MacOS Sierra Launch Daemon won't start VPN service before login prompt I'm trying to get a new MacBook Pro running the latest version of Sierra to connect to my corporate VPN before the login screen. My machine is connected via Ethernet so I don't have to try and start Wi-Fi service prior to login. My command line script to connect to the VPN works fine in terminal. I know the file needs to be placed in /Library/LaunchDaemons/ but I'm not sure how to make sure it's processing before getting to the login screen. I'm new to writing plist files, so any help would be appreciated!

    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
    &lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"                         
    "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
    &lt;plist version="1.0"&gt;
&lt;dict&gt;
&lt;key&gt;Label&lt;/key&gt;
&lt;string&gt;com.vpn_at_boot&lt;/string&gt;
&lt;key&gt;ProgramArguments&lt;/key&gt;
&lt;array&gt;
    &lt;string&gt;sh&lt;/string&gt;
    &lt;string&gt;-c&lt;/string&gt;
    &lt;string&gt;sudo /usr/local/Cellar/sstp-client/1.0.11_1/sbin/sstpc vpn-hidden.hidden.com --user &lt;hidden&gt; --password &lt;hidden&gt; --log-stderr --cert-warn require-mschap-v2 noauth refuse-eap noccp&lt;/string&gt;
&lt;/array&gt;
&lt;key&gt;RunAtLoad&lt;/key&gt;
&lt;true/&gt;
Your plist contains major errors and minor glitches. The proper plist - including stderr and stdout - looks like this:

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
    &lt;key&gt;Label&lt;/key&gt;
    &lt;string&gt;com.vpn_at_boot&lt;/string&gt;
    &lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;/bin/sh&lt;/string&gt;
        &lt;string&gt;-c&lt;/string&gt;
        &lt;string&gt;/usr/local/sbin/sstpc vpn-redacted.redacted.com --user redacted --password redacted --log-stderr --cert-warn require-mschap-v2 noauth refuse-eap noccp&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;RunAtLoad&lt;/key&gt;
    &lt;true/&gt;
    &lt;key&gt;StandardErrorPath&lt;/key&gt;
    &lt;string&gt;/tmp/com.vpn_at_boot.err&lt;/string&gt;
    &lt;key&gt;StandardOutPath&lt;/key&gt;
    &lt;string&gt;/tmp/com.vpn_at_boot.out&lt;/string&gt;
&lt;/dict&gt;
&lt;/plist&gt;


Replace redacted with the proper domain name, user and password in your plist.

Your plist misses important tags (e.g. &lt;/dict&gt; and &lt;/plist&gt;). It contains unnecessary stuff like sudo. The sstp-client may be updated later, so use its link in /usr/local/sbin. I also recommend to add /usr/local/sbin to /etc/paths.

The plist permissions have to look like this:

-rw-r--r--  1 root  wheel  - 682 Jun  9 13:38 /Library/LaunchDaemons/com.vpn_at_boot.plist


After running the daemon successfully (i.e. without errors) you may remove the keys StandardErrorPath and StandardOutPath and their corresponding strings in the plist.