Prerequisites & Requirements

Before attempting to connect, verify that all five criteria are satisfied:

  1. Active Directory Group Membership: The user account must be a member of the VPNUser AD Security Group (used by Cisco ASA/FTD or RADIUS/NPS to authorize access).

  2. Domain Computer Certificate: Issued by your internal Active Directory Certificate Services (AD CS) to the Local Machine Store (certlm.msc).

  3. Strong Computer Key Certificate / User Cert: Enrolled in the Machine or User Store with valid private keys.

  4. VPN Profile File: CertMFA.xml located in C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile.

  5. Administrative Rights: Local Admin access on the client machine to write configuration files and manage machine certificates.

Step-by-Step Installation & Configuration Guide

1.Verify User Group Membership (VPNUser):Confirm the user account is authorized in Active Directory before troubleshooting client settings.

  1. On Active Directory Domain Services (or via Active Directory Administrative Center / RSAT), find the user account.

  2. Open Properties > Member Of tab.

  3. Ensure VPNUser is listed among the security groups.

  4. Note: If the user was just added to the group, they must log off and log back into Windows (or lock and unlock) to update their Kerberos access token on the client endpoint.

2.Verify Certificates in Windows Certificate Store:Ensure machine and user certificates are present before launching the VPN client.

  1. Press Win + R, type certlm.msc, and press Enter to open the Local Machine Certificate Store.

  2. Expand Personal > Certificates.

  3. Verify that both the Domain Computer Certificate and the Strong Computer Key Certificate are present, valid, and contain a private key.

3.Deploy the Cisco Secure Client / AnyConnect VPN Profile:Place the CertMFA profile file in the designated Cisco configuration directory.

  1. Open Windows File Explorer as Administrator.

  2. Navigate to the profile directory path:

    C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile

    (Or for legacy AnyConnect: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\VPN\Profile)

  3. Copy your CertMFA VPN profile file (e.g., CertMFA.xml) into this directory.

4.Install or Update Cisco Secure Client:Run the client installer if Cisco AnyConnect is not already installed.

  1. Run the Cisco Secure Client Predeploy Package installer (.msi).

  2. Select the Core VPN module and complete the installation wizard.

5.Verify Profile Recognition & Initiate Connection:Launch Cisco Secure Client and select the CertMFA connection profile.

  1. Launch Cisco Secure Client from the Windows Start menu.

  2. Select the CertMFA profile from the drop-down menu.

  3. Click Connect.

  4. The client will authenticate using the computer certificates and validate authorization against the VPNUser group via your Cisco headend AAA policies. Complete the MFA prompt when requested.

Quick Troubleshooting Checklist

  • Authentication/Authorization Denied? If the certificate succeeds but connection is rejected, verify that your Cisco ASA/FTD or Cisco ISE / RADIUS policy is properly matching the LDAP attribute for the VPNUser security group.

  • Group Membership Not Applying? Run whoami /groups in a Command Prompt on the client machine to confirm Windows recognizes the user is in the VPNUser group.

  • Profile Reload: Restart the Cisco AnyConnect Secure Mobility Agent service (services.msc) if the profile does not automatically show up in the client UI.