1 / 22

Troubleshooting DirectAccess Clients Step by Step

Troubleshooting DirectAccess Clients Step by Step.

gil
Download Presentation

Troubleshooting DirectAccess Clients Step by Step

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Troubleshooting DirectAccess Clients Step by Step Basic troubleshooting steps are shown in order on the next slides to assist from basic misconfigurations to more advanced problems. These steps are to be used when you have one or more DirectAccess clients that cannot connect.Written by : Tom Danielstomdan@outlook.comwww.DirectAccessGuide.comVersion 1.2

  2. Make sure the client has DirectAccess GPOs (Step 1) • Check with rsop.mscor gpresult /r

  3. Make sure the client has DirectAccess GPOs (Step 1) • This can occur when DA computer is not added to the security group or in the wrong OU not being targeted by the DirectAccess Client GPO • If you’ve recently added the computer to a security group, it does require a reboot to pick up the new group membership. When in doubt, reboot the computer to ensure it has proper group membership

  4. DA Client must think it’s on the Internet (Step 2) • Check status of NCSI to make sure computer thinks it’s on the Internet

  5. DA Client must think it’s on the Internet (Step 2) • Windows OS uses Network Connectivity Status Indicator (NCSI) to determine Internet connectivity. • Check icon to make sure it doesn’t have any warnings or errors • Ensure NCSI in OS can reach www.msftncsi.com/ncsi.txt • Some Internet connections require a proxy server • Most public Internet connections have a splash page you need to logon to reach Internet resources

  6. Check to see if DA client is disconnected (Step 3) • See if DA Client has been manually disconnected

  7. Check to see if DA client is disconnected (Step 3) • It’s possible to manually disconnect a DirectAccess client by selecting “use local DNS resolution” with the DirectAccess Connectivity Assistant (DCA) on Windows 7 • On Windows 8, the disconnect option can be selected on a DirectAccess connection to manually disconnect the DirectAccess client connection.

  8. Check network profile (Step 4) • This needs to be public or home for most DA installs to work properly

  9. Check network profile (Step 4) • This controls what firewall profile will apply • Some environments disable the work firewall profile which can break DirectAccess if a user selects work when presented with a new network connection.

  10. Check key services on DirectAccess Client (Step 5) • Make sure key services are running on DirectAccess client

  11. Check key services on DirectAccess Client (Step 5) • IP Helper must be running in order for the IPv6 transition adapters to load (Terero, 6to4, IP-HTTPS) • The Windows Firewall service must also be running for the DirectAccess clients to negotiate IPsec correctly • The IKE and AuthIP IPsec Keying Modules service must be running in order for machines to properly communicate using IPsec which is required for DirectAccess • The Network Connectivity Assistant is used on Windows 8+ systems to show DirectAccess Status

  12. Check Windows firewall profile (Step 6) • Check Windows firewall profile is enabled for Public and Private profiles using wf.msc or netshadvsh pub and netshadvshpriv

  13. Check Windows firewall profile (Step 6) • Not only does the Windows firewall service need to be running, the profile in the Windows Firewall for public and private needs to be enabled. If disabled, this will prevent IPsec from working correctly on the DA client.

  14. Check DNS Suffix Search Order (Step 7) • The DA client needs to have the correct DNS suffix search orders listed. Check at top of ipconfig /all

  15. Check DNS Suffix Search Order (Step 7) • Most users expect to get to resources by short name. If the DNS Suffix search order is blank or not complete this can cause issues • If you suspect a problem with the DNS Suffix search order, try to reach the same resources by FQDN instead and see if it works

  16. Check NRPT Settings (Step 8) • Check to make sure the Name Resolution Policy Table (NRPT) has the correct domain/hostnames listed by running netshnashpo

  17. Check NRPT Settings (Step 8) • The NRPT controls what DNS names the DA client is able to resolve across DirectAccess. It’s critical to ensure the domain(s)/hostname(s) the client is trying to resolve appear in the NRPT • For domain/hostnames that should be resolved across DA, make sure the correct IPv6 address of the DA server appears (usually contains a “3333” IPv6 address) • If the NRPT is blank and you’ve confirmed the DirectAccess Clients GPO has applied, then you are running Windows 7/8/8.1 Professional or Home Edition. DirectAccess requires you are running Enterprise or Ultimate Edition of Windows : http://support.microsoft.com/kb/2756536

  18. Check DA Client certificate (Step 9) • Check for a computer certificate using either certutil –store my or looking in the local computer certificate store in mmc

  19. Check DA Client certificate (Step 9) • During most installs, a computer certificate is required especially if Windows 7 DA clients exist. Only exception is a Windows 8 only DA deployment which can use Kerberos. • Check to make sure subject name of certificate matches the name of the computer • Look at validity period, needs to be within this period • Review Extended Key Usage (EKU) on certificate to ensure it lists at least Client Authentication • Ensure the client certificate is not listed in the Certificate Revocation List (CRL)

  20. Check computer account in AD (Step 10) • Check domain controller for computer account to make sure on exists and it’s not disabled

  21. Check the status of the IP-HTTPS connection (Step 11) • You can run the following command on your DirectAccess client to check the state of the IP-HTTPS adapter : netshint https show intYou will get an output that will show the current state of the connection. A good connection should show error code 0×0 like below :

  22. Check the status of the IP-HTTPS connection (Step 11) • If you get any other error code besides 0x0, then you have an issue with the IP-HTTPS negotiation between the DirectAccess client and DirectAccess server. I’ve posted some of my previous troubleshooting articles for more common specific IP-HTTPS error codes :0x2af9 = http://directaccessguide.com/2013/08/05/getting-ip-https-error-code-0x2af9/0x2afc = http://directaccessguide.com/2013/08/21/getting-ip-https-error-code-0x2afc/0x4be = http://directaccessguide.com/2013/09/04/getting-ip-https-error-code-0x4be/0x32 = http://directaccessguide.com/2014/04/11/getting-ip-https-error-code-0x32/ 0x34 = http://directaccessguide.com/2014/05/02/getting-ip-https-error-code-0x34/0x80090326 = http://directaccessguide.com/2014/06/01/getting-ip-https-error-code-0x800903260x643 = http://directaccessguide.com/2014/06/11/getting-ip-https-error-code-0x643/

More Related