1. Troubleshooting DirectAccess Clients Step by Step
Basic troubleshooting steps are shown in order on the next slides to assist from basic misconfigurations to more advanced problems. These steps are to be used when you have one or more DirectAccess clients that cannot connect. Written by : Tom Daniels Version 1.3

2. Make sure the client has DirectAccess GPOs (Step 1)
Check with rsop.msc or gpresult /r

3. Make sure the client has DirectAccess GPOs (Step 1)
This can occur when DA computer is not added to the security group or in the wrong OU not being targeted by the DirectAccess Client GPO
If you’ve recently added the computer to a security group, it does require a reboot to pick up the new group membership. When in doubt, reboot the computer to ensure it has proper group membership

4. DA Client must think it’s on the Internet (Step 2)
Check status of NCSI to make sure computer thinks it’s on the Internet

5. DA Client must think it’s on the Internet (Step 2)
Windows OS uses Network Connectivity Status Indicator (NCSI) to determine Internet connectivity.
Check icon to make sure it doesn’t have any warnings or errors
Ensure NCSI in OS can reach
Some Internet connections require a proxy server
Most public Internet connections have a splash page you need to logon to reach Internet resources

6. Check to see if DA client is disconnected (Step 3)
See if DA Client has been manually disconnected

7. Check to see if DA client is disconnected (Step 3)
It’s possible to manually disconnect a DirectAccess client by selecting “use local DNS resolution” with the DirectAccess Connectivity Assistant (DCA) on Windows 7
On Windows 8, the disconnect option can be selected on a DirectAccess connection to manually disconnect the DirectAccess client connection.

8. Check network profile (Step 4)
This needs to be public or home for most DA installs to work properly

9. Check network profile (Step 4)
This controls what firewall profile will apply
Some environments disable the work firewall profile which can break DirectAccess if a user selects work when presented with a new network connection.

10. Check key services on DirectAccess Client (Step 5)
Make sure key services are running on DirectAccess client

11. Check key services on DirectAccess Client (Step 5)
IP Helper must be running in order for the IPv6 transition adapters to load (Terero, 6to4, IP-HTTPS)
The Windows Firewall service must also be running for the DirectAccess clients to negotiate IPsec correctly
The IKE and AuthIP IPsec Keying Modules service must be running in order for machines to properly communicate using IPsec which is required for DirectAccess
The Network Connectivity Assistant is used on Windows 8+ systems to show DirectAccess Status

12. Check Windows firewall profile (Step 6)
Check Windows firewall profile is enabled for Public and Private profiles using wf.msc or netsh adv sh pub and netsh adv sh priv

13. Check Windows firewall profile (Step 6)
Not only does the Windows firewall service need to be running, the profile in the Windows Firewall for public and private needs to be enabled. If disabled, this will prevent IPsec from working correctly on the DA client.

14. Check DNS Suffix Search Order (Step 7)
The DA client needs to have the correct DNS suffix search orders listed. Check at top of ipconfig /all

15. Check DNS Suffix Search Order (Step 7)
Most users expect to get to resources by short name. If the DNS Suffix search order is blank or not complete this can cause issues
If you suspect a problem with the DNS Suffix search order, try to reach the same resources by FQDN instead and see if it works

16. Check NRPT Settings (Step 8)
Check to make sure the Name Resolution Policy Table (NRPT) has the correct domain/hostnames listed by running netsh na sh po

17. Check NRPT Settings (Step 8)
The NRPT controls what DNS names the DA client is able to resolve across DirectAccess. It’s critical to ensure the domain(s)/hostname(s) the client is trying to resolve appear in the NRPT
For domain/hostnames that should be resolved across DA, make sure the correct IPv6 address of the DA server appears (usually contains a “3333” IPv6 address)
If the NRPT is blank and you’ve confirmed the DirectAccess Clients GPO has applied, then you are running Windows 7/8/8.1 Professional or Home Edition. DirectAccess requires you are running Enterprise or Ultimate Edition of Windows :

18. Check DA Client certificate (Step 9)
Check for a computer certificate using either certutil –store my or looking in the local computer certificate store in mmc

19. Check DA Client certificate (Step 9)
During most installs, a computer certificate is required especially if Windows 7 DA clients exist. Only exception is a Windows 8 only DA deployment which can use Kerberos.
Check to make sure subject name of certificate matches the name of the computer
Look at validity period, needs to be within this period
Review Extended Key Usage (EKU) on certificate to ensure it lists at least Client Authentication
Ensure the client certificate is not listed in the Certificate Revocation List (CRL)

20. Check computer account in AD (Step 10)
Check domain controller for computer account to make sure on exists and it’s not disabled

21. Check the status of the IP-HTTPS connection (Step 11)
You can run the following command on your DirectAccess client to check the state of the IP-HTTPS adapter : netsh int https show int You will get an output that will show the current state of the connection. A good connection should show error code 0×0 like below :

22. Check the status of the IP-HTTPS connection (Step 11)
If you get any other error code besides 0x0, then you have an issue with the IP-HTTPS negotiation between the DirectAccess client and DirectAccess server. I’ve posted some of my previous troubleshooting articles for more common specific IP-HTTPS error codes : 0x2af9 = 0x2afc = 0x4be = 0x32 = 0x34 = 0x = 0x643 = 0x274c =