Install-Remote Access

Syntax

Install-RemoteAccess
       [-ComputerName <String>]
       [-DAInstallType] <String>
       [-ClientGpoName <String>]
       [-InternalInterface <String>]
       [-InternetInterface <String>]
       [-NlsCertificate <X509Certificate2>]
       [-NlsUrl <String>]
       [-NoPrerequisite]
       [-ServerGpoName <String>]
       [-ConnectToAddress] <String>
       [-DeployNat]
       [-PassThru]
       [-Force]
       [-CimSession <CimSession[]>]
       [-ThrottleLimit <Int32>]
       [-AsJob]
       [-WhatIf]
       [-Confirm]
       [<CommonParameters>]

Install-RemoteAccess
       [-ComputerName <String>]
       [-PassThru]
       [-VpnType] <String>
       [-MsgAuthenticator <String>]
       [-RadiusPort <UInt16>]
       [-RadiusScore <Byte>]
       [-RadiusServer <String>]
       [-RadiusTimeout <UInt32>]
       [-SharedSecret <String>]
       [-Legacy]
       [-IPAddressRange <String[]>]
       [-IPv6Prefix <String>]
       [-EntrypointName <String>]
       [-CimSession <CimSession[]>]
       [-ThrottleLimit <Int32>]
       [-AsJob]
       [-WhatIf]
       [-Confirm]
       [<CommonParameters>]

Install-RemoteAccess
       [-ComputerName <String>]
       [-PassThru]
       [-MultiTenancy]
       [[-VpnType] <String>]
       [-MsgAuthenticator <String>]
       [-RadiusPort <UInt16>]
       [-RadiusScore <Byte>]
       [-RadiusServer <String>]
       [-RadiusTimeout <UInt32>]
       [-SharedSecret <String>]
       [-CapacityKbps <UInt64>]
       [-CimSession <CimSession[]>]
       [-ThrottleLimit <Int32>]
       [-AsJob]
       [-WhatIf]
       [-Confirm]
       [<CommonParameters>]

Install-RemoteAccess
       [-ComputerName <String>]
       [-Prerequisite]
       [-CimSession <CimSession[]>]
       [-ThrottleLimit <Int32>]
       [-AsJob]
       [-WhatIf]
       [-Confirm]
       [<CommonParameters>]

Description

The Install-RemoteAccess cmdlet performs prerequisite checks for DirectAccess (DA) to ensure that it can be installed, installs DA for remote access (RA) (includes management of remote clients) or for management of remote clients only, installs VPN (both Remote Access VPN and site-to-site VPN), and installs Border Gateway Protocol Routing.

Prerequisite Checks.

• Every prerequisite check results in a terminating, non-terminating error, or a warning.
• The only terminating error condition is DA server not joined to a domain or the Active Directory server not being reachable and it results in the immediate stopping of the cmdlet.
• If the cmdlet performs only prerequisite checks, then the user is informed about every check that fails, through an appropriate message.
• If prerequisite checks are performed just before installation, such as the NoPreRequisite parameter is not specified, then the cmdlet performs all checks one after the other without displaying any messages for failed checks. If one or more terminating or non-terminating errors are encountered, then the cmdlet does not proceed with the installation. If all checks pass or only warnings are encountered, then the cmdlet proceeds with installation.

Re-using Existing Configuration. If one of the remote access technologies is already installed and the cmdlet is used to install the other technology, then it tries to use as much of the configuration of the installed technology as possible and handles any discrepancies between the two technologies. There are separate parameter sets for DA and VPN installation. If the user specifies parameters, that can be re-used from the existing configuration they are ignored. Example: If VPN is already enabled and a user specifies the internal and internet interfaces ,then when installing DA they are ignored and the cmdlets uses the existing VPN interfaces.

Note: This cmdlet cannot be used to move from one DA installation type to another. Run the Set-DAServer cmdlet to move one DA installation type to another.

DA Installation. Client configuration:

• By default DA is deployed on all domain laptop and netbook computers that belong to the domain specified in the client GPO. This is achieved by adding the Domain Computers AD group as the client SG and creating a WMI filter to filter out devices that are classified as either non-laptops and netbooks. If a client GPO is not specified then the domain of the DA server is used and a client GPO with default name is created in that domain. If the user running the cmdlet does not have the permissions to create the WMI filter, then no client SG is added.
• Force tunneling is disabled for the clients.
• This cmdlet does not deploy DA on down-level clients. DA Server configuration.
• If a GPO with the specified name or default name is not present, then it is created. If it is found, then it is edited with the DA server settings.
• Selecting the internal and internet interfaces.
• The internal and internet interfaces can be specified in the cmdlet. If the user wishes to deploy DA in a single network adapter configuration, then the same name should be specified for both interfaces.
• If one or none of them is specified, then the cmdlet itself selects the appropriate interfaces based on their configuration.
• If a VPN is already installed and the interfaces were specified during its installation, then the same interfaces are re-used. If the interfaces were not specified during VPN installation, then the user is allowed to manually specify the interfaces or the cmdlet picks them itself.
• Transition Technologies: IPHTTPS is always enabled. Teredo is enabled only if 2 consecutive IP addresses are found on the internet interface.
• User authentication: All DA users are authenticated using their domain user name and password.
• IPv6 deployment in internal network: If a native IPv6 deployment is detected inside corporate network, then its IPv6 prefix is obtained. Otherwise ISATAP is automatically deployed. Note: That ISATAP will not become effective until the DNS is configured to resolve ISATAP.
• DA is installed in a PKI-less mode, i.e. no IPsec root certificate is required.
• A certificate is still required for IPHTTPS: If VPN is already installed, then the SSL certificate for SSTP is re-used. If there is no certificate configured for VPN, then the cmdlet looks for an appropriate certificate on the computer (a certificate that matches the ConnectToAddress parameter value) or generates a self-signed certificate. Infrastructure Server configuration.
• If the NLS location is not specified in the cmdlet, then it is deployed on the DA server by default. The cmdlet looks for a certificate for which the subject name matches the internal interface of the DA server. If an appropriate certificiate cannot be found, then a self-signed certificate is generated.
• Health checks are not enabled during installation.
• Application servers are not configured during installation.
• If an IPv4 address is detected on the internal interface of the DA server, then the DNS64 or NAT64 configuration is enabled on the DA server which enables DA clients to access corporate network resources that have IPv4 address only by allotting v6 addresses to these hosts.
• This cmdlet also does an auto-discovery of Configuration Manager servers including Domain Controllers and configures them as the Management Servers.

VPN Installation. Authentication configuration. By default Windows authentication is enabled. This also includes authentication through NPS installed locally on the VPN server. If a RADIUS server is specified, then external RADIUS authentication is used. IP address assignment configuration.

• IPv4 addressing with DHCP address assignment is enabled by default. If an IP address range is specified, then static pool addressing is used.
• IPv6 addressing is disabled by default. If an IPv6 prefix is specified, then v6 addressing is enabled and the prefix is used for the addresses.

Examples

Example 1: Log in as a test user and display error message

PS C:\>Install-RemoteAccess -PreRequisite
Warning: The current user does not have the required permissions to configure WMI filtering in the domain. Verify permissions. 
Install-RemoteAccess : DirectAccess can only be configured by a user with local administrator permissions on the server. Add the current user to local administrator group 
At line:1 char 1 
+ install-remoteaccess -prerequisite 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
+CategoryInfo : NotSpecified: (ServerProvider:root/Microsoft/...PS_RemoteAccess) [Install-RemoteAccess], CimException 
+ FullyQualifiedErrorId : REMOTEACCESSERROR 104, Install-RemoteAccess

This command logs in as a test user who is not a domain user or an administrator on the server. This results in the error specifying that DA can only be configured by a user with local administrator permissions.

Example 2: Install DirectAccess to allow remote clients to connect to corporate network

PS C:\>$RemAccess = Install-RemoteAccess -DAInstallType FullInstall -ConnectToAddress edge1.contoso.com -PassThru
Confirm 

 Installing Remote Access will configure this computer as a Remote Access server. Do you want to install Remote Access? 
[Y] Yes  [N] No  [S] Suspend  [?] Help  (default is "Y"): Y

Note: The cmdlet automatically creates a Server and a Client GPO with Default names in the domain to which the current computer is connected. The Client GPO will be filtered on Domain Computers Security Group by default. The default settings can be modified using Set-DAClient. 

This cmdlet will prompt the user that IPsec and Firewall Policies will be updated. It will automatically try and locate a certificate for NLS and IP-HTTPS (SSL cert), in case it does not find these the cmdlet will prompt the user to create a self-signed certificate for the ones not found.
PS C:\>$RemAccess.DAStatus
Installed 

Install-RemoteAccess : The external network adapter settings cannot be determined automatically on localhost. Run the cmdlet again and specify the adapter settings 

At line:1 char:1 

+ Install-RemoteAccess -DAInstallType FullInstall -ConnectToAddress edge1.contoso.com 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
 
+CategoryInfo: ObjectNotFound: (MgmtProvider:root/Microsoft:...PS_RemoteAccess) [Install-RemoteAccess], CimException 

+ FullyQualifiedErrorId : REMOTEACCESSERROR 112, Install-RemoteAccess

This command installs DA to allow remote clients to connect to corporate network. This cmdlet searches for Internet interface and Internal interfaces. If it finds both these interfaces (as in this example), the cmdlet configures DA in edge topology. In case the cmdlet does not find a public interface and the DeployNat parameter is not specified, the cmdlet will display the following error.

Example 3: Deploy DirectAccess behind another edge device

PS C:\>Install-RemoteAccess -DAInstallType FullInstall -ConnectToAddress nat1.contoso.com -InternalInterface 'Internal Connection' -InternetInterface 'Internal Connection' -DeployNat

This command will deploy DA behind another edge device (NAT box). In the example setup, the DA server has a single network adapter connected to the corporate network named corp.contoso.com. Note: The public interface of the NAT device is the one used in ConnectToAddress parameter. For a single network adapter behind NAT topology, the InternalInterface and InternetInterface parameters need to be mentioned, or the cmdlet will display an error that an external interface was not found.

Required Parameters

Optional Parameters

Inputs

None

Outputs

Microsoft.Management.Infrastructure.CimInstance#RemoteAccessCommon

The Microsoft.Management.Infrastructure.CimInstance object is a wrapper class that displays Windows Management Instrumentation (WMI) objects. The path after the pound sign ( # ) provides the namespace and class name for the underlying WMI object. The RemoteAccessCommon object consists of the following properties:

• The status of DirectAccess: installed or uninstalled. -- The status of VPN: installed or uninstalled. -- The status of site-to-site VPN: installed or uninstalled.
• The status of load balancing: enabled or disabled.
• The name of the internet-facing interface of the Remote Access server.
• The name of the internal-facing interface of the Remote Access server.
• The SSL certificate which is used for IP-HTTPS and SSTP.

Related Links

• Add-VpnS2SInterface
• Get-RemoteAccess
• Set-DAClient
• Set-DAServer
• Set-RemoteAccess
• Uninstall-RemoteAccess