Direct Access 2012 -- method for disabling and re-enabling client access ?

Question

We have a reliably functioning DA 2012 setup (which is great), but I need a way to selectively Disable and later Re-Enable DA for particular clients. We use a security group for the Computer accounts of the clients and this is referenced both by Group Policy
(to assign the right settings to the DA Clients) and by the DA Server (to grant the access).
We had hoped that we could simply delete the client Computer account from the security group, but when we tried this the DA server seems to just ignore it, even after a reboot of the DA Server.
We have looked all through the settings of the DA server to see if there is a "disconnect client" option, but can't find anything (which truly amazes me!).
I have seen one blog post from Richard Hicks which recommends running some PowerShell commands (http://directaccess.richardhicks.com/2013/06/11/disconnecting-directaccess-clients-on-windows-server-2012)
but after testing these it seems clear that this really only helps me in a scenario where (A) the client is offsite; and (B) I first Disable the Computer account in AD and then replicate AD.
Wondering what my options are? What do I do when we want to Disable DA for a particular client and then turn it back on again some weeks later?

Answer 1

When you remove the computer account from your group, it will stop DirectAccess from working, but only once the DA client machine receives it's next Group Policy refresh. The purpose of the group is to get those DirectAccess connectivity settings applied
from the DA GPO. So if you remove the account, sometime over the next couple of hours Group Policy will refresh on that laptop, and the DirectAccess settings will be removed. If you do this, then later down the road when you want to turn DirectAccess back
on, you'll need to get that laptop either back into the office or connected via some kind of VPN, because when you add the computer account back to the group, the client machine will have to receive the GPO settings all over again.
I have been installing DirectAccess for years in tons of places, and I don't think I have ever heard of the business requirement to remove and re-add computers to DA like you are describing - do you mind sharing your reasoning behind this? (I'm just truly
curious, I'm always interested in finding new ways that companies are using DA)
The quickest way to disconnect a client machine from DirectAccess is to disable the computer account in AD. You could then re-enable the computer account later and DA would start working again, but of course if you leave a computer account disabled in Active
Directory for a long period of time, it could cause other kinds of sync problems outside the scope of DA.
DirectAccess, if designed properly, turns itself off whenever the computer is connected to the corp network, whether physically onsite or connected via another form of VPN. Given this behavior, I'm not sure why you would want to be able to disable DA for
a while and then turn it back on again later...?