DirectAccess is a feature that has been introduced in Windows Server 2008R2 and Windows 7. It allows secure access to enterprise resources, without requiring a manual VPN connection. A DirectAccess enabled computer establishes a secure connection to the DirectAccess server every time the computer is connected to the internet.

Windows Server 2012 and Windows 8 really simplify the configuration required for DA, making it much easier to deploy a remote access solution.

Requirements

The only requirement is the installation of a Windows Server 2012 member server, providing the “head end” of the connection. No Active Directory, schema, forest, domain-level updates are required.

The DA Server needs two network adapters, one connected to the internal LAN, the other one connected to a DMZ or public network.

image 

If the DA Server is located behind a firewall, https (tcp/443) has do be allowed from the internet to the “public” network adapter.

DirectAccess relies on IPv6 technology, the only hosts that require an IPv6 address are the DirectAccess Server and clients, though. The DA server performs NAT64 and DNS64 in order to enable the DA client to access IPv4 only servers.

Installation

Use ServerManager or PowerShell to install the Remote Access server role on the designated DirectAccess server.

image

Once installed, use the “Getting started” wizard to configure DirectAccess. The wizard can be started from ServerManager or from within the “Remote Access Management Console”.

Select “Deploy DirectAccess only” in the wizard.

image

Select the network topology to be used, in this example I am using a server with two network adapters, one connected to a DMZ and one connected to my LAN. Specify the name (or public IP) that clients will be using to connect.

image

And that’s all there is about it, it’s called “simplified deployment”. The Wizard goes ahead and creates Group Policies for DA Servers and Clients, creates DNS records for Network Location. Pretty cool, eh?

To modify the settings, click the “here” link on the last page of the wizard, for my test environment I go with the defaults.

image

As the wizard finishes, it shows some information about what it did.

image

DirectAccess Server

The DirectAccess Configuration can be shown and changed in the Remote Access Management Console.

image

The Dashboard and Operations Status panels do provide information about the servers status, required services and connected clients.

image

DirectAccess Clients

The wizard created a Group Policy Object, named “DirectAccess Client Settings” and a WMI Filter, to apply that GPO to Notebooks running Windows 7 or 8 Enterprise editions. So all I had to do was to update the group policies on the notebook (gpupdate).

As long as it was connected to the LAN nothing changed, if I connected the notebook to the internet, the DA (Workplace Connection) was established automatically and I was able to access internal resources as if I was on the LAN.

image

I think this “simplified deployment” really does make it easier to get started with DirectAccess, to deploy it in an enterprise network, one should be a little more familiar with the technology :)

So this post was meant to be a quick-and-dirty intro, stay tuned for more in-depth information.

so long,
tom

This post has been migrated from our earlier blog based on BlogEngine.NET.