Skip to content

Connect your Windows laptop to official Dev and QA

Status: Current | Last reviewed: 2026-09-18

This guide is only for your laptop. Your city host must already have a working TrueServe relay. It gives your browser a path to official Dev and QA, including voice traffic, while your normal core VPC VPN stays connected.

Use one WireGuard connection for both environments. Their website addresses and sign-in process stay the same.

OpenVPN pilot: if your city owner issued an .ovpn bundle instead, follow Windows OpenVPN setup. That path uses OpenVPN Community 2.7+ and its own DNS handling; do not run the WireGuard helper below for an OpenVPN connection.

1. Get your personal connection bundle

Ask your city owner for a Windows laptop bundle for your device. Give them your city and a device name, such as alex-windows. The private ZIP includes:

  • both\TrueServe.conf — your profile for Dev and QA together.
  • dev\TrueServe.conf and qa\TrueServe.conf — optional single-environment profiles.
  • windows.ps1 — the connection and DNS helper.
  • WINDOWS-SETUP.md — this guide.

The profile contains your private key. Store the ZIP and its extracted files in your own user folder. Do not commit them, post them in chat, or share them with another developer. Each laptop needs its own bundle.

Right-click the ZIP and choose Extract All. For example, extract it under C:\Users\YOUR_USERNAME\TrueServeAccess\alex-windows. Keep the helper and profile folders together.

2. Connect your normal core VPC VPN

Connect the corporate/core VPN you normally use to reach your city. Leave it connected while using TrueServe.

What this does: lets Windows reach the city's private IP. WireGuard uses that existing route; it does not replace your core VPN.

3. Install the official WireGuard application

Use your approved software installation process to install WireGuard for Windows. The official installer is available from:

https://www.wireguard.com/install/

What this does: installs the WireGuard app and its command-line tools. Both connection methods below use this installation.

4. Open an administrator PowerShell window

Open Start, type Windows PowerShell, right-click it and choose Run as administrator. Accept the Windows permission prompt.

If your account cannot obtain administrator elevation, ask desktop support to perform this setup. Both methods configure system networking and need approved administrator access; the GUI option is not a way around that.

Change to the extracted folder:

cd "$env:USERPROFILE\TrueServeAccess\alex-windows"
Get-ChildItem

Use your actual folder name. Check that windows.ps1 and both are listed. If elevation used a different administrator account, $env:USERPROFILE points to that account's folder. Use the full path to the original user's extracted bundle instead. If Windows marked the reviewed script as downloaded, run:

Unblock-File .\windows.ps1

What this does: opens the files in the right place with permission to configure networking. Unblock-File removes the downloaded-file marker; it does not override your organization's PowerShell policy. If script execution is still blocked, use your approved signing/support process rather than changing machine-wide execution policy.

5. Activate Dev and QA

Choose one method. Do not activate the same profile with both methods.

Start with PowerShell on a managed corporate laptop. It can manage the tunnel service without opening the WireGuard GUI.

Option A: PowerShell

In the administrator PowerShell window, run:

.\windows.ps1 up both
.\windows.ps1 status

What this does: up installs and starts the TrueServe tunnel service, checks the connection, and adds scoped DNS rules. It adds selected destination routes rather than replacing your default route. The active private profile is restricted to Administrators and SYSTEM.

Use up, not dns-on, to start the PowerShell method. dns-on never starts a tunnel; it is the DNS step for an already active GUI tunnel.

The tunnel service can start with Windows. Keep the core VPN connected when using it, or disconnect the TrueServe service with down when finished.

Option B: WireGuard app

The default WireGuard GUI is available to desktops of users in Windows' built-in Administrators group. If it says “WireGuard is running, but the UI is only accessible from desktops of the Builtin Administrator group,” the manager service is running but your desktop cannot open its GUI. This does not mean the TrueServe tunnel is active. Use Option A with approved elevation, or ask desktop support to configure it.

  1. Open WireGuard.
  2. Choose Import tunnel(s) from file.
  3. Select both\TrueServe.conf from your extracted folder.
  4. Select TrueServe and click Activate.
  5. In the administrator PowerShell window, run:

powershell .\windows.ps1 dns-on both

What this does: the app starts the tunnel. The helper checks the route and tunnel DNS, then tells Windows to use the city resolver only for the listed TrueServe names. Importing the profile alone does not install these DNS rules.

6. Verify the connection

.\windows.ps1 status

What this does: shows the WireGuard handshake, the route to the city, and the effective DNS settings. It also queries Studio DNS through the tunnel. The city endpoint must use the core VPN; TrueServe destinations should use WireGuard.

A recent latest handshake confirms the peers communicate. It does not prove browser sign-in or audio, so complete the next step too.

7. Open the normal websites

Environment Studio Grafana ArgoCD
Dev https://studio.dev.trueserve.deloitte.com/ https://grafana.kms.dev.trueserve.deloitte.com/ https://argocd.kms.dev.trueserve.deloitte.com/
QA https://studio.qa.trueserve.deloitte.com/ https://grafana.truserve-qa-wus.qa.orchestrator.trueserve.deloitte.com/ https://argocd.truserve-qa-wus.qa.orchestrator.trueserve.deloitte.com/

Open Studio, sign in normally and complete MFA. Allow microphone access. Test a voice call in each environment and confirm you can speak and hear the reply. Dev and QA can stay open in separate tabs.

What this does: checks the real sign-in and voice path. No localhost address or city-specific replacement URL is needed. ArgoCD browser SSO is separate from its CLI SSO configuration.

8. Disconnect when finished

If you used the app

In administrator PowerShell:

.\windows.ps1 dns-off

Then click Deactivate in WireGuard.

If you used PowerShell

.\windows.ps1 down

What this does: removes the TrueServe DNS rules and, for the CLI method, removes the TrueServe tunnel service. Your core VPN remains available. Remove DNS rules before stopping the app tunnel so Windows does not send these lookups to a disconnected resolver.

Reconnect, switch or replace your profile

  • Reconnect: connect the core VPN and repeat step 5.
  • Dev only or QA only: disconnect first. Use up dev or up qa with the CLI. App users disable DNS, deactivate/delete the old imported profile, import the desired folder's TrueServe.conf, activate, then run dns-on dev or dns-on qa.
  • New city or refreshed bundle: disconnect, replace the entire bundle, replace the app's imported profile if applicable, and reconnect.

Use both for normal work. Do not activate two city tunnels together: their destination routes overlap.

If something fails

GUI administrator message, then “found 0” from dns-on

No interface has the address in your selected profile. dns-on checks that interface before changing DNS, so it stopped without enabling DNS. In an administrator PowerShell window, from your extracted bundle folder, run:

.\windows.ps1 up both
.\windows.ps1 status

Leave the core VPN connected. These commands do not require opening the WireGuard GUI. The earlier failed dns-on check did not create saved helper state, so that failure alone does not require down.

If up reports an existing service or saved profile, collect these results before retrying; do not delete another user's tunnel or change administrator group/registry policy:

Get-Service -Name 'WireGuardTunnel$TrueServe' -ErrorAction SilentlyContinue |
    Format-Table Name,Status
Get-NetIPAddress -AddressFamily IPv4 |
    Where-Object { $_.InterfaceAlias -like '*TrueServe*' } |
    Format-Table InterfaceAlias,IPAddress
& "$env:ProgramFiles\WireGuard\wg.exe" show

Send the up error and these outputs to your city owner. Do not send the private .conf file. If a previous CLI startup failed and left helper state, use .\windows.ps1 down to clean up that owned connection before retrying.

Other failures

WireGuard installation failed: 1

The exit code alone does not identify the cause. The GUI's built-in Administrators desktop message is separate from /installtunnelservice; service installation still requires permission to create and start a service. Do not assume that enabling GUI access will fix it.

Use the current windows.ps1 from your city owner. It captures WireGuard's native error text during up. Before cleanup removes the saved logs, run:

.\windows.ps1 diagnose both

What this does: reports elevation, saved-file existence and service state, then prints installation errors and recent WireGuard logs with key-shaped values redacted. It does not start a tunnel, change group membership or modify registry policy. Review the output before sharing it with your city owner.

The actual message determines the next step: permission/policy failures need desktop support; a missing saved profile needs a complete bundle; driver or service-start failures need the corresponding Windows/WireGuard diagnostics. Avoid repeated blind installation attempts.

Missing C:\ProgramData\TrueServeAccess\mode.txt

This indicates an incomplete or altered helper state directory. The current helper writes its GUI/CLI ownership marker before copying the profile. down can clean up older incomplete state when no TrueServe service or saved tunnel address is active. If a service/interface exists and ownership is unknown, it preserves the files and asks for diagnostics instead.

  1. Confirm the core VPN is connected and PowerShell is running as administrator.
  2. Run .\windows.ps1 status and send its output to your city owner. Do not share the .conf file or private key.
  3. For a failed CLI startup, run .\windows.ps1 down before retrying.
  4. If the helper reports an existing or overlapping NRPT policy, Windows already has a DNS rule for those names. Ask desktop/network support to review it; the helper deliberately preserves existing corporate rules.
  5. If tunnel DNS works but the browser cannot find the website, have desktop support check whether browser Secure DNS bypasses the system resolver.
  6. If Studio loads but audio fails, check the browser microphone permission and Windows microphone privacy settings. Report the environment, time and whether one or both audio directions fail.

After sleep, reboot or a core VPN interruption, run status before assuming the connection recovered. DNS rules can remain while the core VPN is offline; down or dns-off provides cleanup for the selected connection method.

Reference: WireGuard Windows services and GUI access.