Anyconnect .MSI package modifications

• preferences.xml is not created on anyconnect install.
• preferences.xml is created when editing Anyconnect options OR on first successful VPN connection to ASA.
• preferences.xml is created locally in: C:\Users\%username%\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client

The only reference to preferences.xml in the anyconnect-win-3.1.05160-pre-deploy-k9.msi package is:
Table: CustomAction;
Action: MoveUserPrefs
Type: 3154
Source: InstallHelper.exe
Target: -moveIfExist "[LocalAppDataFolder]\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "[Cisco_AnyConnect_Secure_Mobility_Client_DIR]\preferences.xml"

---

Need to add a client-profile in MSI package.
Created extra row in File table:

File: acp_Default.xml
Component: acp_Default.xml
Filename: acp_Default.xml
FileSize: 3385
Sequence: 95

Blogpost about Component attributes:
http://www.alkanesolutions.co.uk/tag/windows-installer-component-attributes/

Preconfiguring Anyconnect .msi installer

AnyConnectLocalPolicy.XML is a configuration file for Anyconnect local settings. 
It is located at C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\AnyConnectLocalPolicy.XML

Problem is that the configuration in the file is not configurable from ASA. 
The file is generated locally upon installing Anyconnect.
There are 2 methods for pushing the desired configuration file to clients (maybe 3?):

• Write a script that replaces the client's local configuration file with a modified configuration file located on a remote fileshare. The script can be pushed to the client via Anyconnect script feature. Of course Anyconnect needs to be run in administrative rights to copy/replace system files. A working snippet for the script:

copy "\\vboxsrv\temp\AnyConnectLocalPolicy.xml" "%AllUsersProfile%\Cisco\Cisco AnyConnect Secure Mobility Client\AnyConnectLocalPolicy.XML" /y

• Modify the Anyconnect .msi installer. A nice tool for editing the .msi installer is Microsoft Orca. Orca is included with the Microsoft Windows SDK for Windows 7 and .NET Framework 4 (winsdk_web.exe).

After the SDK is installed you must install Orca from C:\Program Files\Microsoft SDKs\Windows\v7.0\Bin\Orca.Msi 

Once installed you can edit the anyconnect-win-3.1.05152-pre-deploy-k9.msi with Orca. The default values of AnyConnectLocalPolicy.XML can be modified when navigating Orca to the Property table and changing the value of LOCAL_POLICY_RESTRICT_PREFERENCE_CACHING, which defaults to "false". 

After changing from "false" to "Thumbprints" Anyconnects installs with a modified AnyConnectLocalPolicy.XML