So as we're talking about Windows Always On VPN,
you might be asking yourself, what happened to DirectAccess?
Has it gone away?
The answer is no, it hasn't.
And in fact, DirectAccess is included in Windows Server 2022 and Windows 11,
the latest releases of the server and client operating system from Microsoft.
However,
DirectAccess has had no new features or functionalities added since 2012.
So even though it's in the latest version of Windows,
it is still very much an old, or legacy,
technology.
It has been not formally deprecated,
but it is functionally end of life because quite clearly
Microsoft is no longer investing in DirectAccess.
They are putting all of their effort and energy into
developing the Microsoft Always On VPN solution.
So as Microsoft is moving away from DirectAccess in favor of Always On VPN,
let's take a look at a few things that might have led to its demise.
So first of all, DirectAccess requires domain join for both clients and servers.
And when I say domain join,
I'm talking about classic or legacy on‑premises Active Directory.
Endpoints had to be Enterprise edition only,
although Education would work, but fundamentally,
Enterprise edition rules out things like Professional or Home.
DirectAccess was managed exclusively using on‑premises
Active Directory and Group Policy and, again,
is an Active Directory only solution.
And when I say Active Directory,
I mean the classic or legacy on‑premises Active Directory.
By contrast, Always On VPN, domain join is optional,
so there's no longer a hard requirement for your servers or
your clients to be joined to the domain.
This means you can implement servers and services that are not domain join,
your clients don't have to be domain join,
and they can still maintain single sign‑on to on‑premises resources.
In addition, Always On VPN does support both Enterprise and Professional edition.
Always On VPN is managed using Microsoft Endpoint
Manager or any third‑party MDM.
It leverages modern management capabilities that are
integrated into Microsoft's cloud.
And finally, Always On VPN supports integration with classic Active Directory,
but it also supports integration with modern authentication
methods using Azure Active Directory as well.
And so ultimately,
it's the lack of these advanced cloud integration features and
capabilities and modern authentication and management that's
really led to the demise of DirectAccess.
So Always On VPN offers some additional benefits over DirectAccess.
For example, IPv6 is optional in Always On VPN,
whereas DirectAccess, IPv6 was required and,
in fact, used exclusively,
so a lot of applications that used IPv4 would not function over DirectAccess.
That's not a problem going forward and Always On VPN.
In addition,
trusted network detection is handled a little bit differently and Always On VPN.
So there's no more network location server.
The NLS was the bane of the DirectAccess administrator's life.
If it didn't work correctly, it could cause some serious problems.
That is a thing of the past with Always On VPN.
In addition, since Always On VPN uses IPv4,
which is more widely deployed than IPv6 on most enterprise networks today,
outbound management is much easier and simpler.
You simply connect to this IPv4 address as you would any
other network or host on your network.
And finally, Always On VPN is infrastructure independent,
which gives administrators a lot more flexibility in terms of deployment,
and it also removes some of the interdependencies that
could cause support issues and troubleshooting challenges with DirectAccess in the past.