Enhancing the security of DirectAccess by requiring certificate authentication

When a DirectAccess client computer builds its IPsec tunnels back to the corporate network, it can require a certificate as part of that authentication process. In earlier versions of DirectAccess, the one in Server 2008 R2 and the one provided by Unified Access Gateway (UAG), these certificates were required in order to make DirectAccess work. Setting up these certificates really isn't a big deal at all. If there is a CA server in your network, you are already prepared to issue the necessary certificates at no cost. Unfortunately, though, there must have been enough complaints being sent to Microsoft in order for them to make these certificates recommended instead of required. Due to this, they created a new mechanism in Windows 8 and Server 2012 called Kerberos proxy. This can be used to authenticate the tunnels instead. This allows the DirectAccess tunnels to build without a computer certificate...