How to configure Direct Access on Windows Server 2022
|
Show
All posts in category Windows Server 2022Endpoint Manager and Intune Learning Resources for Always On VPN AdministratorsMicrosoft Endpoint Manager (MEM), formerly Intune, is the recommended solution for deploying and managing Windows Always On VPN client configuration settings. Always On VPN is designed for Mobile Device Management (MDM), with configuration settings deployed specifically to the VPNv2 Configuration Service Provider (CSP) interface. ResourcesGetting up to speed on all things MEM isn’t difficult at all. I’ve found the MEM community to be exceedingly helpful, and there are many available training resources in various formats from which to choose. BooksThe following is a list of Microsoft Endpoint Manager books Always On VPN administrators will find most helpful for learning about MEM.
YouTubeThe Intune Training channel on YouTube is an incredibly valuable resource for Always On VPN administrators learning MEM. Hosted by Steven Hosking, Adam Gross, and Ben Reader, there are countless videos covering important MEM configuration tasks. PluralsightPluralsight offers video training courses for a wide variety of IT-related topics. Recently I published the Implementing Always On VPN video training course. There are several Microsoft Endpoint Manager video training courses available as well. Pluralsight is available via subscription. You can sign up for a free trial here if you don’t have a subscription. ConferencesThe Midwest Management Summit (MMS) is the premier event for systems management professionals. Their annual conference takes place each spring in the U.S. (Minneapolis, MN). The event is the best place to learn about Microsoft Endpoint Manager and network with systems management professionals worldwide. Additional ResourcesAs a reminder, MEM topics such as certificate deployment and Always On VPN profile deployment and management are covered in detail in both my Implementing Always On VPN book and the Implementing Always On VPN video training course on Pluralsight. 😁 Posted in Always On VPN, Always On VPN Book, AOVPN, AOVPN Book, certificates, cloud, Conditional Access, Deployment, Device Management, device tunnel, DirectAccess Book, education, Endpoint Manager, Enterprise, Important Links, InTune, Intune Certificate Connector, Intune PFX Connector, learning, MDM, MEM, MEMCM, Microsoft Endpoint Manager, Microsoft Intune, Mobile Device Management, Mobility, Network Device Enrollment Service, Network Device Enrollment Services, OMA-DM, PFX Connector, public cloud, Recommended Reading, Remote Access, SCCM, SCEP, Security, Simple Certificate Enrollment Protocol, System Center 2012, System Center Configuration Manager, systems management, VPN, Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 Tagged Always On VPN, book, books, education, enterprise mobility, learning, MEM, MEMCM, Microsoft, Microsoft Endpoint Manager, Mobility, security, systems management, video training, VPN, Windows, Windows 10, Windows 11 Posted by Richard M. Hicks on June 30, 2022 https://directaccess.richardhicks.com/2022/06/30/endpoint-manager-and-intune-learning-resources-for-always-on-vpn-administrators/ Always On VPN Video Training Course on PluralsightImplementing Microsoft Windows Always On VPN, my latest video training course on Pluralsight is now available! This course provides comprehensive training for designing, implementing, and supporting a Windows Always On VPN solution. The course is nearly seven hours long (!) and covers all Always On VPN configuration aspects. The video training course covers the following Always On VPN topics.
The Implementing Always On VPN video training course is available to Pluralsight subscribers now. You can sign up for a free trial if you don’t have a subscription. Enjoy!
Additional InformationImplementing Microsoft Windows Always On VPN on Pluralsight Additional Video Training Courses on Pluralsight Sign Up for a Free Trial at Pluralsight Posted in administration, Always On VPN, AOVPN, device tunnel, education, Enterprise, enterprise mobility, InTune, learning, Mobility, Pluralsight, Remote Access, user tunnel, video, Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 Tagged Always On VPN, education, learning, Microsoft, Mobility, Pluralsight, security, training, video, video training, VPN, Windows, Windows 10, Windows 11, Windows Server, Windows Server 2016, Windows Server 2019, Windows Server 2022 Posted by Richard M. Hicks on June 21, 2022 https://directaccess.richardhicks.com/2022/06/21/always-on-vpn-video-training-course-on-pluralsight/ Certificate-Based Authentication Changes and Always On VPNMicrosoft introduced important changes affecting certificate-based authentication on Windows domain controllers as part of the May 10, 2022 update KB5014754 that may affect Always On VPN deployments. The update addresses privilege escalation vulnerabilities when a domain controller is processing a certificate-based authentication request. The recommendation from Microsoft is that the update be applied to all Windows domain controllers and Active Directory Certificate Services (AD CS) servers as soon as possible. Updated 5/20/2022: An out-of-band update to address authentication issues reported with this update is now available. Updates are available for Windows Server 2022, Windows Server 20H2, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2. Certificate ServicesAfter applying the update to certification authority (CA) servers, a non-critical extension with Object Identifier (OID) 1.3.6.1.4.1.311.25.2 is added to all issued certificates with the user or device security identifier (SID) included. Domain controllers with the update installed will use this information to validate the certificate used for authentication and ensure that it matches the information in Active Directory. Domain ControllersThe update operates in Compatibility Mode, by default, when applied to domain controllers. Windows monitors authentication requests and records audit events for certificates presented for authentication under the following conditions. No strong mapping (event ID 39) – The certificate has not been mapped explicitly to a domain account, and the certificate did not include the new SID extension. Certificate predates account (event ID 40) – A certificate was issued before the user existed in Active Directory, and no explicit mapping could be found. User’s SID does not match certificate (event ID 41) – A certificate contains the new SID extension, but it does not match the SID of the corresponding user account. Certificate MappingAdministrators can map certificates explicitly to accounts in Active Directory, but this results in a significant administrative burden in most environments. A better option is to reissue user and device authentication certificates after applying the KB5014754 update to all issuing CA servers. Reenroll CertificatesAdministrators should reissue user and device authentication certificates after applying the KB5014754 update. Open the Certificate Templates management console (certtmpl.msc), identify the user or device authentication certificate template, then right-click on the template and choose Reenroll All Certificate Holders. Enforcement ModeAfter applying update KB5014754, administrators should monitor domain controller event logs for event IDs 39, 40, and 41. Once all certificates have been updated, and none of these events have been recorded for 30 days, administrators can switch to Full Enforcement Mode by enabling it in the registry on all domain controllers. Key: HKLM\SYSTEM\CurrentControlSet\Services\KDC Note: Microsoft will automatically switch to Full Enforcement Mode beginning May 9, 2023. Known IssuesThere have been some reports of authentication issues after installing the KB5014754 update. Early indications are that device authentication certificates missing a Subject Alternative Name (SAN) entry are to blame. Administrators are encouraged to update their device certificates to include the SAN entry. Optionally, but not recommended, administrators can place the update in disabled mode by editing the registry. Note: An out-of-band update for these authentication issues is now available. See the reference links at the top of this article for more information. CaveatIt’s important to understand that this new OID is added only to online templates. Online templates are those that build the subject information from Active Directory. Unfortunately, this new OID is NOT applied to offline templates (templates where the subject name is supplied in the request), such as those used for delivering certificates with Microsoft Endpoint Manager/Intune using PKCS or SCEP. It is impossible to move to enforcement mode when issuing user or device authentication certificates with Microsoft Endpoint Manager or Intune today. Microsoft is aware of this limitation and is working to address this issue as we speak. I expect a fix to be available sometime before the May 2023 deadline when Microsoft permanently switches on enforcement mode. Additional InformationKB5014754 – Certificate-based authentication changes on Windows domain controllers Microsoft Windows Always On VPN Users Prompted for Certificate Microsoft Windows Always On VPN Clients Prompted for Authentication when Accessing Internal Resources Posted in Active Directory, administration, Always On VPN, AOVPN, authentication, certificates, device tunnel, EAP, Enterprise, enterprise mobility, extensible authentication protocol, Hotfix, Mobility, network policy server, Operational Support, PKI, public key infrastructure, Remote Access, routing and remote access service, RRAS, Security, TLS, troubleshooting, Update, VPN, Vulnerability, Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 Tagged AD CS, AD DS, Always On VPN, AOVPN, authentication, CA, certificate, certificate mapping, certificate services, certificate template, certificates, domain controller, enterprise mobility, hotfix, KB5014754, Microsoft, Mobility, OID, PKI, Remote Access, secure remote access, security, SID, template, update, Windows, Windows 10, Windows 11 Posted by Richard M. Hicks on May 16, 2022 https://directaccess.richardhicks.com/2022/05/16/certificate-based-authentication-changes-and-always-on-vpn/ Is Microsoft DirectAccess still supported?As of today, Microsoft has not announced the End of Life of DirectAccess and based on Microsoft's standard product life cycle, DirectAccess will be available and supported for many years to come. Always On VPN has many benefits over the Windows VPN solutions of the past.
What has replaced Microsoft DirectAccess?Windows 10 Always On VPN is the replacement for Microsoft's DirectAccess remote access technology. Always On VPN aims to address several shortcomings of DirectAccess, including support for Windows 10 Professional and non-domain joined devices, as well as cloud integration with Intune and Azure Active Directory.
What is DirectAccess in Windows Server?“DirectAccess provides users transparent access to internal network resources whenever they are connected to the Internet.” DirectAccess does not require any user intervention or any credentials to be supplied in order to connect. It can be thought of as if the machine makes the connection to internal resources.
How do I find my DirectAccess server?The DirectAccess NCA can be accessed by pressing the Windows Key + I and then clicking on Network & Internet and DirectAccess.
|
