Help with Dial-up VPN

As for your boss - do you have a web server at your site?
As to remotely administrating your web site over vpn I have found a product from AT&T that is free to be very helpful.
The AT&T European developers built a system called VNC. it is available for download from
http://www.uk.research.att.com/vnc/
The documentation and source code is also available if you want. You can run vnc as a service so you can reboot as server at work from home via the vpn connection. VNC has made my life mucheasier and the best part is IT"S FREE!

If you are using dial-up, you don't really need VPN unless you are worried about phone line taps. A dial-in RAS connection to your mail server will allow your boss to get his mail (with his proper username and password).

When you define the incoming RAS connection you can specify whether the caller can access that machine only or the entire network. In the latter case the server acts as a router between the LAN and the dial-in users. With this setup you could do your admin tasks.

You would need a VPN where, for example, your boss wanted to dial his ISP and attach to your mail server over the internet. In that case you want the traffic to be authenticated before it gets on your network, and encrypted, since someone on the internet could theoretically intercept it. RRAS on your NT server includes the VPN software (install the PPTP protocol). You open a hole on your firewall for the two ports that VPN uses, allowing this traffic to and from whichever server you are using as your VPN server. Microsoft has extensive writeups on theory and deployment of VPN. Go to www.microsoft.com/technet and search for 'PPTP'.

On the user side, Win95 needs the Dial-up networking 1.3 upgrade, available from the Microsoft site. I believe Win98SE has it included, but you have to add the PPTP protocol.

Good luck.

I see two (or more)problems here.
2kPro boxes do PPTP and L2TP. Exchange does OWA, which you can make SSL using Certificate Authority which you will need for L2TP.
First off, will your laptop users ever have to do traveling which will require them to either dial a 1800 for your RRAS, or a 1800 for ISP and then VPN in. Either way, you'll end up with 3 network connections for the RRAS on each 2KPro laptop.
I would setup the OWA with SSL as the first choice, with RRAS second, with VPN third, and VPN only if you have a definitive need for it.
RRAS will require you to coordinate your DHCP with RRAS, dink around with the RAS Policy and the user objects. With only 4 users I'd simply enable the 4 users for dial-in rights, assign static IP inside the RRAS.
OWA as the only incoming method from the ISP will(using SSL)work better than the VPN will.
VPN over a dial up RRAS is redundant. You are already connecting straight in.
YMMV

Using high security cost no more. Always go with the maximum level of security and encryption that all of your users have in common. If all of your users can use Microsoft challenge authentication with 128 bit data encryption, go for it. Unless you are using a very slow computer, the computer will have no trouble doing the encrypt/decrypt fast enough to keep up with a dial-up line (or a T1 for that matter).

Good luck.

You'd need to be routing in since you have a mail server you need to get to listening on the network. If you just try to let them access the Win2K computer as a VPN server instead of a VPN router, they can't get out of that computer and won't be able to access the mail, so you have to clear them for domain access. So you go to your Win2K server, Dial Up Networking, Make New Connection, and use Allow another computer to connect. This takes you to the Routing and Remote Access system, which you must now set up and includes permissions for the remote user. Then, you have to go to the user properties in AD and click "Accept Dial-In"- you might be able to do it from RRAS MMC. Your boss must set up his Dial Up Networking connection for VPN and make sure his login includes a Domain window (which I couldn't find before I tried to log in, but popped up on authentication and is now part of the DUN connection properties- go figure :) I've heard that he will have to also use "Log on to NT domain"and have the domain in to access files, but I don't know if that's true as my setup is VPN server, not router. Good luck!
David