rasdial Error 623: How to Create the VPN Profile First

Error 623 from rasdial is a lookup failure rather than a network failure: the phonebook holds no entry with that name. Windows expects the profile to exist before any command dials it, and the dialer never provisions one on its own. Work through the checks below in order, because each one assumes the previous one passed.

Read the Error Code Before Anything Else

Codes that follow 623 describe different faults, so the first text you see decides the branch. A 691 is a credential rejection against a profile that does exist, and an 868 usually points at name resolution for the server address. Only 623 sends you back to provisioning, which is why repeating the same command rarely changes anything.

Capture the exit status in the same step that dials. The next command in a script overwrites it, and the real code is gone by the time anyone reads the log.

rasdial "Office"; if ($LASTEXITCODE -ne 0) { Write-Output "failed: $LASTEXITCODE" }

Confirm the Phonebook Entry Exists

Ask Windows which profiles it really has before adding another one. The cmdlet returns the name, the server address and the current connection state, and an empty result settles the question at once.

Windows keeps per-user entries in one phonebook file and all-user entries in another, so one name can point at two different servers. That duplication explains a script that dials the wrong endpoint while the settings you inspected look perfectly correct. List both locations before you conclude anything about the name.

Get-VpnConnection -Name "Office" | Format-List Name, ServerAddress, ConnectionStatus
dir "%APPDATA%\Microsoft\Network\Connections\Pbk"
dir "%PROGRAMDATA%\Microsoft\Network\Connections\Pbk"

Create the Profile With Add-VpnConnection

Provision the entry once, with the cmdlet that writes a native profile rather than with a text edit. Supply the server address, the tunnel type and the authentication method that your gateway actually accepts, because a profile negotiating the wrong protocol fails later with a message that blames the server.

You can still paste a connection section into rasphone.pbk by hand, but nothing validates that edit. One wrong key yields a profile that authenticates against nothing, and the error it produces looks like a remote fault rather than a typo.

Add-VpnConnection -Name "Office" -ServerAddress vpn.corp.internal \
  -TunnelType Ikev2 -AuthenticationMethod Eap -EncryptionLevel Required

Match the Session to the Credential Store

An entry belongs to a user or to the machine, and the certificate or saved credential behind it may be reachable from only one logon session. A scheduled task that runs as SYSTEM is a different client from the account that signed in, and a service in session 0 has no desktop on which to show a prompt. The first time an interactive session meets an unfamiliar network, Windows opens its network location prompt, and the dialer offers no switch to silence it. Session isolation avoids that prompt and simultaneously removes the user context some authentication methods require.

Choose the owner deliberately: a logon-triggered task for a per-user tunnel, or a service for a machine-wide one. Mixing the two and expecting identical behaviour is how a connection that works by hand starts failing under automation.

Leave Auto-Trigger the Way You Found It

Windows can raise a tunnel on its own when an application or a network condition matches, and a disconnect can add the profile to the list of disabled auto-trigger entries. The next automatic attempt then never happens, long after the script responsible has exited. A job that disconnects unconditionally therefore breaks always-on behaviour for every other user of that machine. That side effect is invisible in the job log, which is what makes it expensive.

Note the profile state before the job runs, and put it back the way you found it rather than tearing the tunnel down by default. Re-enabling the trigger is a policy change, so treat it as a deliberate step and not as cleanup.

Two limits survive any amount of scripting. rasdial can report success while the service behind the tunnel is still unreachable, so test the resource you actually need. A profile that demands a smart card, a push approval or a browser sign-in has no unattended path, and a human owner stays part of the design.