FQDN Split tunneling does not work at all.  Endpoints are left in a broken state where internal corporate DNS Servers are set statically on an endpoint.  Users can no longer use their computer until it's brought into the office to have DNS Servers set back to automatic.  (TAC admits this, and suggest that it not even be used) Disabling DNS registration at the adapter level isn't really valid either, regardless of GPOs to attempt to disable the setting.  This just 'fixes' the issue when a machine is remote on VPN, but now when back in the office would not register its DNS entries correctly (or at all). ... View more

Great, that does not answer the question at all.   "Has anyone actually used the PCS to sucessfully utilize a Windows 2019 server as a DHCP Server (That doesn't reside on the same LAN segment as the clients [Relay])?"   Doesn't.  Does NOT reside on the same LAN segment as the clients. ... View more

Has anyone had a chance to look / try this yet?   https://support.microsoft.com/en-us/help/4505658/windows-10-update-kb4505658   Specifically: Microsoft introduced a new Registry Key to fix this issue in   KB4507466 Addresses an issue that causes a Windows device to incorrectly register host A records for two network interface controllers (NIC) after establishing a virtual private network (VPN) connection to the corporate domain. This occurs when the device is configured with two NICs and one of them is a VPN. To implement this solution, make the following registry changes and then restart your device: Setting: DisableNRPTForAdapterRegistration Path: HKLM\System\CurrentControlSet\Services\Dnscache\Parameters Type: DWORD Value: A value of 1 means that only the host A records for the VPN interface will register on an active VPN connection. A value of 0 (default) means host A records will also be registered for other local interfaces. ... View more

That implies that I would need to change configuration of the client when it is remote vs the next day when it is back in the office.  The Pulse Secure Desktop client already does a terrible job of detecting Domain vs Private network locations let alone, trying to script a change at login to prevent other adapters from registering in DNS. ... View more