GINA/CP Scheduler mechanism rights

GINA/CP Scheduler mechanism rights

According to the updating cached credentials note:

"VPN client settings will be applied to users' machines during GINA/CP installation or when the GINA/CP scheduler runs."

How exactly does the scheduler update these settings on he client? 
  1. Who pushes or pulls? 
  2. Is this a LAN only feature or will it operate over the Internet?
  3. What credentials/rights are required? (hopefully not a domain admin; running the service account for the entire product as a domain admin, with Internet exposure, is a red flag) 
  4. How do I debug issues related to the scheduler?

Thanks!
              New to ADManager Plus?

                New to ADSelfService Plus?