Adds one or more client computer security groups (SGs) to the DirectAccess (DA) deployment, adds one or more DA client Group Policy Objects (GPOs) in one or more domains, adds one or more SGs of down-level clients to the DA deployment in a multi-site deployment, or adds one or more down-level DA client GPOs in one or more domains in a multi-site deployment.
Networking / Security · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft RemoteAccess reference: Adds one or more client computer security groups (SGs) to the DirectAccess (DA) deployment, adds one or more DA client Group Policy Objects (GPOs) in one or more domains, adds one or more SGs of down-level clients to the DA deployment in a multi-site deployment, or adds one or more down-level DA client GPOs in one or more domains in a multi-site deployment. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Add-DAClient. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / RemoteAccess · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AsJob
Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete.
-CimSession
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
-ComputerName
Specifies the IPv4 or IPv6 address, or host name, of the computer on which the Remote Access server computer specific tasks should be run.
-Confirm
Prompts you for confirmation before running the cmdlet.
-DownlevelGpoName
Specifies the name to be used when creating the down-level client GPO in the specified domain or represents the domain in which a down-level client GPO with the default name should be created. GPO is specified in the format DOMAIN\GPO_NAME. Domain is specified in the format DOMAIN. This parameter can be used to create the multiple GPOs in multiple domains in one run, so the list of names of the GPOs can be provided. These GPOs correspond to the down-level SGs added using the DownlevelSecurityGroupNameList parameter. If this parameter contains only the domain name, then the following default GPO name is used. -- \ client policy for \-\. A list of GPOs can be specified. This parameter is applicable only in case of multi-site deployment.
-DownlevelSecurityGroupNameList
Specifies the names of one or more down-level client SGs that are not already part of the DA deployment. Specified in DOMAIN\SG_NAME format. These down-level clients can then connect only to the site specified in the EntrypointName parameter. This parameter is only applicable in case of a multi-site deployment.
-EntrypointName
Specifies the identity of a site in a multi-site deployment to which down-level clients are added, such as these clients can only connect to the specified site. If this parameter is not specified, then the site to which the computer on which the cmdlet is run is used (the user may or may not be specifying a computer name). If both this parameter and the ComputerName parameter are specified and the computer name does not belong to the site represented by the name of the entry point, then the entry point takes precedence and the authentication type is configured for it.
-GpoName
Specifies the name to be used when creating the client GPO in the specified domain or represents the domain in which a client GPO with the default name should be created. GPO is specified in the format DOMAIN\GPO_NAME. Domain is specified in the format DOMAIN. If this parameter contains only the domain name, then the following default GPO name is used. -- \ client policy for \. A list of GPOs can be specified.
-PassThru
Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
-SecurityGroupNameList
Specifies the list of client SGs that are to be added to the DA deployment. Each SG is specified in DOMAIN\SG_NAME format.
-ThrottleLimit
Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Prerequisites
Windows with the RemoteAccess module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
This example will add the SGs corp.contoso.com\DirectAccessLaptopClients and corp.contoso.com\DirectAccessMobileClients to DA configuration. corp .contoso.com/DirectAccess Client Settings is the DA Client GPO configured at the time of DA installation. Two new SGs DirectAccessLaptopClients and DirectAccessMobileClients are created and DA Connectivity is provisioned for these SGs. This cmdlet will add the SGs to DA configuration. This essentially means that the existing Client GPO configuration corp.contoso.com/DirectAccess Client Settings will be filtered on the two SGs. This cmdlet will only provision Windows® 8 clients. Down-level clients have to be provisioned separately. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.