Microsoft released a free software called “Mouse Without Borders” which allows you running multiple computers with one keyboard and mouse like Synergy. But the “Mouse Without Borders” brings a lot of cool features and an easy setup.

• Use your mouse seamlessly
• Drag files across computers
• Copy & paste across computers
• Share one keyboard across computers
• Lock or log into all of your PCs at one time and share screen captures from one PC to another

In Windows 7 you an create VPN connections for PPTP, L2TP or SSTP. To delete a connection you can not just right click and press delete. But it’s still very simple, but a lot of people can’t find where you can remove VPN connections, because it is a kind of hidden .

1. First open Network and Sharing Center
2. Click Change Adpater Settings on the left side
   
3. Now you can see all connections and you can remove the VPN connection

Some weeks ago my HP Elitebook 8460w arrived. The first thing I did was installing a new OCZ Vertex 2 SSD and Windows 7 with Servicepack 1, I installed all the drivers from the HP Support Website and everything worked fine.

Now last week I tried to update the firmware on my OCZ Vertex 2 drive. Now with an Intel Rapid Storage driver installed, the OCZ Toolbox could not find the SSD drive and I could not update the SSD firmware. So I uninstalled the Intel Rapid Storage driver and updated the SSD. After I did this every thing still worked fine. But some days later I got the first Bluescreen after I came out of Hibernate. After searching for a solution I could see I am not the only one with this problem.

Now after some research I think I have the solution. This could be the Microsoft MSAHCI driver in Service Pack 1. After I installed the latest Intel Rapid Storage driver everything worked again.

last week my HP Elitebook 8460w arrived and I thought I should write a little review.

System Configuration

Sadly the HP Elitebook 8460w is not available in Switzerland, so I had to order it in the US and this is the configuration I ordered.

• HP EliteBook 8460w Mobile Workstation
• Intel® Core™ i7-2630QM Processor (2.0 GHz, 6 MB L3 Cache)
• Mobile Intel QM67 chipset
• 14.0-inch diagonal LED-backlit HD+ anti-glare (1600 x  900) with 720p HD Webcam
• AMD FirePro™ M3900 w/1 GB gDDR3
• 8GB 1333 MHz DDR3 SDRAM (2D)
• 500 GB 7200 rpm 2.5-inch hard drive
• DVD+/-RW SuperMulti DL Drive
• DualPoint (TouchPad and PointStick)
• Intel Centrino® Ultimate-N 6300 (3×3)
• Bluetooth® Wireless Technology 2.1
• TPM & Fingerprint
• HP 9-Cell 100 Wh Li-Ion Battery
• 56K v.92 high speed modem
• 2x USB 3 ports
• 1x USB 2 always on port
• 1x USB/eSATA combo port
• HP Elite Support with limited 3 year standard parts and labor warranty 3/3/3

I also replace the 500GB Harddisk with an OCZ Vertex 2 (240GB).

Design and Durability

Of course design is a subjective thing. But in my opinion is a really nice upgrade from the previous model. Very clean and industrial design, and the “gunmetal black” is a good choice. I also like the back with a radial-brushed, gunmetal finish and backlit jewel HP logo.

The quality of the HP Elitebook 8460w is just impressive. As a former MacBook Pro user, I am really happy with quality and the durability of the 8460w. HP sends here a clear message to his competitors, about quality of business notebooks. The Elitebook is made out of magnesium and aluminum materials, and meets the military standards (MIL-SD 810G) for drop, vibration, dust, altitude and high temperature.

Everything seems to be at the right place and all buttons and the whole chassis is feeling very “high-class”. The only thing which makes a cheap impression is the optical drive which looks a bit like cheap plastic, but I don’t think this will be a big issue.

HP removed all the little doors on the bottom. The new Elitebook series has a big magnesium cover on the bottom, which lets you easily access harddrive, RAM and other things. And as the rest of the notebook this makes a very solid impression.

The size and the dimensions are not the best in class. The Elitebook is around 3.2 cm thick, compare to the MacBook Pro which is around 2.5 cm this is quite a bit. But it sounds like more than it is. The weight is in my opinion, with something around 2kg, very good for a mobile workstation.

Keyboard

HP changed the keyboard design of the ProBook and the Elitebook to a MacBook like chicklet style. I think this is a huge improvement to the previous generation of Elitebooks. There is more space between the keys and this makes is very easy to type. The keys feel very smooth and there are no sharp edges, they also have a slightly gritty texture and a subtle curvature which make a comfortable type experience. The only downside is that there is no backlight keyboard option on the 8460w, the 8560w and the 8760w have a backlight keyboard.

HP also removed the touch sensitive buttons and added real hardware quick launch buttons. One for turn WiFi on and off, another one for quick web access and the third for mute and unmute.

Touchpad and Pointing Stick

HP also redesigned the touchpad from scratch. The touchpad is now a bigger, multi-touch glass touchpad. It’s nearly as good as the Apple glass touchpad. If you move from a MacBook to a Windows notebook, the HP Elitebook trackpad is one of the only trackpads which gives you a similar experience.

Business users which like a Pointing Stick instead of a touchpad will get this option. With a simple double click on the upper left corner of the touchpad you can turn it off. There is also enough space between the keys and the pointing stick.

Display and Audio

About 14 inch screens is always a big debate. I am not a photographer or have anything to do with colors. But I think it’s the screen it’s okay for a 14 inch. Most of the time I use the screen with a brightness of 50%, so it’s really enough bright if you turn it to 100%. The contrast is average but I think it’s much better than on the Lenovo ThinkPad T420 or the Elitebook 8440p. But if you are a graphic designer you maybe would prefer an Elitebook 8560w or an 8760w with a Dreamcolor display.

HP uses SRS Premium Sound branding for built-in stereo speakers. The sound quality is quite good for a business laptop. But of course multimedia notebooks have much better speakers.

Ports and Accessories

As usual HP offers a lot of ports and options in his business notebook line.  Besides the ports and slots I mention, HP offers pretty cool accessories like the well know HP docking stations and external monitor solutions. The HP Elitebook supports multiple display output (AMD Eyefinity) up to four external monitors, and lets you use a DisplayPort-to-HDMI converter for the display signal and sound.

The Elitebook 8460w comes standard with a 6 cell battery. You can replace the primary 6 cell battery with a 9 cell one, or add on a second 8 or 12 cell battery to greatly extend battery life.

Left

• 1x power adapter port
• 1x firewire port (1394a)
• 2x USB 3.0 ports
• 1x SD/MMC slot
• 1x Express Card/54 slot
• SuperMulti DL; DVD+/-RW

Right

• 1x stereo microphone in
• 1x stereo headphone/line-out
• 1x eSATA/USB combo
• 1x USB 2.0 charging
• 1x DisplayPort
• 1x Security lock slot

Back

• 1x RJ-11 port
• 1x VGA port
• 1x RJ-45 port
• Battery slot

Bottom

• 1x docking connector (for HP docking stations)
• 1x secondary battery connector

Display

• HP Night Light (a LED light above the display)
• HD webcam

Internals

• Intel Core i5 and i7 2. Generation CPU’s
• Up to 16GB DDR3 SDRAM (2 slots)
• Mobile Intel® QM67 Express Chipset
• AMD FirePro™ M3900 with 1 GB dedicated DDR3 video memory
• Bluetooth 2.1
• Intel Centrino 802.11a/b/g/n (3×3)
• TPM 1.2 Embedded Security Chip
• HP Fingerprint Sensor
• Integrated Smart Card Reader
• HP 3D DriveGuard

Heat and Fan Noise

The Elitebook stays always very cool, much cooler than my MacBook Pro which was very hot on the spots where the CPU and the GPU was. I think this is mostly because of the thicker design and it’s also a sign of good quality materials.

I can’t really say something about the fan, it’s mostly really silent and I can’t hear any noises.

Wireless

I did not really think about wireless performance before, but with the integrated Intel Centrino Ultimate-N 6300 (3×3) is a real benefit. I can see now new wireless access points which I could not see before, because they were out of range.

Battery life and Performance

A 14-inch mobile workstation is in my opinion all about battery life, and the 15-inch and the 17-inch are more like desktop replacements. HP did a very good job in terms of battery life on the 8460w. With my 9-cell battery and normal use (WLAN on, web browsing, display brightness 60%), I get something like 9-11 hours of batterylife without problems. I am also sure I could get more out of it, by activating power saving features. I am more than satisfied with battery life.

For its 14-inch size notebook this thing is a monster. Intel did a very good job with the second generation of Sandy Bridge CPUs even I don’t have the fastest Core i7 option (i7-2630QM Processor 2.0 GHz, 6 MB L3 Cache) I still have enough power to even run Microsoft Hyper-V for demos on my notebook.

I would not really criticize the AMD GPU (AMD FirePro M3900), but it’s the weakest part of the system. But I think for a 14-inch workstation with this battery life this is not a problem at all. If you need more graphics power you should move to the 15-inch and the 17-inch mobile workstation which have better graphic options but less battery life.

Replacing the normal HDD with a SSD is always a good choice. It needs less power, it is a lot faster and move my notebook around even its still running and don’t have to worry about destroying the HDD. In my case I did not use the HP SSD option, I bought an OCZ Vertex by myself and replaced the HDD.

Here you can see the results of the Windows Experience Index.

Conclusion

The new Elitebook 8460w is more than I even expected. It is one of the best Windows based business notebooks in the industry. Sure it’s not made for high graphics designer but its a good mobile workstation with an extremely strong battery life and more than enough CPU power. The build quality HP delivered is outstanding and reaches Apple MacBook Pros.

More information about the HP Elitebook 8460w here.

If you need to run multiple instances of Windows on your computer, you have different options. First you could use software like Microsoft Virtual PC or VMware Workstation to run a virtual instance. But if you need more performance, or you have to run for example Microsoft Hyper-V you need a native installed Operating System. Until Microsoft added the feature “boot from VHD”, you had to create different partitions for each installation. Since Microsoft allowed you to use VHD to boot you won a lot of flexibility.

This guide should show you how you can install a new operation system in a VHD, which you can boot from.

1. First boot from a Windows Setup DVD or USB Stick
2. On the screen where you could click “Install now” you have also a “Repair your computer” option in the bottom left corner. Click on this option or use the short cut “Shift + F10” to boot in to the command line mode.
3. Enter diskpart
   
4. Create a new VHD file
   create vdisk file=”filepathandfilename” type=”expandable” maximum=maxsiize
   
5. Now you have to attach this VHD
   select vidsk file=”filepathandfilename”
   attach vdisk
   
6. Now you can switch back to the “Install now” screenby pressing “ALT+TAB” and now do the setup on the new create vdisk.
7. If you start Windows the next time you will see the new and the old Windows in the boot menu.

If you want to add a already existing VHD to the boot menu you can use bdcedit to edit the boot menu.

bcdedit /copy {originalguid} /d "New Windows 7 Installation"
bcdedit /set {newguid} device vhd=[D:]\Image.vhd
bcdedit /set {newguid} osdevice vhd=[D:]\Image.vhd
bcdedit /set {newguid} detecthal on

You can get more information here.

This is a small and simple post how you can enable Windows 7 Autologon.

1. Open the Command Prompt
2. Run the command “control userpasswords2″
   
3. Uncheck the check box for “Users must enter a user name and password to use this computer”
   
4. Enter the credentials for the User to logon
   

This is a modified document which I wrote for a Microsoft Workshop at KTSI. It’s a Desgin, Step by Step and a Troubleshooting Guide for Microsoft DirectAccess. This is made for SMB or LAB environments not for Enterprise Deployments.

I hope this guide can help you deploy DirectAccess in your environment and you can enjoy DirectAccess like I do

Design

Requirements

Basically this is a project which is optimized for SMB environments. That means this design uses a minimum of servers to deploy Microsoft DirectAccess.

So what do you need for a DirectAccess environment.

• One or more DirectAccess servers running Windows Server 2008 R2 (with or without UAG) with two network adapters: one that is connected directly to the Internet and one that is connected to the intranet. DirectAccess servers must be a member of an AD DS domain.
• On the DirectAccess server, at least two consecutive, public IPv4 addresses assigned to the network adapter that is connected to the Internet.
• DirectAccess client computers that are running Windows 7 Enterprise or Windows 7 Ultimate. DirectAccess clients must be members of an AD DS domain.
• At least one domain controller and DNS server that is running Windows Server 2008 SP2 or Windows Server 2008 R2. When UAG is used, DirectAccess can be deployed with DNS servers and domain controllers that are running Windows Server 2003 when NAT64 functionality is enabled.
• A public key infrastructure (PKI) to issue computer certificates, and optionally, smart card certificates for smart card authentication and health certificates for NAP. For more information, see Public Key Infrastructure on the Microsoft Web site.
• Without UAG, an optional NAT64 device to provide access to IPv4-only resources for DirectAccess clients. DirectAccess with UAG provides a built-in NAT64.
• Activated IPv6 on the Servers you want to use with DirectAccess

Key elements

• DirectAccess client. A domain-joined computer running Windows 7 Enterprise, Windows 7 Ultimate, or Windows Server 2008 R2 that can automatically and transparently connect to an intranet through a DirectAccess server.
• DirectAccess server. A domain-joined computer running Windows Server 2008 R2 that accepts connections from DirectAccess clients and facilitates communication with intranet resources.
• Network location server. A server that a DirectAccess client uses to determine whether it is located on the intranet or the Internet.
• Certificate revocation list (CRL) distribution points. Servers that provide access to the CRL that is published by the certification authority (CA) issuing certificates for DirectAccess.

DirectAccess Connection Process

1. The DirectAccess client computer running Windows 7 Enterprise or Windows 7 Ultimate detects that it is connected to a network.
2. The DirectAccess client computer determines whether it is connected to the intranet. If it is, DirectAccess is not used. Otherwise, DirectAccess is used.
3. The DirectAccess client computer on the Internet connects to the DirectAccess server with IPv6 and IPsec. If a native IPv6 network is not available (and it probably will not be when the computer is connected to the Internet), the client uses the 6to4 or Teredo IPv6 transition technologies to send IPv4-encapsulated IPv6 traffic.
4. If a firewall or proxy server prevents the client computer using 6to4 or Teredo from reaching the DirectAccess server, the client automatically attempts to connect with the Internet Protocol over Secure Hypertext Transfer Protocol (IP-HTTPS) protocol. IP-HTTPS uses an IPv4-based Secure Sockets Layer (SSL) connection to encapsulate IPv6 traffic.
5. As part of establishing the IPsec session for the infrastructure tunnel to reach the intranet DNS server and domain controller, the DirectAccess client and server authenticate each other using computer certificates and computer account credentials.
6. If Network Access Protection (NAP) is enabled and configured for health validation, the DirectAccess client attempts to obtain a health certificate from a Health Registration Authority (HRA) on the intranet. The HRA forwards the DirectAccess client’s health status information to a NAP health policy server. The NAP health policy server processes the policies defined within the Network Policy Server (NPS) and determines whether the client is compliant with system health requirements. If so, the HRA obtains a health certificate for the DirectAccess client.
7. When the user logs on, the DirectAccess client establishes the intranet tunnel to access the resources of the intranet. The DirectAccess client and server authenticate each other using a computer certificate and user account credentials. IF NAP is being used, the DirectAccess client submits its health certificate for authentication.
8. The DirectAccess server forwards traffic between the DirectAccess client and the intranet resources to which the user has been granted access.

From TechNet: http://technet.microsoft.com/en-us/library/dd637792(WS.10).aspx

IMPORTANT: DirectAccess authenticates the computer before the user logs on. Typically, computer authentication grants access only to domain controllers and DNS servers. After the user logs on, DirectAccess authenticates the user, and the user can connect to any resources he or she is authorized to access.

Separating Internet and Intranet Traffic

DirectAccess is splitting Internet and Intranet Traffic. So if a client is out-side the company network it will not connected to the company network to get Internet Access.

Picture from TechNet: http://technet.microsoft.com/en-us/library/dd637769(WS.10).aspx

DirectAccess versus legacy VPN

Problems with VPN

Traditionally, users connect to intranet resources with a VPN. However, using a VPN can be cumbersome because:

Connecting to a VPN takes several steps, and the user needs to wait for authentication. For organizations that check the health of a computer before allowing the connection, establishing a VPN connection can take several minutes.

• Any time users lose their Internet connection, they need to re-establish the VPN connection.
• VPN connections can be problematic in some environments that filter out VPN traffic.
• Internet performance is slowed if both intranet and Internet traffic goes through the VPN connection.

Because of these inconveniences, many users avoid connecting to a VPN. Instead, they use application gateways, such as Microsoft Outlook® Web Access (OWA), to connect to intranet resources. With OWA, users can retrieve internal e-mail without establishing a VPN connection. However, users still need to connect to a VPN to open documents that are located on intranet file shares, such as those that are linked within an e-mail message.

TechNet: http://technet.microsoft.com/en-us/library/dd637766(WS.10).aspx

DirectAccess Benefits

• Seamless connectivity. DirectAccess is on whenever the user has an Internet connection, giving users access to intranet resources whether they are traveling, at the local coffee shop, or at home.
• Remote management. IT administrators can connect directly to DirectAccess client computers to monitor them, manage them, and deploy updates, even when the user is not logged on. This can reduce the cost of managing remote computers by keeping them up-to-date with critical updates and configuration changes.
• Improved security. DirectAccess uses IPsec for authentication and encryption. Optionally, you can require smart cards for user authorization. DirectAccess integrates with NAP to require that DirectAccess clients must be compliant with system health requirements before allowing a connection to the DirectAccess server. IT administrators can configure the DirectAccess server to restrict the servers that users and individual applications can access.

TechNet: http://technet.microsoft.com/en-us/library/dd637814(WS.10).aspx

DirectAccess and VPNs Working Together

DirectAcces does not solve every problem or is a solution for everything. That’s why a lot of company could deploy a mixed system with DirectAccess and “legacy” VPN.

Picture from TechNet: http://technet.microsoft.com/en-us/library/dd875517(WS.10).aspx

Server and Clients for this Guide

As mentioned in an earlier chapter, this is designed to use a minimum of servers. This is not Microsoft best practice, but it should be okay for lab environments and it shows what you need as a minimum.

Overview

DirectAccess Overview

LAB Overview

Domains

Servers

All this Servers are Virtual Machines based on Microsoft Hyper-V 2008 R2, on the following Hyper-V Hosts.

Hyper-V Hosts

Groups

Network Overview

Group Policies

Step by Step Deployment

Make your Environment Ready

Active Directory Domain Services

Installing the Active Directory Domain Service is nothing special, in our lab environment we used an already existing Active Directory Domain.

The only other thing you need is a Security Group for Active Directory Computer Accounts which are allowed to use DirectAccess.

Active Directory Certificate Services

To use DirectAccess you need the Active Directory Certificate Services. If you don’t have a working PKI yet, you can use this step by step guide to deploy one.

DHCP Server

There is just one thing you have to make sure, if you don’t have implemented IPv6 in your environment you need to disable DHCPv6 stateless mode. You can do this by choosing Disable DHCPv6 stateless mode for this server in the DHCP Configuration Wizard.

DNS Server

Basically you just need the DNS Server and if you have installed your first Active Directory Server you already have the DNS role installed. There is no special configuration need at this moment; we just have to add some entries later.

Creating a new Certificate Template

Right click on Webserver and Duplicate Template

On the Security tab you have to Allow Enroll Permissions for Domain Computers and Authenticated Users.

After creating this Certificate Template you have to add this to your CA Template Folder by right click New
à
Certificate Template to Issue and now choose your Certificate in this case Webserver (DirectAccess).

Create IPv6 ICMP Firewall Group Policy

DirectAccess can only work if the systems can ping each other over IPv6 so we have to create an ICMPv6 Inbound and Outbound rule on each system or we do this over Group Policy which is much simpler and quicker.

First open the Group Policy Management MMC and create a new Group Policy Object and edit this. In this case we all the Group Policy Object DirectAccess IPv6.

In the Group Policy Management Editor now navigate to Computer Configuration / Policies / Windows Settings / Security Settings / Windows Firewall with Advanced Security / Windows Firewall with Advanced Security. Now under Inbound Rules we create a new rule in our case named Inbound ICMPv6 Echo Requests.

After you have created the Inbound rule, you also have to create an Outbound rule with the same settings as the Inbound rule.

After you have created this Group Policy Object remember to add this to your domain.

Remove ISATAP from DNS global block list

To remove the ISATAP entry from the DNS global block list you can use the following command:

Dnscmd /config /globalqueryblocklist wpad

This removes the value isatap from the registry key REG_MULTI_SZ “GlobalQueryBlockList” under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentConrtolSet\Services\DNS\Parameters

On the second DNS Server I did the same. I used Powershell Remoting to do that, you can also connect via Remote Desktop and run the command.

With net stop iphlpsvc and net start iphpsvc you can restart the IP helper service on the DNS server.

More about ISATAP: http://en.wikipedia.org/wiki/ISATAP

Certificate Revocation List

Now if you work with certificates you need a CRL (Certificate Revocation List). We simply deploy this on our DirectAccess Server, you could use every other Server in your environment, but the server needs to be accessible from the Internet.

Setup IIS-Website

First we install the standard IIS role.

Now we add a Virtual Directory to the Default Website (right click on Default Web Site and Add Virtual Directory).

Under Physical path you need to add a path which the CA saves the Revocation List. So we will create a network share for this directory later.

In our case we used C:\inetpub\wwwroot\crld

Now on the properties of this Virtual Directory you can now click on Directory Browsing.

Now you can enable Directory Browsing by pressing Enable on the Actions menu.

Now in the Configuration Editor we have also to add a setting for requestFiltering.

Under system.webServer/security/requestFiltering set allowDoubleEscaping to true.

Create Share for CRL

Create a share on the directory we used for our Virtual Directory (In our case we used C:\inetpub\wwwroot\crld).

And grant Full Control for the CA Computer account.

CA Configuration

Basically we now have to publish the CRL from the CA to the CRL webserver we just created. And Clients can check now the CRL from the Webserver over http.

Create External DNS Entries

Create the following A Records for your external domain. In this case our external domain is microsoft-engineering.ch and we create a sub domain called clr.microsoft-engineering.ch and point to the external IP address which the CRL is available.

This is mostly done by our external Hosting Provider.

You also have to create another A Record for DirectAccess.

IMPORTANT: for the DirectAccess A Record you have to use the first external IP Address. If your external DirectAccess IP Addresses are 234.234.233.121 and 234.234.233.122 you create the A Record only for 234.234.233.121. Not for the second one and not for both.

Configure CRL Distribution Point

On the Server which has the CA role installed you start the Certification Authority Management Console.

Right click Properties

Under the Extensions Tab, select the extension CRL Distribution Point (CDP).

Now click on Add.. and add the external Connection first, by adding the external address:

http://crl.microsoft-engineering.ch/crld/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

IMPORTANT: Do not forget the .crl at the end

Click OK and add the select the following checkboxes

Now add the second entry and this time for the internal connection to the network share.

\\das-win-020-001\crld$\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

Click OK and select the following checkboxes

Verify the CRL Distribution

If you now check the network share it should not see any file except the web.config file. If you now right click on Revoked Certificates / All Tasks / Publish it should publish two new files to the network share.

Configure Auto Enrollment for Computer Certificates

To configure Auto Enrollment for Computer Certificate we create another Group Policy. In this case we called this Autoenrollment.

Navigate to Computer Configuration / Policies / Windows Settings / Security Settings /Public Key Policies

Edit the Certificate Services Client – Auto-Enrollment

Use the settings from the screenshot

Now run the Automatic Certificate Request Wizard

And don’t forget to add this new Group Policy to your Domain.

Request Certificate for DirectAccess Server

On the DirectAccess Server open a MMC and add the Snap-in Certificates for local Computer account.

Now navigate to Certificates / Personal and click right on Certificates. Now click on All Tasks and Request Certificate.

Now select your template in our case we called this Webserver (DirectAccess). You also need to add some information to this certificate.

Add a Common Name and as alternative name DNS and use your public DirectAccess domain, for which you have created the A Record. In our example environment we used directaccess.microsoft-engineering.com.

After you have added this certificate it is recommended that you add a friendly name to this Certificate, so you can better find this certificate later.

Network Location Server

The Network Location Server is basically just a webserver. In this environment we used a simple IIS installation on our fileserver, it could also be a SharePoint site or a existing website or installation of IIS.

With the Network Location Server DirectAccess clients check their location (Internal or external).

So basically this is has to be a server which is a member of the Domain and you IIS is installed or you can install the IIS server role. The server does not need to be reachable from external.

Now first add the DirectAccess webserver certificate to the Server. You can do the same as with the DirectAccess Server.

IMPORTANT: in a productive environment, the Network Location Server should be high available. If the NLS is not available all DirectAccess clients will try to connect over the DirectAccess to the network, even if they are at the local company network.

Open the MMC and add the Certificate Snap-In. Request a new Certificate:

As on the DirectAccess server you have to add some information for the certificate.

Add a Common Name and as alternative name DNS and use your internal domain, for which you have created the A record. In our example environment we used corp.pepsi.local.

Next step is to create an HTTPS binding for the site nls.corp.pepsi.local and create a DNS CNAME on your local DNS Server for nls.corp.pepsi.local which points to the Server where the NLS Website runs.

On this Server we now add a binging for HTTPS. Open the IIS Manager right click on the Default Website, or the Website you want to use for NLS, and Edit Bindings.

Now Add Binding.

Now later in the DirectAccess installation you need to add the URL for this website location (http://nls.corp.pepsi.local). The webserver needs to send back status code 200. Which means send back a simple OK.

DirectAccess Server

The Direct Access Server is a Windows Server 2008 R2 Server which has an internal and an external network interface. The external network interface must have two external IP addresses.

So you should have two network adapters, and it’s recommended two name them correctly, for example internal and external. We used DA1 for DirectAccess (external) and Local Area Network for the internal adapter.

You also should set the DNS-Suffix for the internal connection.

Install DirectAccess

After we finished all these requirements we are now ready to install the DirectAccess feature on our DirectAccess Server.

Installing the feature DirectAccess Management Console will automatically add the feature Group Policy Management Console.

After you have installed the DirectAccess feature you should get the following console. By the way no reboot is needed.

Step 1

In Step 1 add the group with Computer Clients you have created in the Active Directory.

Step 2

In Step 2 you define the network interfaces and certificates.

The first certificate is the CA certificate and the second one is the external certificate, in this case for directaccess.microsoft-engineering.ch.

Step 3

In Step 3 you define the Network Location Server

After the click of next it will automatically add the DNS Suffix of the Domain and the name of the Network Location Server.

You can now add the Infrastructure Servers which can access the DirectAccess clients. This could make sense for Management Server or WSUS Servers.

Step 4

In Step for you could add an additional end-to-end authentication.

After you click on the finish button you will get an overview of all the settings.

If you now open the Group Policy Management Console you will see that DirectAccess has automatically created two new Group Policies.

Everything Working

After you are done and you don’t have any visible error, DirectAccess should work properly.

On your DirectAccess client you should have access to your company network all the time.

Even Internal DNS Request should work.

Basic Troubleshooting

Checks

Check for DirectAccess Group Policy

With gpresult you can check on the client if the DirectAccess Group Policy is working on the client.

gpresult /R

This shows all GPO’s deployed to the client.

If the GPO is not all ready deploy to the host you can run a gpupdate /force

Check Connection

With IPCONFIG you can check if there is a connection

You can see a Tunnel adapter with an IPv6 address beginning with 2001:

Also a ping to a domain client should work

Links and Documents

DirectAccess Deployment and Troubleshooting Guides
http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=647222d1-a41e-4cdb-ba34-f057fbc7198f

Technical Overview of DirectAccess in Windows 7 and Windows Server 2008 R2
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=64966E88-1377-4D1A-BE86-AB77014495F4

Test Lab Guide: Demonstrate DirectAccess
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=8D47ED5F-D217-4D84-B698-F39360D82FAC

Windows 7 and Windows Server 2008 R2 DirectAccess Executive Overview
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=D8EB248B-8BF7-4798-A1D1-04D37F2E013C

Windows 7 and Windows Server 2008 R2 DirectAccess IT Infrastructure Compatibility
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=25B453B4-2DB7-435D-88B5-5C3B81DE249C

Wikipedia ISATAP
http://en.wikipedia.org/wiki/ISATAP

German DirectAccess Guide
http://technikblog.rachfahl.de/technik/howto-einrichtung-von-directaccess/

Some days ago I compared the new HP EliteBook and ProBook series. Now I decided to buy the HP EliteBook 8460w mobile workstation. I think this is the best option between performance and batterylife.

Here the 8460w configuration I ordered:

• HP EliteBook 8460w Mobile Workstation
• Intel® Core™ i7-2630QM Processor (2.0 GHz, 6 MB L3 Cache)
• Mobile Intel QM67 chipset
• 14.0-inch diagonal LED-backlit HD+ anti-glare (1600 x 900) with 720p HD Webcam
• AMD FirePro™ M3900 w/1 GB gDDR3
• 8GB 1333 MHz DDR3 SDRAM (2D)
• 500 GB 7200 rpm 2.5-inch hard drive
• DVD+/-RW SuperMulti DL Drive
• DualPoint (TouchPad and PointStick)
• Intel Centrino® Ultimate-N 6300 (3×3)
• Bluetooth® Wireless Technology 2.1
• TPM & Fingerprint
• HP 9-Cell 100 Wh Li-Ion Battery
• 56K v.92 high speed modem
• HP Elite Support with limited 3 year standard parts and labor warranty 3/3/3

As I said the main reasons for me to buy this notebook, are the performance, the form factor, the batterylife and of coure the design. I am sure the EliteBook 8460p would be enought performance for me, but I really like the color of the EliteBook w-series notebooks.

Since HP will not release the EliteBook 8460w in Europe I ordered the notebook directly in the HP Online Store with my myus.com account.

After some years with my Apple MacBook Pro its time for a new notebook. Now since my work now is really in the Microsoft field, it does not really make sence to buy a MacBook Pro again. So first I check out the new Dell Latitude E-Series, and now HP released the new Elitebook Workstations.

Now I don’t really like the new HP Elitebook p-series, but I really like the black desgin of the ProBook or the new gunmetal black of the Elitebook w-series.

What is important for me:

• Screen resolution – 1600 x 900 or even 1920 x 1200
• battery – life 6 hours or more
• Size 14 inch or 15 inch
• cool desgin
• docking station
• multiple monitor support

If you need more information you can get them here.