Direct Access Server cannot connect to PDC domain emulator

Question

I few days ago we had to load a new certificate on one of our Direct Access servers. Since then, we have had a major problem on that server. The Direct Access console cannot be loaded and DA itself cannot run. The exact message is "Settings for the server ServerName cannot be retrieved. The system cannot find the file specified."

We have traced this out to being unable to talk to the PDC emulator for the domain.

Background info: We have three stand-alone setups of Direct Access (not multisite) at different countries and, obviously, AD sites. One that is installed in the same AD site as the PDC emulator has no problem. A second installation has no problem - and is two armed with one on the domain network and one in the DMZ. (Security team want this system turned off and replaced because they can't inspect the traffic after it passes through DA - outside the scope of this question). The problem server is one armed and sits in a DMZ at yet a different AD site. However, neither on the DMZ, nor on our production LAN for testing, can it talk to the PDC emulator.

Other hosts on the same networks are able to talk to the PDC emulator, so it is functioning. We have changed IP addresses so we know it's not something special there.
It is not related to the Remote Access MMC. The Group Policy Management Console also cannot talk to the PDC emulator, but can talk to another Domain Controller on the same subnet as the DA server, and also the PDC emulator.

So, I thought, nah, DA is broken. So, I created a new instance at yet a fourth site to test things. This instance, correctly setup with Certificates, NLA, two armed configuration breaks, with the same error when it installs. As soon as it loads the Direct Access group policy (and the DA firewall policies), it drops any connection to the PDC emulator and does not load DA - which never functions. We don’t have any policies on the box EXCEPT for the Direct Access policies. If we remove the DA policies, the server works as expected.

Testing servers were, 2012 R2, 2016 and 2019. Full patched before attempting the installs. These AD sites are in different countries - the latency is important for the local users accessing local resources. Using a DA server in another country is just not feasible.

Any thoughts would be most helpful.

Answer 1

Not real clear what's going on here but I'd check the required ports are flowing between networks.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts#windows-server-2008-and-later-versions
https://www.microsoft.com/en-us/download/details.aspx?id=24009

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

All ports blocks removed during testing. Long testing with our networks group with permit statements on all associated IP addresses.