Feature Comparison of Always On VPN and DirectAccess

Equivalent functionality


In previous versions of the Windows VPN architecture, platform limitations made it difficult to provide the critical functionality needed to replace DirectAccess like automatic connections initiated before users sign in. That means attackers and more repressive governments would have an easier way to compromise these connections. Monitoring of DirectAccess remote access client status. The primary goal of the migration is for users to maintain remote connectivity to the office throughout the process. These are situations or scenarios in which Always On VPN provides improved functionality over DirectAccess or fills a gap in functionality.

Improved functionality


Connecting to an OpenVPN network requires a a third-party application — either a desktop application or a mobile app. OpenVPN is new and secure, although you will need to install a third-party application. This is the one you should probably use. IPsec encryption should be secure, theoretically.

There are some concerns that the NSA could have weakened the standard, but no one knows for sure. Either way, this is a slower solution than OpenVPN. It can be configured to use very secure AES encryption, which is good. Still, this is better to use than PPTP. OpenVPN seems to be the best option. Giorgio Montersino on Flickr.

The Best Tech Newsletter Anywhere. Join , subscribers and get a daily digest of news, comics, trivia, reviews, and more. At this time, Azure VPN conditional access provides the closest replacement to the existing NAP solution, although there is no form of remediation service or quarantine network capabilities.

You can achieve this functionality in Always On VPN by using the Device Tunnel feature available in version in the VPN profile combined with traffic filters to control which management systems on the corporate network are accessible through the Device Tunnel. Monitoring of DirectAccess remote access client status. Improved functionality Each item in this section is a use case scenario or commonly used DirectAccess function for which Always On VPN has improved functionality—either through an expansion of functionality or elimination of a previous limitation.

Support for two-factor or OTP authentication. Always On VPN specifically supports smart card both physical and virtual and Windows Hello for Business certificates to satisfy two-factor authentication requirements. Group Policy is therefore not a dependency to define VPN profile settings because you do not use it during client configuration. You can configure Always On VPN to support both force tunnel the default operating mode and split tunnel natively.

Always On VPN provides additional granularity for application-specific routing policies. Support for the DirectAccess Connectivity Assistant to provide corporate connectivity status. DirectAccess functionality Always On VPN equivalent Use of multisite to provide multiple remote access entry points and geo-redundancy.

No native multisite-equivalent feature exists in Always On VPN without the use of third-party networking equipment or services such as Azure Traffic Manager or a third-party global server load balancer. Deployment of client and server configuration settings through Group Policy. Always On VPN does not require devices to be domain joined, so there are no dedicated Group Policy settings to configure it.

Next step If you want to This page provides a brief overview of the Always On VPN technologies with links to detailed documents. Planning your migration phases helps identify any issues before they affect the entire organization.

The primary goal of the migration is for users to maintain remote connectivity to the office throughout the process. If you perform tasks out of order, a race condition may occur, leaving remote users with no way to access company resources. Before you install the Remote Access server role on the computer you're planning on using as a VPN server, perform the following tasks.

Feedback We'd love to hear your thoughts. Choose the type you'd like to provide: Product feedback Sign in to give documentation feedback Content feedback You may also leave feedback directly on GitHub.

There are no open issues. Use of a dedicated Infrastructure Tunnel to provide connectivity to the corporate network when the user is not signed in. Use of manage-out to allow remote connectivity to DirectAccess-connected clients from management clients located on the corporate network.


Want to use a VPN? If you’re looking for a VPN provider or setting up your own VPN, you’ll need to choose a protocol. Some VPN providers may even provider you with a choice of protocols. Feature Comparison of Always On VPN and DirectAccess. 06/07/; 10 minutes to read Contributors. In this article. Applies To: Windows Server (Semi-Annual Channel), Windows Server , Windows