Configuration for directAccess and VPN

Question

Hi:&nbsp;When I open server manager, I see a yellow ! point, when I check I see that configuration required for DirectAccess and VPN (RAS) at aestone. I click on configuration and get the following error message:Initializing operations before applying configurationPreparing to apply configuration changes...Backing up GPOs...Configuring Remote Access settingsRetrieving server GPO details...Clearing existing stale configuration settings. This might take a few minutes...Checking the specified adapters...Deploying the Remote Access server behind NAT...Checking the network location server certificate...Checking the specified adapters...Checking for a native IPv6 deployment...Verifying the IP-HTTPS certificate...Creating a DNS entry for the network location server certificate...Generating a self-signed network location server certificate on server aestone.stoneandstone1.com...Retrieving internal network DNS settings...Verifying the GPO to write settings...Creating the GPO. Linking the GPO to the domain...Checking for a client GPO to write settings...Creating the GPO. Linking the GPO to the domain...Checking for permissions to apply DirectAccess client policies to the GPO...Identifying all domains...Identifying infrastructure servers in domain stoneandstone1.com...Registering the DNS entry used to check client connectivity...Registering the web probe in DNS...Clearing existing stale configuration settings...Creating DirectAccess client policies...Updating client policies...Initializing accounting settings...Writing settings to the server GPOs...Writing settings to the client GPOs...Updating local settings...Applying GPOs on the Remote Access servers...Adding DirectAccess NRPT settingsRetrieving server GPO details...Opening the server GPO...Opening the client GPOs...Checking for edit permissions on the client GPOs...Error: The DNS suffix directaccess-nls.stoneandstone1.com already exists in client GPO stoneandstone1.com\DirectAccess Client Settings.Finishing operations after applying configurationInformation: Attempting to roll back the configuration...How do I fix this? Allen

jamony · Answer

You are not failing on the VPN role itself; the deployment is rolling back because the DirectAccess client GPO already contains an NRPT namespace for directaccess-nls.stoneandstone1.com. That means the wizard is encountering configuration left by an earlier or partial DirectAccess deployment. Before changing anything, back up the DirectAccess GPOs in Group Policy Management and confirm whether any clients still use the deployment. Open DirectAccess Client Settings, inspect Computer Configuration &gt; Policies &gt; Windows Settings &gt; Name Resolution Policy, and identify the existing directaccess-nls rule. If it belongs to the active deployment, reuse the existing GPO rather than creating another. If it is demonstrably orphaned, remove only that duplicate namespace entry, allow AD and SYSVOL replication to complete, run gpupdate /force on the Remote Access server, then rerun the wizard. Do not delete the whole GPO unless the deployment is being intentionally rebuilt.

aestone · Answer

Hi:&nbsp;Thanks for the response, I appreciate it, Allen

aestone · Answer

Hi:&nbsp;Thanks for the response, I will attempt the fix and let you know what happens, on another note, I have another problem I see schannel errors in the event log and I get the following:&nbsp;No suitable default server credential exists on this system. This will prevent server applications that expect to make use of the system default credentials from accepting SSL connections. An example of such an application is the directory server. Applications that manage their own credentials, such as the internet information server, are not affected by this.The SSPI client process is lsass (PID: 2092). Can you tell me how to fix this? thanks, Allen

Forum Discussion

Configuration for directAccess and VPN

3 Replies