"VPN client settings will be applied to users' machines during GINA/CP installation or when the GINA/CP scheduler runs."

How exactly does the scheduler update these settings on he client? 

1. Who pushes or pulls? 
2. Is this a LAN only feature or will it operate over the Internet?
3. What credentials/rights are required? (hopefully not a domain admin; running the service account for the entire product as a domain admin, with Internet exposure, is a red flag) 
4. How do I debug issues related to the scheduler?

Thanks!