# VPNs: in practice, how much info can the admins truly have access to? **URL:** \ **Category:** Factual Questions\ **Created:** [August 21, 2012, 6:42pm UTC](https://boards.straightdope.com/t/vpns-in-practice-how-much-info-can-the-admins-truly-have-access-to/632192 "2012-08-21T18:42:49Z")\ **Posts on this page:** 4\ **Page:** 2
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [August 23, 2012, 5:28am UTC](https://boards.straightdope.com/t/vpns-in-practice-how-much-info-can-the-admins-truly-have-access-to/632192/21 "2012-08-23T05:28:42Z")
> [@Reply](#): > > And I just meant “keylogger” as a generic term for client-side monitoring suite, real-time or not. I was more worried that they would be able to change CA lists and other software without access to the client computer, and apparently group policy enables at least the former. Scary. You can absolutely distribute certs via a GPO, change CA lists, change trusted sites/domains, and a whole bunch of other stuff. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [August 23, 2012, 5:34am UTC](https://boards.straightdope.com/t/vpns-in-practice-how-much-info-can-the-admins-truly-have-access-to/632192/22 "2012-08-23T05:34:40Z")
> [@Bricker](#): > > Your VPN admin alone can’t do this – he would need some access to your machine, yes? Specifically he’d need to be able to pretend to be a CA, and he can’t do that without adding his Fake CA cert to your certificate store. > > Or am I missing a trick? Getting access to your machine might not be too difficult. “Just run vpn-wow.exe to setup your new VPN WOW! account, you’ll have to click on ‘OK’ to allow administrator privileges for the installer.” ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [August 23, 2012, 6:44am UTC](https://boards.straightdope.com/t/vpns-in-practice-how-much-info-can-the-admins-truly-have-access-to/632192/23 "2012-08-23T06:44:11Z")
Is it normal for a computer joining a VPN over the Internet to also be required to join the company domain? If not, would the GPO method still work? ---
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [August 23, 2012, 8:13am UTC](https://boards.straightdope.com/t/vpns-in-practice-how-much-info-can-the-admins-truly-have-access-to/632192/24 "2012-08-23T08:13:46Z")
> [@CurtC](#): > > Are you sure you’re answering the question she was asking? I got the impression that she’s connecting through her home ISP, for example, to her company VPN, and she is concerned whether her ISP’s admin people can see her traffic that she sends to/from the company network. I think the question was “_If I am using a VPN to access my company network and doing other things as well, how much can the company Network Admin see?_” The answer lies somewhere between **very little** and **absolutely everything** : If the tunnel is split, then only company traffic is visible to the company admin - your access to “The Straight Dope” goes directly via the Internet, not the VPN. If the tunnel is not split, then all traffic goes via the VPN, and the company proxy. They can see all **http** traffic. They may be able to see **https** , if they have the appropriate certificates. If the access device is a company device and is in the company domain, then the certs can be installed via GPO. If it is not a company device, then they may mandate a certificate, or they may not. If they have not, then **https** traffic probably cannot be monitored. > [@Reply](#): > > Is it normal for a computer joining a VPN over the Internet to also be required to join the company domain? If it is a company device or accessing company network resources, then yes (otherwise, how do you authenticate access to those resources). > [@Reply](#): > > If not, would the GPO method still work? No. We should clarify that by **VPN** I mean a _network-layer_ tunnel that uses a virtual network adapter on the client, through which some (or all) network traffic is routed. These are generally used from a secured company device using VPN client software, and such devices will conform to company policy, enforcement, use standards and monitoring. As a network admin, I don’t allow random computers into my physical network - I’ll make even less of an exception for random computers from the across the internet. Many networks now use policy enforcement as well, to ensure VPN-attached computers have the correct AV signatures and patch levels before full network access is granted. Some people use VPN to refer to secure extranet interfaces (usually SSL/HTTPS, or secure _internal_ Remote Desktop sessions via Citrix/Terminal Server) to internal company resources. _I_ don’t consider these true VPNs. However, these are more likely to be used from a non-company device, using a standard web browser. These sorts of VPN can be used without policy enforcement. Another question to ask is whether you actually check certificates before installing them, or just blithely assume that the server you are connecting to has updated their certs - certainly I would get suspicious if just as I attached to a Wifi cafe network I got prompted to install new certs, especially for my own server, when I know if I have installed new certs. Si [Previous page](https://boards.straightdope.com/t/vpns-in-practice-how-much-info-can-the-admins-truly-have-access-to/632192.md?page=1)