Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows 7 Direct Access is a feature that enables safe direct access to a network without using third party software.

What are its requirements and how do you set up this feature?

share|improve this question
great question. this is one many are wondering about – dr.pooter Jun 15 '09 at 6:08

DirectAccess requirements

  • One or more DirectAccess servers running Windows Server 2008 R2 with two network adapters: one that is connected directly to the Internet, and a second that is connected to the intranet.
  • On the DirectAccess server, at least two consecutive, public IPv4 addresses assigned to the network adapter that is connected to the Internet.
  • DirectAccess clients running Windows 7.
  • At least one domain controller and Domain Name System (DNS) server running Windows Server 2008 or Windows Server 2008 R2. When smart card-based authentication is required for end-to-end protection, you must use Active Directory Domain Services (AD DS) in Windows Server 2008 R2.
  • A public key infrastructure (PKI) to issue computer certificates, smart card certificates, and, for NAP, health certificates. For more information, see
  • IPsec policies to specify protection for traffic. For more information, see
  • IPv6 transition technologies available for use on the DirectAccess server: ISATAP, Teredo, and 6to4.
share|improve this answer
Clients supported for Direct Access are Windows 7 Ultimate/Enterprise and Windows 2008R2 – David Yu Jun 15 '11 at 21:43

This feature does look to rock. Should see a decline in SSL VPN sales I would think...

Technical Overview of DirectAccess in Windows 7 and Windows Server 2008 R2

share|improve this answer

To configure DirectAccess (DA), you can see the answer provided by vzczc to see what is needed. Once you have the systems and infrastructure in place you need to do the following:

Prepare AD/DNS

  1. Create a security group for computers that will be DA clients
  2. Create a DNS host record for the Network Location Server for intranet DA clients.
  3. Create a DNS host record for the server that hosts the certificate revocation list (CRL) in the intranet.
  4. On public DNS create a DNS host record for the host that will provide access to the CRL for internet based DA clients.

Configure your PKI environment

  1. Add/configure CA server role
  2. Configure CRL distribution settings
  3. Publish the CRL to designated intranet location
  4. Create certificate template and configure security settings on the template so Authenticated Users can enroll the certificate
  5. Distribute the computer certificates (this can be done via GPO and auto-enrollment)

Configure DA clients

  1. Verify DA clients have computer cert required for DA authentication
  2. Verify clients can connect to intranet resources

Configure DA server

  1. Install two NIC in DA server
  2. Install web server role on DA server
  3. Create a virtual directory to host the CRL
  4. Publish the CRL to the virtual directory
  5. Install DA Management Console feature
  6. Run DA Management wizard to configure DA

The Network Location Server functionality is used by the DA clients to determine if they are on the intranet. Depending on the response (or non-response) of the Network Location Server, the DA client will institute the profiles and rules appropriate for DA or non-DA (intranet) access.

The Network Location Server can run on the DA server, it needs the web server role to function.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.