We have a couple workstations completely outside our network but can hit the ERAS via VPN. Our default policy includes the IP address of the ERAS as the remote server, and doesn't specify it as a hostname in case it has dns resolving issues. The remote workstations can ping the IP and hit shares on it fine. So the question is, why when we deploy either via email or via a package on a share does einstall just silently fail? I see it running for a few seconds in the process list, then it just stops. I'm assuming this is because the einstaller can't locate the ERAS and grab the remote install info from port 2224. But the remote workstations CAN hit the ERAS server via ping and there are no firewalls in the way (non-VPN clients work fine). I even tossed in the hostname into the systemroot\windows\system32\drivers\etc\hosts file in case it was trying to resolve the IP. No luck there either. I guess it boils down to how does the einstaller connect to the ERAS when it's run, and where does it get that info? Is it contained in the package as part of the default policy provided you defined it in the default policy before? Is it somehow embedded when you deploy the package? Is it specified as an IP or hostname? My last resort is to set up a new server available on a public IP (not over VPN) but that seems like overkill.