Deploying DirectAccess on Windows Server 2016 core is recommended to ensure the highest level of security and availability for the remote access solution. Server core is a stripped-down, command-line only version of Windows that removes many features unnecessary to support common server workloads. It’s reduced attack surface improves security, and this leaner version of the Windows OS requires less maintenance (patching), resulting in fewer reboots which increases overall availability. It has a smaller disk and memory footprint too which results in quicker system restarts, when required.
Removing the GUI
Historically I’ve recommended that DirectAccess administrators deploy Windows server with the full GUI first, then remove it later after validation testing is complete. Prior to placing it in production, the GUI can be removed by running the following PowerShell command.
Uninstall-WindowsFeature Server-Gui-Mgmt-Infra -Restart
This works flawlessly in Windows Server 2012 and Windows Server 2012 R2. However, when running this command on a Windows Server 2016 server you will receive the following error message.
Uninstall-WindowsFeature : ArgumentNotValid: The role, role service, or feature name is not valid:
‘Server-Gui-Mgmt-Infra’. The name was not found.
Changes in Windows Server 2016
This happens because Microsoft quietly removed the option to switch back and forth between the full GUI version and the core version of Windows beginning with Windows Server 2016.
Source: https://docs.microsoft.com/en-us/windows-server/get-started/getting-started-with-server-core
It is still recommended that DirectAccess be deployed on server core to provide the most secure and reliable experience. However, since it is no longer possible to switch from GUI to core, it must be deployed in serve core configuration upon initial installation.
Additional Information
DirectAccess and Windows Server 2012 R2 Core
Configure Windows Server Core to use PowerShell by Default
Planning and Implementing DirectAccess with Windows Server 2016 Video Training Course
Managing and Supporting DirectAccess with Windows Server 2016 Video Training Course
Eddie
/ August 28, 2017I was planning on converting our Server 2016 Desktop Experience Direct Access server to Core when I found out it was not supported. So, the next plan is to build a new 2016 Core server to replace the current Desktop Experience server.
Is there a way I can export all the settings I need to create a replica Direct Access server? Or do I just suck it up and start from scratch?
Richard M. Hicks
/ August 28, 2017It is possible to perform a “rolling upgrade” to convert to server core. It would involve creating a load-balanced cluster and adding the second node configured with server core. You could then remove the first node and either add another or leave it with just one, your call. However, depending how many users you are supporting it might be easier and quicker to simply remove the configuration and rebuild with core. Unfortunately there’s no way to export/import settings. You’ll just have to document them so you’ll have them when you reinstall.