Seen on Windows Server 2012, when configuring direct access, while running the ‘Getting Started Wizard’ you have to choose the network topology. You have a choice of edge, behind an edge device (with 1 NIC), or behind an edge device (with 2 NICs). Each choice you make will present you with one of the following errors.
An external adapter with a public IP address, IPv6 enabled and without a domain profile cannot be located.
An internal adapter with a valid IP address, DNS settings and a domain profile cannot be located.
An internal adapter with a valid IP address, IPv6 enabled, DNS settings and a domain profile cannot be located.
Solution
The reason you are getting this error is because the network card (or cards) in this server are NOT set with a domain profile, in my case it had been set to public (which was confusing as this was a domain controller).
The fix is a little unusual, and why it works I have no idea, but it worked for me.
1. Windows Key+R > ncpa.cpl {Enter} > Right click the NIC > Properties > REMOVE the tick from IPv6 > OK > Then RETICK IPv6 > OK.
2. Now if you look in ‘Network and Sharing Center’ you will see it labelled as ‘Domain network’. The wizard should now proceed without error.
Related Articles, References, Credits, or External Links
In the following procedure I’m using Window Server 2012, and Windows 8 Enterprise, I am NOT configuring for Windows 7 so I don’t need to worry about PKI and certificates. (Other than the one the direct access server uses for https identification).
I’m not adding in any Application or Infrastructure servers, this is just a basic run through on setting up Direct Access to get you up and running.
Solution
Step 1 Create Direct Access Group
You can of course accept the default of allowing access to the domain computers group, but I would like to tie things down a little further.
1. Server Manager> Tools > Active Directory Administrative Center > Select the OU (or create one) where you want to create the group.
2.Give the group a sensible name like DirectAccessComputers.
3. Remember when you try and ‘add’ members it will by default NOT have computers listed you will need to add them in.
6. Or from Server Manager > Tools > Add Roles and Features.
7. Simply add in ‘Remote Access’ and accept all the defaults.
Step 3 Configure Remote Access
8. Once installed launch Remote Access Management.
9. Run the getting stated wizard.
10. Deploy Remote Access Only (I’m not deploying VPNs).
11. Select how the server will be deployed, mine has a single NIC and I’m going to port forward TCP Port 443 (https) to it from the firewall. Enter its Publicly addressable name > Next > Finish.
14. Remove the domain computers and add in the group we created above. Untick the ‘mobile only’ option.
Note: Force Tunnelling means that the remote clients will access the internet though YOUR corporate network. This is only a good idea if you have internet filtering, AV or NAP that you want to take advantage of. (It’s literally the exact opposite of split tunnelling).
15. Remote Access Server > Edit.
16. Select an existing Cert or create a new one > Next.
17. Remember I’m just using Windows 8, if you see the Windows 7 box and think “ooh I’ll tick that!” Then you need to start using certificates > Finish.
18. Finish.
19. Review the settings > Apply.
20. Operation Status.
21. Press Refresh until all the services are green.
Step 4 Configure Clients
The title is a misnomer and to be honest there is no configuration to be done, but they have to get the settings through group policy, so log then onto the domain.
22. A quick simple check is to run the following command;
[box]
Get-DaConnectionStatus[/box]
Note: If you get an error message make sure you are not using Windows 8 Pro see here.
23. The client knows it’s ‘inside’ the LAN, because it has a Name Resolution Policy Table and it can see your internal DNS, you can prove this with the following command;
[box] Get-DNSClientNrptPolicy[/box]
Step 5 Test Clients Externally
Note: Before you proceed your Direct access server needs to be publicly available via the name you specified on the certificate in step 11, and needs to have https open to it.
25. Whilst out on the internet you can test your remote client by first making sure it’s pointing to the correct place;
[box]netsh interface httpstunnel show interface[/box]
This should give the the URL that is on the certificate you specified in step 11, when you ping it by name you should expect a reply (unless ICMP has been blocked by your edge device).
26. And to prove that the client knows it’s NOT on the corporate LAN execute the following;
[box]netsh dnsclient show state[/box]
27. So If i try to ping the internal FQDN of my Direct Access server it should respond (Note its IPv6 address will respond this is normal).
Note: Here I’ve only setup the one server, you can add more Infrastructure and Application servers in the Remote Access Management Console.
28. Because I can resolve that, I can access resources on that server like UNC paths.
29. To access shared resources.
Step 6 Monitoring Remote Access Clients
30. Back on the Direct Access server, you can see the remote clients under ‘Remote Client Status’.
31. Right click each one for a more detailed view.
Related Articles, References, Credits, or External Links
When attempting to check Direct Access connection status on a Windows 8 client machine with a Get-DaConnectionStatus command you see the following error;
Get-DaConnectionStatus : Network Connectivity Assistant service is stopped or not responding.
OK, so lets go and check the status of that service, if it starts great, but mine did not as you can see.
And it logged an Event ID 7024
The Network Connectivity Assistant service terminated with the following service-specific error:
The request is not supported.
Note: This will also happen if you have not configured Remote Access properly on your server, and the client has not got the necessary group policies applied, so make sure that’s discounted first!
Solution
In my case the problem was a little more obscure, it seems this will not work on Windows 8 (Professional), to check your version simply run msinfo32;
Windows 8 Professional
Windows 8 Enterprise
Try the same this on a Windows 8 (Enterprise) client and it will run without error.
Related Articles, References, Credits, or External Links
