All posts tagged Windows Server

Microsoft Entra Private Network Connector Overview and Deployment Strategies

When deploying Microsoft Entra Private Access, administrators must install at least one Entra Private Network Connector to facilitate communication between Global Secure Access clients and on-premises resources. The Entra Private Network connector is a software agent that communicates outbound only. It requires no inbound connectivity, reducing public network exposure and minimizing the organization’s attack surface.

Entra Private Network Connector

The Entra Private Network connector is essentially the old Azure Application Proxy, updated to support all TCP and UDP-based communication. You can download the connector by opening the Entra admin center, navigating to Global Secure Access > Connect > Connectors, and clicking the Download connector service link.

Cloud Appliances

To enable access to cloud-hosted resources, the Entra Private Network connector can be installed on a VM in those environments. However, the Entra Private Network connector is also available as an appliance in public preview for the following cloud providers.

Resource Requirements

The following recommendations pertain to VM resources for the Entra Private Network connector server.

  • Windows Server 2016 or later. However, Windows Server 2016 reaches end of life in January 2027, so Windows Server 2022 and later are recommended. The Desktop edition is required, but it can technically be installed on Server Core with the Application Compatibility Feature on Demand for Server Core. However, Microsoft may not formally support this option.
  • Minimum 4 CPU cores and 8GB RAM. Monitor resource utilization during migration. Provision additional CPU and/or memory when utilization consistently exceeds 70% during peak times. Scaling out (adding servers) is preferred over scaling up (adding CPU and RAM).
  • Domain Join. Domain join is optional but recommended. Domain join is required to support single sign-on (SSO).

Connector Groups

A Connector Group is a logical grouping of Entra Private Network connectors. A Connector Group functions as a single unit for high availability and load balancing. Connectors are deployed in the same region as the tenant by default.

Default Group

When you install the Entra Private Network connector, it is placed into the Default connector group. However, this may not always be desirable. For example, the organization may have multiple data centers in different geographies. They may also have resources hosted in different Active Directory forests or perhaps located in isolated network locations. Using a common connector group may be suboptimal or not work at all.

Custom Groups

Administrators can define custom connector groups as needed. Custom connector groups ensure that connectors always have access to the resources nearest to them. They can be deployed in different locations and assigned to other Azure regions to ensure optimal traffic routing and reduced latency. Today, administrators can create connector groups in the North America, Europe, Australia, Asia, and Japan regions.

Create a Connector Group

Open the Microsoft Entra admin center and perform the following steps to create a new Entra Private Network connector group.

  1. Navigate to Global Secure Access > Connect > Connectors and Sensors.
  2. Click on New Connector Group.
  3. In the Name field, enter a descriptive name for the connector group.
  4. From the Connectors drop-down list, select one or more Entra Private Network connectors to assign to the group. Optionally, you can leave this field blank and assign connectors later.
  5. Click Save.

Connector Group Assignment

Once you have created a new connector group, you can assign Quick Access or individual Enterprise applications to it as follows.

Quick Access

To assign a new connector group to the Quick Access application, open the Entra admin console, navigate to Global Secure Access > Applications > Quick Access, and select the Network access properties tab. Select the new connector group from the Connector Group drop-down list.

Enterprise Applications

To assign a new connector group to an individual Enterprise application, navigate to Global Secure Access > Applications > Enterprise applications. Select an application, then select Network access properties. Select the new connector group from the Connector Group drop-down list.

Deployment Strategy

The following are best practices for deploying the Entra Private Network connector.

Redundancy

Always deploy at least two Entra Private Network connectors to ensure high availability and eliminate single points of failure.

Location

Install the Entra Private Network connector on servers closest to the applications they serve. Deploy connectors in all locations where applications are accessed, including on-premises networks and Infrastructure-as-a-Service (IaaS) resources.

Default Connector Group

Avoid using the default connector group for application assignment. Always use custom connector groups for application access. This ensures that new connectors do not process production traffic immediately after installation, which can cause unexpected behavior if the connector is not optimally deployed for the published resource or is not connected to the back-end application.

Deleting Connectors

Entra Private Network connectors cannot be removed from the management console. If you uninstall a connector, its status will show as inactive. After 10 days of inactivity, it will be automatically removed.

Reassigning Connectors

Administrators can reassign connectors to different connector groups at any time. However, existing connections on that connector server from the prior group assignment will remain until they age out. Administrators can restart the connector service or reboot the server to address this issue.

Restart-Service -Name WAPCSvc -PassThru

Connector Updates

The Entra Private Network connector will automatically install major updates when they become available. However, not all updates are applied automatically. Don’t be alarmed if you see discrepancies between release versions across multiple connector servers in the admin console. Administrators can always perform software updates manually to ensure uniform connector versions in their environment, if desired.

Diagnostics

Beginning with Entra Private Network connector v1.5.4287.0, the agent installation also includes the diagnostic utility ConnectorDiagnosticsTool.exe, which is in the C:\Program Files\Microsoft Entra Private Network Connector\ folder on the connector server. Running the tool initiates a series of tests to perform a health check of the connector service, including certificate status, connectivity, enabled TLS versions, service status, and more.

Note: Entra Private Network connector v1.5.4522.0 and later includes a graphical output, as shown above. Previous versions featured text-based output only.

Summary

Microsoft Entra Private Network Connectors are lightweight, outbound-only agents that enable secure access to on-premises and cloud resources through Entra Private Access. Best practices emphasize deploying at least two connectors per location for redundancy, placing them close to target applications, using custom connector groups for high availability, load balancing, and optimal routing, and assigning them to Quick Access or enterprise applications while avoiding the default group. Ensure that VMs are appropriately sized for the expected connector traffic, and consider using marketplace appliances for Azure, AWS, and GCP. If you’ve previously deployed the Entra Private Network connector, ensure that it is running the latest release to take advantage of new diagnostics for troubleshooting.

Additional Information

Microsoft Entra Private Network Connectors

Microsoft Entra Private Network Connector groups

Preventing Port Exhaustion on Entra Private Network Connector Servers

Microsoft Entra Private Access Intelligent Local Access

Leave a comment
by Richard M. Hicks on January 19, 2026  •  Permalink
Posted in Amazon Web Services, AWS, Azure, Azure App Proxy, Azure Application Proxy, cloud, Cloud Service, Deployment, Enterprise, enterprise mobility, Entra, Entra Global Secure Access, Entra ID, Entra Private Access, Entra Private Network Connector, Global Secure Access, GSA, Infrastructure, Microsoft, Microsoft Entra, Microsoft Entra Global Secure Access, Microsoft Entra ID, Microsoft Entra Private Access, Mobility, Private Network Connector, public cloud, Remote Access, SASE, Secure Access Service Edge, Secure Service Edge, Security, Security Service Edge, SSE, Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Windows Server 2025, Zero Trust, Zero Trust Network Access
Tagged , , , , , , , , , , , , , , , , , , , , , , , , , ,

Posted by Richard M. Hicks on January 19, 2026

https://directaccess.richardhicks.com/2026/01/19/microsoft-entra-private-network-connector-overview-and-deployment-strategies/

What’s New in Absolute Secure Access v14

Absolute Software recently announced a significant upgrade for its popular secure remote access and Zero Trust Network Access (ZTNA) solution. Version 14 of Secure Access introduces many compelling new features and updates that administrators will find beneficial. In addition, crucial security vulnerabilities in the previous release have been addressed.

New Features

Absolute Secure Access v14.x includes many enhancements over previous releases. Here are a few of the highlights.

Improved Performance

Absolute Secure Access v14 provides much faster throughput on multi-gigabit networks (e.g., 2.5Gbps Wi-Fi 6E/7 or 10Gbps wired). New kernel-level optimizations reduce CPU overhead by up to 40% on high-speed links, improving performance on faster networks.

Modern Certificate Handling

SHA-1 has been deprecated since 2011, and beginning with Absolute Secure Access v14, support for SHA-1 certificates has been removed completely.

Enhanced Client Auto Reconnect

Improved client auto-reconnect logic now survives Windows standby mode for more than 12 hours (previous versions were capped at around 4 hours). This will reduce frustration when devices return from standby for extended periods.

Automatic Host Group Updates

Host groups are an excellent way to streamline policy configuration for services like Microsoft 365 and AWS. These cloud providers publish the IP addresses of their services, which are dynamic and often change over time. Absolute Secure Access v14 now supports automatic host group updates for these services. Microsoft 365 updates occur every 28 days, and AWS updates occur every 5 days by default. This interval is configurable for administrators.

Security Updates

Absolute Secure Access v14 closes four server-side CVEs as well as 14 third-party CVEs (Apache, OpenSSL, etc.) that were not patched in v13.x.

Summary

If you have deployed previous versions of Absolute Secure Access, consider upgrading to v14.x today. You’ll gain improved performance, reduced administrative overhead, critical security updates, and much more. If you’d like help with your migration or want to learn more about the new capabilities in Absolute Secure Access v14, fill out the form below, and I’ll provide more information.

Additional Information

Absolute Secure Access

Absolute Secure Access Enterprise VPN Advanced Features In Depth

Absolute Secure Access and IPv6

Leave a comment
by Richard M. Hicks on November 5, 2025  •  Permalink
Posted in Absolute, Absolute Secure Access, Absolute Software, Enterprise, enterprise mobility, Mobility, NetMotion, NetMotion Mobility, NetMotion Software, Remote Access, Security, Security Update, Update, VPN
Tagged , , , , , , , , ,

Posted by Richard M. Hicks on November 5, 2025

https://directaccess.richardhicks.com/2025/11/05/whats-new-in-absolute-secure-access-v14/

Application Compatibility Feature on Demand for Server Core

If you know me, you know that I’m a big fan of Windows Server Core. Server Core is a refactored and streamlined version of Windows Server that offers a smaller attack surface and reduced maintenance requirements. It’s ideally suited for roles like domain controllers (DCs), certification authority servers (CAs), DHCP and DNS servers, and file servers that can easily be managed remotely. Server Core lacks a Graphical User Interface (GUI), which can make administrative tasks more difficult. To support Server Core, administrators must have a firm grasp of the command line and PowerShell. Many organizations are reluctant to deploy Windows Server Core for this reason. For example, network interface configuration and disk management are common pain points for command-line administration. However, I’ve recently discovered something that might reduce this barrier to adoption.

GUI for Server Core?

I honestly don’t know how I missed this, but recently I learned of the Application Compatibility Feature on Demand for Windows Server Core. First introduced in October 2018 for Windows Server 2019 Core and supported through Windows Server 2025, the Application Compatibility Feature on Demand enables important GUI management consoles that help administrators configure and deploy Windows Server Core. It does not add the entire Windows Desktop Experience, of course, but it does introduce support for some critical GUI tools that administrators will find very helpful for installing and configuring various workloads on Server Core. Here are some examples.

Installation

To install the Application Compatibility Feature on Demand for Windows Server Core, open an elevated PowerShell command window and run the following PowerShell command.

Add-WindowsCapability -Online -Name ServerCore.AppCompatibility~~~~0.0.1.0

After running the command, restart the server to complete the installation.

Features and Capabilities

After installing the Application Compatibility Feature on Demand for Windows Server Core, administrators can perform local administration using many GUI tools they are already experienced with. Here are a few examples.

Network Control Panel

Having a GUI for network interface configuration is arguably the most essential benefit of this feature. Many administrators struggle with assigning IP addresses, DNS servers, DNS suffixes, and other network configuration-related tasks using the command line. Here, the classic Network Control Panel applet (ncpa.cpl) gives administrators the familiar GUI experience for managing network settings in Windows Server Core.

Disk Management

Right behind network configuration, disk configuration in Windows Server Core is one of the most challenging administrative tasks using the command line. The Application Compatibility Feature on Demand for Windows Server Core adds support for the well-known Disk Management GUI (diskmgmt.msc), which many administrators have used before.

Event Viewer

While using PowerShell is effective for parsing event log information on Windows Server Core, it’s sometimes easier to view event log information using the GUI (eventvwr.msc).

File Explorer

Copying files to and from a Windows Server Core instance is much easier with the Application Compatibility Feature on Demand for Windows Server Core installed. To perform file operations on Windows Server Core, simply open the Windows File Explorer (explorer.exe) as you would on Windows Server GUI.

Device Manager

Working with device drivers on Windows Server Core can be challenging even for the most experienced command-line administrators. Thankfully, the Application Compatibility Feature on Demand for Windows Server Core adds support for the Device Manager GUI (devmgmt.msc), which significantly simplifies this task.

Task Scheduler

Creating basic scheduled tasks using PowerShell isn’t terribly difficult. However, things become much more difficult when creating tasks with complicated requirements, such as odd schedules, and when using event-based triggers. The familiar Task Scheduler GUI (taskschd.msc) reduces this complexity, allowing administrators to use the GUI they are likely already experienced with.

Resource and Performance Monitor

Both the Resource Monitor (resmon.exe) and Performance Monitor (perfmon.exe) are essential tools for troubleshooting resource consumption and performance bottleneck issues on Windows Server. Both tools are included with this feature.

Resource Monitor (resmon.exe)

Performance Monitor (perfmon.exe)

What’s Missing

Sadly, installing the Application Compatibility Feature on Demand for Windows Server Core does not add GUI support for user and device certificate stores (certmgr.msc and certlm.msc, respectively). Administrators must continue to use certutil.exe or PowerShell to manage certificate stores on Windows Server Core. Alternatively, administrators can use a remote management workstation to perform these tasks using the GUI. However, even with this limitation, the Application Compatibility Feature on Demand greatly improves the Server Core administration experience.

Additional Tools

This feature update includes many other GUI tools in addition to the popular administrative GUI tools listed above. These are available ad hoc using the generic Microsoft Management Console (mmc.exe). Here are a few more GUI tools you might find helpful.

Routing and Remote Access Management Console – This will be especially helpful for Always On VPN administrators using RRAS in their environments.

Windows Firewall with Advanced Security – Managing Windows Firewall and IPsec Connection Security policies is now much easier using the same GUI included with Windows Server Desktop Experience.

Local Users and Groups – Local user and group administration tasks can now be performed using the same GUI that administrators are already comfortable with.

Group Policy, Security Policy, and Resultant Set of Policy (RSoP) – GUI management tools are now available for common local group and security policy administration. In addition, administrators have access to the RSoP policy GUI for GPO troubleshooting.

Other Tools – Administrators will also find the Hyper-V Manager and Failover Cluster Manager GUI consoles are included with this feature update.

Run mmc.exe at the command line and choose File > Add/Remove Snap-in to access these GUI tools.

Summary

Don’t let the lack of a full GUI stop you from deploying Server Core! The Application Compatibility Feature on Demand makes Server Core accessible without sacrificing its core benefits. If command-line concerns have held you back from deploying Server Core, this feature removes that barrier. Start with a test deployment on a non-critical server and experience how Server Core’s reduced attack surface and lower maintenance overhead can work in your environment—without abandoning the GUI tools you rely on.

Additional Information

Application Compatibility Feature on Demand for Windows Server Core

Always On VPN and RRAS on Windows Server Core

10 PowerShell Commands Always On VPN Administrators Should Know

1 Comment
by Richard M. Hicks on October 14, 2025  •  Permalink
Posted in administration, Microsoft, Server Core, systems management, Windows Server 2019, Windows Server 2022, Windows Server 2025
Tagged , , , , , , , ,

Posted by Richard M. Hicks on October 14, 2025

https://directaccess.richardhicks.com/2025/10/14/application-compatibility-feature-on-demand-for-server-core/

« Older Posts