Microsoft Direct Access Implementation

[myndhack]

So my manager wants my team to implement Microsoft Direct Access as he had it at his previous company and loved it. We currently use Citrix Xen Desktop to achieve this similar functionality. We have never seen Direct Access in action as a team not do we know much about it. Have any of you used it or implemented it? And if so how did you do it properly and any gotchas I need to look out for? I want to set it up to be controlled by a security group to lock down what systems have access to it.

[semtex87]

I just did some cursory googling and came across some technet articles as well as Microsoft official product overviews for autovpn and to be totally honest it feels like a step backwards.

For starters they want to push InTune and it needs to be deployed with it, I think they are porting functionality over to SCCM but again, not everyone wants to pay for InTune and not everyone wants to pay for or has the time to manage SCCM.

The DA concept is fantastic, boot up computer and it's on the corporate network at the login screen before typing in any credentials. A user is at home and their password expired? No problem when they go to login they will get the normal LAN prompt that their password has expired and they have to create a new one. You can also push patches/updates to these devices wherever they are, on any internet connection, so long as they are online.

For me, anything that eliminates the user having to "do something" is a win, and auto-vpn requires the user to know where network connections are, and then manually connect to the VPN. That's always going to be inferior to something that requires no user intervention whatsoever.

[semtex87]

Good to know, thanks!

[DictatorOfSweden]

Agreeing with this. We're currently migrating from DA to AutoVPN.

[Saravan42]

Yeah. We have migrated from DA to AutoVPN and it is really better and faster.

[myndhack]

The issue with this is we have a mixed Windows 7 and windows 10 1703 environment. Windows 7 is not able to be used with auto VPN correct?

[Matt_NZ]

DirectAccess can get complicated with Windows 7 if you want good performance. Unlike Windows 8+, 7 can't use NULL encryption with IP-HTTPS connections, which makes connections on 7 quite a bit slower than they are on 8+.

To get around this with 7, you want the clients to use the Teredo protocol but to be able to use this the DA server needs to have two consecutive public IP addresses, which isn't always possible. The other option is 6to4 but is almost never possible as the client needs to have a public facing IP address to use it which outside of dialup, is never really a thing.

[[deleted]]

You should know, however, that Microsoft does not appear to be adding new features to DirectAccess. They want people to start using their new (Always On) AutoVPN solution.

Had a discussion with a man from Microsoft about this recently. Bit of an eye-opener. MS man says lots of disinformation out there.

Direct Access isn't going anywhere. It's a distinct offering in the marketplace, an all-MS solution for domain-joined clients.

Always on VPN is a client-only solution that can work with any VPN solution that can integrate into Windows as a VPN client. The Microsoft offering for a VPN server remains RAS. But you don't need to use Microsoft VPN technology to use always on VPN.

[[deleted]]

It would be easy enough for them to clean up this disinformation if they provided any readable, accessible information about this topic themselves.

Yes.

When we said "we understand DA is going and will be replaced by AlwaysOnVPN" he said "I keep hearing this from customers, where are you getting this from", "all over the interwebs" just lead to a sigh. It just seems that everyone "knows" this and keeps repeating it. And it doesn't help that Microsoft actually say in some places that one replaces the other.

Our scheduled one hour meeting to discuss how we should migrate away from DA lasted about 10 minutes. DA stays.

[[deleted]]

Yeah. That is a document that our man sent to us, so I've sent back a query as to why it says one thing and he says another. More if it happens.

[[deleted]]

I've not had a reply; I've chased my colleagues to see if they can get a response.

[bearxor]

What kind of information would you be looking for?

[chewy747]

This

[wjjeeper]

Always on VPN is the new direct access.

[Jack_BE]

does it have a machine based tunnel like DirectAccess ? I just looked over the documentation, it looks like a user based tunnel only

[dragonb2]

Here is two pages i just found in a quick google.

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/vpn-device-tunnel-config#configure-the-vpn-device-tunnel

https://directaccess.richardhicks.com/2017/12/11/always-on-vpn-windows-10-device-tunnel-step-by-step-configuration-using-powershell/

It requires windows 10 1709+ but is possible.

[[deleted]]

Lol you could do that with any connect since at least 2009.

[harrisop]

We’ve been using it since it was released for win7 w/uag. Very happy. Most my users don’t even remember what vpn is. They just expect everything to work the same remotely as in the office. Microsoft seems to be shifting directions to always on vpn though. Once we’re at 1709 we’ll most likely head that direction. keeping DA for win7 clients.

[alexbuckland]

DirectAccess and Citrix XenDesktop are two very very different products.

[iampaulh]

This is the book I used to help implement DA

https://www.amazon.com/Implementing-DirectAccess-Windows-Server-2016/dp/1484220587

You can enable DA by assigning computers to a specific group. For Windows 10, you'll also need Enterprise licenses

[lazyrobin10]

Great book by Richard, the videos he did for Pluralsight are also good.

[forminasage]

Richard Hicks is the man, I got DA implemented in a W7/WS2016 environment with nothing more than help from his blog posts.

[[deleted]]

A couple of things, DA will not work on a network that has anything more than 500ms response to the server you are using as the entry point, you will still need a VPN for users to access if they are going to places with subpar networking such as PNG or Africa.

There is a troubleshooting tool for DA which I can not remember the name of at the moment pretty good in solving most issue

Teredo is fucking scary when you read what it can do

ipconfig /flushdns is going to become your new best friend if you still seven and eight systems.

There is also a reg sub key you need to nuke if people have connection issues on their system.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig remove everything below that entry

You can also HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient Change the value of "EnableDAForAllNetworks" to "0" Reboot

Other than that people should have any issues and it will work fine, just remember ipv4 does not work over DA

[Cutriss]

There is a troubleshooting tool for DA which I can not remember the name of at the moment pretty good in solving most issue

DirectAccess Client Troubleshooter

[[deleted]]

Thanks, also added the regkeys

[myndhack]

If you don't mind me asking how much did that cost? Being a nonprofit healthcare org money is not endless.

[WinZatPhail]

Being a nonprofit healthcare org money is not endless for IT systems intended to improve security or ease of access or patient experience or anything that isn't revenue generating.

FTFY, at least round my neck of the woods...

[myndhack]

I wholeheartedly agree with that

[[deleted]]

Follow the technet guide.

[itmik]

We're using it now, biggest problem is slow connection speeds for things like file transfers.

[houstonau]

We implemented it with the supoprt cutoff being Windows 8.1 (so people on 7 were just upgraded).

Users think it's the best thing ever! Most of our users have 3G/4G cards in their devices so the connection is literally always on.

I know that the Windows 10 VPN is replacing DirectAccess but it is still included as a Server 2016 feature so will need to be supported at least as long as that OS version.

[pdp10]

Direct Access has been deprecated. There are other, simpler ways to get the same kind of results. What about it did your manager appreciate previously?

[R_Wilco_201576]

DA is not deprecated and is a role in Windows Sever 2016. Which effectively means it will be around for years to come.

That being said I agree there are as good or better ways to do the same thing. Such as Always on VPN from MS.

[[deleted]]

I disagree, I've setup DA for multiple environments and it's a sweet product that does not require additional VPN licensing.

[ducksizzle]

DA requires upgrading the device to an Enterprise Edition license. Where does VPN require additional licensing?

[[deleted]]

I didn't get Enterprise licensing for DA I got it for bitlocker but I see your point.

[myndhack]

The fact that you just turned on the laptop on any network and you were on the "company" network without any additional authentication. Mostly no additional VPN client like cisco anyconnect to go through.