Manageability Not only does DirectAccess provide an enhanced end user experience, but also when using DirectAccess, Microsoft IT is better able to manage computer systems such as laptops that are frequently moved outside the corporate network. The key management benefits DirectAccess provides are described below. Remote Computer Management Systems that are not running DirectAccess are more of a challenge for Microsoft IT administrators to manage. When a laptop with Internet connectivity is running DirectAccess, the laptop is always connected to the corporate network. This "always on" connection promotes timely security scans, enables Helpdesk to "reach out" for remote assistance, simplifies updates to group policy, and allows the computer to pull down security and system updates as soon as they are required, even if the user is not logged on. This functionality gives Microsoft IT the opportunity to service remote machines on a regular basis and ensures that remote users stay up-to-date with company policies. Monitoring and Reporting Windows Server 2008 R2 provides built-in monitoring of the DirectAccess server and DirectAccess components through the DirectAccess Monitoring snap-in. The DirectAccess Monitoring snap-in provides the ability to monitor traffic activity, data, and control traffic counters and events for the different components of the DirectAccess server and the server's status. System Design This section of the document provides an overview of how DirectAccess works and discusses the underlying connectivity and security technologies that Microsoft IT has implemented as part of the DirectAccess system. Architecture The following figure illustrates the major components of the DirectAccess system. Figure 1. A schematic of Microsoft IT's DirectAccess implementation Connectivity The following technologies are used by DirectAccess to initiate and maintain a secure connection with the corporate network. IPv6 DirectAccess clients maintain constant connectivity with the intranet, and Internet Protocol version 6 (IPv6) provides the end-to-end addressing necessary to accomplish this. Clients establish an IPv6 tunnel to the DirectAccess server, which acts as a gateway to the internal network. The preceding figure shows a DirectAccess client connecting to a DirectAccess server across the public IPv4 Internet. Clients can connect from behind a firewall using one of the transition technologies listed below.
Manageability Not only does DirectAccess provide an enhanced end user experience, but also when using DirectAccess, Microsoft IT is better able to manage computer systems such as laptops that are frequently moved outside the corporate network. The key management benefits DirectAccess provides are described below. Remote Computer Management Systems that are not running DirectAccess are more of a challenge for Microsoft IT administrators to manage. When a laptop with Internet connectivity is running DirectAccess, the laptop is always connected to the corporate network. This "always on" connection promotes timely security scans, enables Helpdesk to "reach out" for remote assistance, simplifies updates to group policy, and allows the computer to pull down security and system updates as soon as they are required, even if the user is not logged on. This functionality gives Microsoft IT the opportunity to service remote machines on a regular basis and ensures that remote users stay up-to-date with company policies. Monitoring and Reporting Windows Server 2008 R2 provides built-in monitoring of the DirectAccess server and DirectAccess components through the DirectAccess Monitoring snap-in. The DirectAccess Monitoring snap-in provides the ability to monitor traffic activity, data, and control traffic counters and events for the different components of the DirectAccess server and the server's status. System Design This section of the document provides an overview of how DirectAccess works and discusses the underlying connectivity and security technologies that Microsoft IT has implemented as part of the DirectAccess system. Architecture The following figure illustrates the major components of the DirectAccess system. Figure 1. A schematic of Microsoft IT's DirectAccess implementation Connectivity The following technologies are used by DirectAccess to initiate and maintain a secure connection with the corporate network. IPv6 DirectAccess clients maintain constant connectivity with the intranet, and Internet Protocol version 6 (IPv6) provides the end-to-end addressing necessary to accomplish this. Clients establish an IPv6 tunnel to the DirectAccess server, which acts as a gateway to the internal network. The preceding figure shows a DirectAccess client connecting to a DirectAccess server across the public IPv4 Internet. Clients can connect from behind a firewall using one of the transition technologies listed below.
0712DirectAccessTCS.docx