or the command line:
ovpn_system_service.exe start
ovpn_system_service.exe stopStop or remove the PLC service
Stop the service
ovpn_system_service.exe stopStops the service.
Terminates the active VPN connection.
The service will start again after a reboot.
Remove the service
ovpn_system_service.exe removeStops the service.
Terminates the active VPN connection.
Removes the service from the system.