Background: We have DA, single site config. Enterprise PKI with Offline Root and online Intermediate CA (Intermediate CA used to issue Computer Certs to clients for DA). The Intermediate CA's cert is expiring, and we have issued a new Intermediate Cert. That cert has propagated across the enterprise and is in the trusted intermediate store for all domain joined clients, servers, including DA servers, etc. Both the old and new Intermediate Certs are valid and in clients Intermediate Trusted CA stores.
Problem: Direct Access servers show IPSec error as the configuration still has the old Intermediate CA Certificate in it and needs to be updated.
Question: What is the impact to DA clients once we switch over in that configuration? I understand it will update GPO and clients will get that GPO, but will it immediately break DA clients until they get a GP Update, or will this change not impact client connectivity?