Step 2: Configure the DirectAccess Server

Applies To: Windows Server 2012 R2, Windows Server 2012

This topic describes how to configure the client and server settings required for a basic DirectAccess deployment. Before beginning the deployment steps, ensure that you have completed the planning steps described in Step 2: Plan the DirectAccess Deployment3.

Install the Remote Access role

To deploy Remote Access, you must install the Remote Access role on a server in your organization that will act as the Remote Access server.

To install the Remote Access role

1. On the Remote Access server, in the Server Manager console, in the Dashboard, click Add roles and features.

2. Click Next three times to get to the server role selection screen.

3. On the Select server roles dialog, select Remote Access, click Add Features, and then click Next.

4. Click Next five times.

5. On the Confirm installation selections dialog, click Install.

6. On the Installation progress dialog, verify that the installation was successful, and then click Close.

Windows PowerShell equivalent commands

The following Windows PowerShell cmdlet or cmdlets perform the same function as the preceding procedure. Enter each cmdlet on a single line, even though they may appear word-wrapped across several lines here because of formatting constraints.

Install-WindowsFeature RemoteAccess -IncludeManagementTools

Configure DirectAccess with the Getting Started Wizard

To configure DirectAccess using the Getting Started Wizard

1. In Server Manager click Tools, and then click Remote Access Management.

2. In the Remote Access Management console, click Run the Getting Started Wizard.

3. Click Deploy DirectAccess only.

4. Select the topology of your network configuration and type the public name to which remote access clients will connect. Click Next.

   Note

   By default, the Getting Started Wizard deploys DirectAccess to all laptops and notebook computers in the domain by applying a WMI filter to the client settings GPO.

5. Click Finish.

6. Since there is no PKI used in this deployment, if certificates are not found, the wizard will automatically provision self-signed certificates for IP-HTTPS and the Network Location Server, and will automatically enable Kerberos proxy. The wizard will also enable NAT64 and DNS64 for protocol translation in the IPv4-only environment. After the wizard successfully completes applying the configuration, click Close.

7. In the console tree of the Remote Access Management console, select Operations Status. Wait until the status of all monitors display as "Working". In the Tasks pane under Monitoring, click Refresh periodically to update the display.

Update clients with the DirectAccess configuration

To update DirectAccess clients

1. Click the Search charm, and then click Apps. Right-click Windows PowerShell, click Advanced, and then click Run as administrator.

2. In the PowerShell window, type gpupdate and then press ENTER.

3. Wait for the computer policy update to complete successfully.

4. Type Get-DnsClientNrptPolicy and then press ENTER

   The Name Resolution Policy Table (NRPT) entries for DirectAccess are displayed. Note that the NLS server exemption is displayed. The Getting Started wizard automatically created this DNS entry for the DirectAccess server, and provisioned an associated self-signed certificate so that the DirectAccess server can function as the Network Location Server.

5. Type Get-NCSIPolicyConfiguration and then press ENTER. The network connectivity status indicator settings deployed by the wizard are displayed. Note the value of DomainLocationDeterminationURL. Whenever this network location server URL is accessible, the client will determine that it is inside the corporate network, and NRPT settings will not be applied.

6. Type Get-DAConnectionStatus and then press ENTER. Since the client can reach the network location server URL, the status will display as ConnectedLocally.

See also

• Step 3: Verify the Deployment1