SystemSerenity

Writing / Post

Rolling out WireGuard to 20+ Windows users without giving anyone admin rights

WireGuardWindowsLeast privilegePowerShell

WireGuard for Windows normally needs Administrator rights to manage tunnels. Its limited operator UI lets standard users connect and disconnect without ever seeing a key.

When the agency moved to a pfSense firewall with a WireGuard VPN, the plan hit a familiar wall. WireGuard for Windows expects an administrator to manage tunnels, and the team's laptops run as standard users. The usual outcomes are both bad: hand out local admin rights, or have IT take a ticket every time someone needs to connect.

The built-in answer

WireGuard for Windows has a documented, easy-to-miss option called the limited operator UI. With it turned on, members of the built-in Windows Network Configuration Operators group can start and stop tunnels from the WireGuard window. Their view has keys stripped, and they can't add, edit, import, export or delete configurations.

The rollout, per device

  • Install WireGuard (for example with winget).
  • Copy the device's own configuration into a folder only Administrators and SYSTEM can read.
  • Install the tunnel as a Windows service with wireguard.exe /installtunnelservice.
  • Set HKLM\Software\WireGuard\LimitedOperatorUI to 1.
  • Add the user to Network Configuration Operators, then have them sign out and back in once.
  • Delete the original configuration file, since it contains the private key.

Security rules worth keeping

  • Use one key pair per device. Don't reuse a configuration across people or machines, and don't send configurations or keys by email or chat.
  • Prefer split tunneling, so only office networks go through the tunnel, unless you mean to route all traffic.
  • Revoke on the server. Removing the peer on the firewall belongs in the offboarding checklist, because deleting the app from a laptop doesn't revoke anything.

Troubleshooting in the right order

  1. Is the tunnel service running?
  2. Did a handshake happen recently? If not, look at the endpoint, the keys, or whether the server lists this peer.
  3. Is the target reachable? A handshake with no traffic points at allowed IPs, routing, NAT or firewall rules on the server side.

Result

More than 20 remote and in-office users connect on their own, nobody received local admin rights for it, and access is revoked in one place when someone leaves.

The scripts are open source: wireguard-nonadmin-windows. Reference: WireGuard for Windows enterprise usage documentation.

← All writing