Configuration for directAccess and VPN

You are not failing on the VPN role itself; the deployment is rolling back because the DirectAccess client GPO already contains an NRPT namespace for directaccess-nls.stoneandstone1.com. That means the wizard is encountering configuration left by an earlier or partial DirectAccess deployment. Before changing anything, back up the DirectAccess GPOs in Group Policy Management and confirm whether any clients still use the deployment. Open DirectAccess Client Settings, inspect Computer Configuration > Policies > Windows Settings > Name Resolution Policy, and identify the existing directaccess-nls rule. If it belongs to the active deployment, reuse the existing GPO rather than creating another. If it is demonstrably orphaned, remove only that duplicate namespace entry, allow AD and SYSVOL replication to complete, run gpupdate /force on the Remote Access server, then rerun the wizard. Do not delete the whole GPO unless the deployment is being intentionally rebuilt.