Configure the VPN not to be the default route (Untick "Use default gateway on remote network", buried way down in the adapter TCP settings), otherwise this is a bit pointless.
Set up scheduled tasks triggered on 'an event':
- Log:
Microsoft-Windows-NetworkProfile/Operational
- Source:
NetworkProfile
- Event ID:
10000
and another for10001
This will trigger the script on any connection/disconnection, which is mildly annoying, but works.