We have users who VPN into our network/domain, is there a way to that DC can be configured to automatically scan and patch when it sees a system/user VPN'd in to the domain?