DirectAccess Installation Errors Involving Security Group

Question

So I've read that it's best practice to filter DirectAccess GPO Affects to a single Security group instead of the "All Commputers" Group in AD. So I've done this. I created a group called 'DirectAccess' and set that as the target. When I attempt
to generate the GPO in the DirectAccess Wizard, I recieve this error:
"Security Group MyDomain\DirectAccess cannot be found"
"The Operation Failed. All of the Specified Security Groups are invalid."
So it looks like the group is invisible to my Server? The only thing I can think of is my AD Structure is sitting on some 2008 R2 boxes and this server is 2012 R2 box. Is there a requirement for AD to be at 2012 Operational Level for DirectAccess to work
in 2012 server R2?
--Aaron

Answer 1

Update: I had this closed a while ago. Microsoft was finally able to set it up in my environment. I will post the Closure email they sent me detailing the steps needed to successfully install DirectAccess:   **Note I have changed all my Server/AD
information to match M$'s Contoso dummy domain
Issue:
 Unable to configure Direct Access Server (DA_EDGE). Error: Security group CONTOSO\DirectAccess Clients cannot be found..
Troubleshooting:
 We collected logs from the Direct Access server while configuring Direct Access.
logman create trace ETWTrace -ow -o c:\ETWTrace.etl -p {AAD4C46D-56DE-4F98-BDA2-B5EAEBDD2B04} 0xffffffffffffffff 0xff -nb 16 16 -bs 1024 -mode 0x2 -max 2048 –ets
logman update trace ETWTrace -p {62DFF3DA-7513-4FCA-BC73-25B111FBB1DB} 0xffffffffffffffff 0xff –ets
Configured Direct Access
logman stop ETWTrace -ets
 We could not find information which could give us clue about the cause of the issue. We found that it was not able to find the group.
2464: 04: 2014-06-24 11:56:18.627 VERBOSE: Validating security group (CONTOSO\dagroup1) in the domain...
2464: 04: 2014-06-24 11:56:18.707 NTE: Security group CONTOSO\dagroup1 cannot be found.
 We Collected Network Capture but could not find anything in LDAP Search Request Packet about the same.
 We found that DC has 2 NIC and both were getting Domain Profile.
 We removed the DMZ NIC and kept only NIC connected to LAN.
 We again tried to configure Direct Access however it still came up with error.
 We involved Directory Services team to take a look at the issue however in logs we were not able to find anything.
 We collected Process Monitor and got it analyzed by the on the Direct Access Server and found that we were not able to create GPO. However it does not give clue as to how its failing.
11:58:51.6421023 PM RAMgmtUI.exe 1836 CreateFile
\\DC.contoso.com\SysVol\contoso.com\Policies\{D937469B-6E34-4A7F-9405-F9F97DC200E0} NAME NOT FOUND Desired Access: Read Attributes, Read Control, Dis, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
11:58:51.6446131 PM RAMgmtUI.exe 1836 CreateFile
\\DC.contoso.com\SysVol\contoso.com\Policies\{D937469B-6E34-4A7F-9405-F9F97DC200E0} NAME NOT FOUND Desired Access: Read Control, Dis, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
11:58:51.6472327 PM RAMgmtUI.exe 1836 CreateFile
\\DC.contoso.com\SysVol\contoso.com\Policies\{D937469B-6E34-4A7F-9405-F9F97DC200E0} NAME NOT FOUND Desired Access: Read Data/List Directory, Synchronize, Dis, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a
11:58:51.6500318 PM RAMgmtUI.exe 1836 CreateFile
\\DC.contoso.com\SysVol\contoso.com\Policies\{D937469B-6E34-4A7F-9405-F9F97DC200E0} NAME NOT FOUND Desired Access: Read Attributes, Delete, Synchronize, Dis, Options: Directory, Synchronous IO Non-Alert, Open Reparse Point, Attributes: n/a, ShareMode: Read,
Write, Delete, AllocationSize: n/a
 We did research internally and decided to configure Direct Access with Domain Computers Security Group (Using PowerShell command) and change it from GPMC – DirectAccess Client Settings GPO to “Direct-Access-Clients” security group and updated
Group Policy on Direct Access Server.
Install-RemoteAccess -NoPrerequisite -Force -PassThru -ServerGpoName 'contoso.com\DirectAccess Server Settings' -ClientGpoName 'contoso.com\DirectAccess Client Settings' -DAInstallType 'FullInstall' -InternetInterface 'Internal' -InternalInterface 'Internal'
-ConnectToAddress 'EDGE.contoso.com' -DeployNat -Verbose -ComputerName 'DA_EDGE.contoso.com'
 We Also configured Certificate Authentication, and Exception for “EDGE.contoso.com'” in NRPT ising poweshell.
Add-DAClientDnsConfiguration -DnsSuffix 'EDGE.contoso.com' -Verbose -ComputerName 'DA_EDGE.contoso.com'
Set-DAClient -Downlevel 'Enabled' -Verbose -ComputerName 'DA_EDGE.contoso.com'
 Once Direct Access got configured we were able to update GPO and connect client from outside.
 On Windows 7 client machine we found IP Helper Service disabled and after enabling the service we were able to connect on that as well.
Resolution:
 We configured Direct Access with Domain Computers Security Group (using PowerShell command) and changed the security group from GPMC – DirectAccess Client Settings GPO to “Direct-Access-Clients” security group and updated Group Policy on Direct
Access Server.
Install-RemoteAccess -NoPrerequisite -Force -PassThru -ServerGpoName 'contoso.com\DirectAccess Server Settings' -ClientGpoName 'contoso.com\DirectAccess Client Settings' -DAInstallType 'FullInstall' -InternetInterface 'Internal' -InternalInterface 'Internal'
-ConnectToAddress 'EDGE.contoso.com' -DeployNat -Verbose -ComputerName 'DA_EDGE.contoso.com'
Commands for troubleshooting Direct Access Clients connectivity:
 To check client status:
netsh dns show state
 To check effective NRPT on the client:
netsh name show eff
 To Check status of IPHTPS Interface:
netsh int http show int
 To Check status of Teredo Interface:
netsh int teredo show state
 To Check Windows Firewall Profile on the client:
netsh advf show cu
 To Check IPSec Main Mode Security Association:
netsh advf mon show mmsa
 To Check IPSec Quick Mode Security Association:
netsh advf mon show qmsa
Related Articles:
Manage DirectAccess Clients Remotely
http://technet.microsoft.com/library/jj574200.aspx
Remote Access
http://technet.microsoft.com/en-US/network/dd420463
Remote Access (DirectAccess, Routing and Remote Access) Overview
http://technet.microsoft.com/en-us/library/hh831416
Remote Access (DirectAccess) Prerequisites
http://technet.microsoft.com/en-us/library/dn464273.aspx
DirectAccess Offline Domain Join
http://technet.microsoft.com/en-us/library/jj574150.aspx
Plan the DirectAccess Infrastructure
http://technet.microsoft.com/en-us/library/jj574101.aspx
Configure the DirectAccess Server
http://technet.microsoft.com/en-us/library/jj574180.aspx
Configuring and Implementing DirectAccess with Windows Server 2012
http://technet.microsoft.com/en-us/video/tdbe13-configuring-and-implementing-directaccess-with-windows-server-2012.aspx