Why DirectAccess shouldn't configured on Domain Controllers?

Kim Iseop
Kim Iseop used Ask the Experts™
on
I've configured DirectAccess on Windows Server 2016 DC. It correctly configured and deployed at first time after installing DA.
But I modified the NLS configuration and tried to apply configuration, I got "DirectAccess configuration settings stored in GPOs cannot be backed up. Verify network connectivity to the domain controller." error message.

|DC(also DirectAccess Server)|------|Router|------|Client on the Internet|
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
System Analyst
Commented:
AD DS requirements for DirectAccess

If the domain controller is on a perimeter network (and therefore reachable from the Internet-facing network adapter of the DirectAccess server), you must prevent the DirectAccess server from reaching it by adding packet filters on the domain controller to prevent connectivity to the IP address of the Internet adapter.
The DirectAccess server must be a domain member.
DirectAccess clients must be domain members. Clients can belong to:
Any domain in the same forest as the DirectAccess server.
Any domain that has a two-way trust with the DirectAccess server domain.
Any domain in a forest that has a two-way trust with the forest to which the DirectAccess domain belongs.

in simple word
 the DirectAccess server must be a domain member and cannot be a domain controller.
PberSolutions Architect

Commented:
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Accept: Tahir Qureshi (https:#a42052354)

If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

Pber
Experts-Exchange Cleanup Volunteer

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial