deploying openvpn on windows clients

I've mentioned this in a couple other OpenVPN questions but we used to roll our own nullsoft installer for OpenVPN. The starting point and instructions can be found here. The installer contained a well commented configuration file mostly pre-configured for the user. They were provided good instructions with a lot of pictures to guide them through the process of generating a certificate signing request using the MyCertificate Wizard that is part of that package. We prefilled in all the fields for the certificate request other than the employee's name and email address. They would then email us their csr which we would verify the information in the request, sign it, and email them back their certificate. Then their instructions included installing the certificate and modifying the configuration files to point to their new certificate and key files.

We were a small company though so it was easy to help out the couple of users who struggled with this process. In a bigger organization I think I would have moved the certificate requests and signing and auto generated configuration file to some sort of web based application.

Another thing you could look into is something like wpkg, another favorite project of mine. In it you could have a base xml file that belongs to a general profile to pushes out the openvpn package to all the computers in the organization. Then you could have per user profiles that contain an xml package file that pushes out the configuration for that user. But this may get a bit much to manage if you have a large number of users. It also takes a bit of time to figure out and implement wpkg so it may not be worth the effort. If you have a WSUS server available you may be able to do something similar with it.