Checklist: Before You Configure DirectAccess

Deploy an Active Directory Domain Services (AD DS) domain on your internal network and ensure that at least one domain controller in the domain containing user accounts is running Windows Server 2008 or later.

Active Directory Domain Services Home page on Microsoft Technet (http://go.microsoft.com/fwlink/?Linkid=127814)

Deploy a public key infrastructure (PKI) with Active Directory Certificate Services (AD CS) and configure autoenrollment for computer certificates.

Active Directory Certificate Services Home page on Microsoft Technet (http://go.microsoft.com/fwlink/?Linkid=127816)

Configure a certificate revocation list (CRL) distribution point that is reachable from the Internet.

Specify CRL Distribution Points (http://go.microsoft.com/fwlink/?Linkid=137744)

Install Windows 7 on your DirectAccess clients and join them to your AD DS domain.

Understanding DirectAccess Components

Create AD DS security groups that contain the computer accounts of your DirectAccess clients.

Create a New Group (http://go.microsoft.com/fwlink/?Linkid=133523)

Configure your Internet firewall to allow DirectAccess traffic.

Understanding DirectAccess Components

Configure and deploy Windows Firewall settings for Teredo traffic.

Understanding DirectAccess Components

If your DirectAccess server is not acting as the network location server, determine or create an HTTPS-based uniform resource locator (URL) on a highly available Web server on your internal network. DirectAccess clients use this URL to determine whether they are located on the Internet or the internal network.

Identify Infrastructure Servers for DirectAccess

For each of your Domain Name System (DNS) servers that are running Windows Server 2008 or later, remove the ISATAP name from the global query block list.

Update the Global Query Block List (http://go.microsoft.com/fwlink/?LinkId=146153)