Its actually a two part solution, one service where basically all the logic etc is baked into, but since the vpnclient needs to be invoked as the logged on user thats done from something running as the logged on user I believe, at first this was a trayicon but since you already have 10000000 of those that was ditched later I think. I did not do the end result only the specification what was supposed to happen and some initial investigations if the solution was feasible at all - which it proved to be.
This could certainly be coded into any vendors client fro the start which would be the ideal solution really. Until then, were doing it ourselves.
Nimbostratus