Deploy a Single DirectAccess Server Using the Getting Started Wizard

Artykuł
08/31/2016

Applies To: Windows Server 2012 R2, Windows Server 2012

This topic provides an introduction to the DirectAccess scenario that uses a single DirectAccess server, and allows you to deploy DirectAccess in a few easy steps.

For information about alternate deployment paths, see DirectAccess Deployment Paths in Windows Server.

Important

To deploy DirectAccess using this guide, you must use a DirectAccess server that is running Windows Server® 2012 R2 or Windows Server® 2012.

Before you begin deploying, see the list of unsupported configurations, known issues, and prerequisites

You can use the following topics to review prerequisites and other information before you deploy DirectAccess with Windows Server® 2012 R2 and Windows Server® 2012.

Scenario description

In this scenario a single computer running either Windows Server 2012 R2 or Windows Server 2012 is configured as a DirectAccess server in a few easy steps.

In the simple scenario, DirectAccess is set up with default settings in a few easy wizard steps, without any need to configure infrastructure settings such as a certification authority (CA) or Active Directory security groups.
If you want to configure an advanced deployment with custom settings, see Deploy a Single DirectAccess Server with Advanced Settings
If you want to configure DirectAccess with enterprise features such as a load-balanced cluster, multisite deployment, or two-factor client authentication, complete the scenario described in this topic to set up a single server, and then set up the required enterprise scenario using Deploy Remote Access in an Enterprise.

In this scenario

To set up a simple DirectAccess server, several planning and deployment steps are required.

Prerequisites

Before you begin deploying this scenario, review this list for important requirements:

Windows firewall must be enabled on all profiles

This scenario is only supported when your client computers are running Windows® 8.1 and Windows® 8.

ISATAP in the corporate network is not supported. If you are using ISATAP, you should remove it and use native IPv6.

A Public Key Infrastructure is not required.

Not supported for deploying two factor authentication. Domain credentials are required for authentication.

Automatically deploys DirectAccess to all mobile computers in the current domain.

Traffic to Internet does not go over the DirectAccess tunnel. Force tunnel configuration is not supported.

DirectAccess server is the Network Location Server.

Network Access Protection (NAP) is not supported.

Changing policies outside of the DirectAccess management console or PowerShell cmdlets is not supported.

To deploy multisite, now or in the future, first Deploy a Single DirectAccess Server with Advanced Settings.

Planning steps

Planning is divided into two phases:

Planning for the DirectAccess infrastructure—This phase describes the planning required to set up the network infrastructure before beginning the DirectAccess deployment. It includes planning the network and server topology, and the DirectAccess network location server.
Planning for the DirectAccess deployment—This phase describes the planning steps required to prepare for the DirectAccess deployment. It includes planning for DirectAccess client computers, server and client authentication requirements, VPN settings, infrastructure servers, and management and application servers.

For detailed planning steps, see Plan an Advanced DirectAccess Deployment.

Deployment steps

Deployment is divided into three phases:

Configuring the DirectAccess infrastructure—This phase includes configuring network and routing, configuring firewall settings if required, configuring certificates, DNS servers, Active Directory and GPO settings, and the DirectAccess network location server.
Configuring DirectAccess server settings—This phase includes steps for configuring DirectAccess client computers, the DirectAccess server, infrastructure servers, management and application servers.
Verifying the deployment—This phase includes steps to verify that the deployment is working as required.

For detailed deployment steps, see Install and Configure Basic DirectAccess.

Practical applications

Deploying a single Remote Access server provides the following:

Ease-of-access—You can configure managed client computers running Windows 8.1, Windows 8, and Windows® 7 as DirectAccess clients. These clients can access internal network resources via DirectAccess any time they are located on the Internet without needing to log in to a VPN connection. Client computers that are not running one of these operating systems can connect to the internal network by using traditional VPN connections.
Ease-of-management—DirectAccess client computers located on the Internet can be remotely managed by Remote Access administrators over DirectAccess, even when the client computers are not located in the internal corporate network. Client computers that do not meet corporate requirements can be remediated automatically by management servers. Both DirectAccess and VPN are managed in the same console and with the same set of wizards. Additionally, one or more Remote Access servers can be managed from a single Remote Access Management console

Roles and features included in this scenario

The following table lists the roles and features required for the scenario:

Role/feature	How it supports this scenario
Remote Access role	The role is installed and uninstalled using the Server Manager console or Windows PowerShell. This role encompasses both DirectAccess, which was previously a feature in Windows Server 2008 R2, and Routing and Remote Access Services which was previously a role service under the Network Policy and Access Services (NPAS) server role. The Remote Access role consists of two components: DirectAccess and Routing and Remote Access Services (RRAS) VPN—DirectAccess and VPN are managed together in the Remote Access Management console. RRAS Routing—RRAS routing features are managed in the legacy Routing and Remote Access console. The Remote Access Server Role is dependent on the following server roles/features: Internet Information Services (IIS) Web Server – This feature is required to configure the network location server on the Remote Access server, and the default web probe. Windows Internal Database—Used for local accounting on the Remote Access server.
Remote Access Management Tools feature	This feature is installed as follows: It is installed by default on a Remote Access server when the Remote Access role is installed, and supports the Remote Management console user interface and Windows PowerShell cmdlets. It can be optionally installed on a server not running the Remote Access server role. In this case it is used for remote management of a Remote Access computer running DirectAccess and VPN. The Remote Access Management Tools feature consists of the following: Remote Access GUI Remote Access module for Windows PowerShell Dependencies include: Group Policy Management Console RAS Connection Manager Administration Kit (CMAK) Windows PowerShell 3.0 Graphical Management Tools and Infrastructure

Remote Access role

The role is installed and uninstalled using the Server Manager console or Windows PowerShell. This role encompasses both DirectAccess, which was previously a feature in Windows Server 2008 R2, and Routing and Remote Access Services which was previously a role service under the Network Policy and Access Services (NPAS) server role. The Remote Access role consists of two components:

DirectAccess and Routing and Remote Access Services (RRAS) VPN—DirectAccess and VPN are managed together in the Remote Access Management console.
RRAS Routing—RRAS routing features are managed in the legacy Routing and Remote Access console.

The Remote Access Server Role is dependent on the following server roles/features:

Internet Information Services (IIS) Web Server – This feature is required to configure the network location server on the Remote Access server, and the default web probe.
Windows Internal Database—Used for local accounting on the Remote Access server.

Remote Access Management Tools feature

This feature is installed as follows:

It is installed by default on a Remote Access server when the Remote Access role is installed, and supports the Remote Management console user interface and Windows PowerShell cmdlets.
It can be optionally installed on a server not running the Remote Access server role. In this case it is used for remote management of a Remote Access computer running DirectAccess and VPN.

The Remote Access Management Tools feature consists of the following:

Remote Access GUI
Remote Access module for Windows PowerShell

Dependencies include:

Group Policy Management Console
RAS Connection Manager Administration Kit (CMAK)
Windows PowerShell 3.0
Graphical Management Tools and Infrastructure

Hardware requirements

Hardware requirements for this scenario include the following:

Server requirements:
- A computer that meets the hardware requirements for Windows Server 2012 R2 or Windows Server 2012.
- The server must have at least one network adapter installed, enabled, and connected to the internal network. When two adapters are used, there should be one adapter connected to the internal corporate network, and one connected to the external network (Internet, or private network).
- At least one domain controller. The Remote Access server and DirectAccess clients must be domain members.
Client requirements:
- A client computer must be running Windows 8.1 or Windows 8.
  
  Important
  
  If some or all of your client computers are running Windows 7, you must use the Advanced Setup Wizard. The Getting Started Setup Wizard described in this document does not support client computers that are running Windows 7. See Deploy a Single DirectAccess Server with Advanced Settings for instructions on how to use Windows 7 clients with DirectAccess.
  
  Note
  
  Only the following operating systems can be used as DirectAccess clients: Windows® 8.1 Enterprise, Windows Server 2012 R2, Windows Server 2012, Windows® 8 Enterprise, Windows Server 2008 R2, Windows 7 Enterprise, and Windows 7 Ultimate.
Infrastructure and management server requirements:
- If VPN is enabled and a static IP address pool is not configured, you must deploy a DHCP server to allocate IP addresses automatically to VPN clients.
A DNS server running Windows Server 2008 SP2; Windows Server 2008 R2; or Windows Server 2012 is required.

Software requirements

There are a number of requirements for this scenario:

Server requirements:
- The Remote Access server must be a domain member. The server can be deployed at the edge of the internal network, or behind an edge firewall or other device.
- If the Remote Access server is located behind an edge firewall or NAT device, the device must be configured to allow traffic to and from the Remote Access server.
- The person deploying remote access on the server requires local administrator permissions on the server, and domain user permissions. In addition, the administrator requires permissions for the GPOs used in DirectAccess deployment. To take advantage of the features that restricts DirectAccess deployment to mobile computers only, permissions to create a WMI filter on the domain controller are required.
Remote Access client requirements:
- DirectAccess clients must be domain members. Domains containing clients can belong to the same forest as the Remote Access server, or have a two-way trust with the Remote Access server forest.
- An Active Directory security group is required to contain the computers that will be configured as DirectAccess clients. If a security group is not specified when configuring DirectAccess client settings, by default the client GPO is applied on all laptop computers in the Domain Computers security group. Only the following operating systems can be used as DirectAccess clients: Windows Server 2012, Windows Server 2008 R2, Windows 8 Enterprise, Windows 7 Enterprise, and Windows 7 Ultimate.

Content type	References
Remote Access on TechNet	Remote Access TechCenter
Product evaluation	Test Lab Guide: Demonstrate DirectAccess in a Cluster with Windows NLB Test Lab Guide: Demonstrate a DirectAccess Multisite Deployment Test Lab Guide: Demonstrate DirectAccess with OTP Authentication and RSA SecurID
Tools and settings	Remote Access PowerShell cmdlets
Community resources	DirectAccess Wiki entries
Related technologies	How IPv6 works

Udostępnij za pośrednictwem