remote user domain integration - DirectAccess vs Always On VPN

Question

We use a 3rd-party security vendor vpn client & server which the users sign into with current domain credentials after signing into their Windows 10 desktops with cached domain credentials. With this solution remote domain-joined computers that rarely visit a company office to connect on the internal network never get changes or additions to group policy computer settings as described in this archived forum post: how-to-force-gpo-changes-on-remote-pcs-that-used-cached-credential-login

Additionally, domain-synced password expiration notices or password change prompting at windows logon is not possible and group membership + kerberos tickets will not refresh at logon. All of this leads to support concerns.

Can anyone comment on whether DirectAccess or "Always On VPN" address these shortcomings and whether one is a better approach vs the other in an environment where Windows 10 Enterprise, Server 2019, and SCCM are available?

Answer 1

Hi ,

You could consider to use Always On VPN Device Tunnel in such scenes.

Always On VPN Device Tunnel was designed with a specific purpose that being to provide pre-logon network connectivity to support scenarios such as logging on without cached credentials.

AOVPN Device Tunnel takes place as the machine has booted up. It does not require the user to log in first since it only requires the machine certificate to authenticate which will be used independently of which user logs in.

For your reference:

Always On VPN Device Tunnel Only Deployment Considerations

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Configure VPN device tunnels in Windows 10

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.