Step-By-Step: Enabling DirectAccess in Windows Server 2012

Last week Pierre and I completed the last Windows Server 2012 #CANITPRO Camp in St. John's, Newfoundland.  The camp was a great showcase of virtualization capabilities for Windows Server 2012 and was well received by audiences across Canada.  So much so that Pierre, Mitch and I will be putting together a version 2 of Windows Server 2012 #CANITPRO Camp next week.  Agenda and dates of the camps will be posted soon but I wanted to incorporate one of the upcoming labs into a Step-By-Step post to allow everyone a preview of what to expect.

Direct Access

Direct access was introduced in Windows Server 2008 R2 as a new remote access feature allowing connectivity to corporate network resources without the requirement of Virtual Private Network (VPN) connections. DirectAccess at the time only supported domain-joined Windows 7 Enterprise and Windows 7 Ultimate edition clients. Windows Routing and Remote Access Server (RRAS) will continue to provide traditional VPN connectivity for legacy clients, non-domain joined clients, third party VPN clients and site-to-site server connections. RRAS in Windows Server 2008 R2 must be deployed and managed separately from DirectAccess as it cannot coexist on the same edge server.

In 2012, DirectAccess offered with Windows Server 2012 combines the feature and the RRAS role service into a new unified server role. This new Remote Access role allows for centralized configuration, administration, and monitoring of both VPN-based remote access services and DirectAccess.  Windows Server 2012 DirectAccess also provides multiple updates and improvements to address deployment blockers and provide simplified management.

These features include:

• DirectAccess and RRAS coexistence
• Simplified DirectAccess Deployment
• Removal of PKI (Public Key Infrastructure) as prerequisite
• Built in NAT64 and DNS64 support for IPv4 only resources
• Support for DirectAccess behind a NAT device
• Load Balancing Support
• Multi Domain Support
• NAP Integration
• Manage-Out to clients support
• User Monitoring / Server Status / Diagnostics
• IP-HTTPS performance improvements
• Server Core Support
• Multisite Support

Windows 8 and Windows Server 2012, DirectAccess deployment is also now simplified with a working configuration deployed in a few clicks. However, options are also available to allow for DirectAccess accessibility through a multitude of deployment options should the standard configuration not meet your organizations requirements.  These deployment options include:

• Single Site Remote Access
• Remote Access in a Cluster
• Multiple Remote Access Servers in a Multisite Deployment
• Remote Access with OTP Authentication
• Remote Access in a Multi-Forest Environment
• Remote Access with Network Access Protection
• Remote Access in the Cloud

Prerequisites

Download and install Windows Server 2012 in your lab to complete this exercise. Alternatively you can complete this lab in a virtual lab setup by downloading and installing Hyper-V Server 2012.

Direct Access Deployment Steps

1. Install the remote access role:
   • In the Server Manager console, in the Dashboard, click add roles.
   • Click Next three times to get to the server role selection screen.
   • On the Select Server Roles dialog, select Remote Access, click Add Required Features, and then click Next.
   • On the Select features dialog, expand Remote Server Administration Tools, expand Role Administration Tools, and then select Remote Access Management Tools, and then click Next.
   • Click Next four times.
   • On the Confirm installation selections dialog, click Install.
   • On the Installation progress dialog, verify that the installation was successful, and then click Close.
2. Obtain two consecutive public IPv4 IP addresses and configure them on the external adapter of the server. These addresses must be unique.
3. Create a new DNS record for the server FQDN.
4. Obtain a server certificate for IP-HTTPS connections, with a subject name that matches the FQDN of the server.
5. Create client security groups.
6. After Installing the Remote Access Role. Open up the Remote Access Management Console
   
   
7. Click on the Deploy DirectAccess Only option
   
   
   
8. If two network adapters are present, select the Edge topology and enter the FQDN or External IP address, if not, select the topology that meets your requirements
   
   
9. Click Next and Finish with the default options or select to edit the settings (settings can be edited later)
   
   
10. The wizard cycles through various processes and completes the task
    
    

Once completed successfully, the ability to look through all the configuration steps and edit as needed/necessary is made available.

To explore the new DirectAccess feature for yourself download the Windows Server 2012 installation kit.