COMMAND EVERYTHING.
Sets the properties specific to the DirectAccess (DA) server.
Microsoft RemoteAccess reference: Sets the properties specific to the DirectAccess (DA) server. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Set-DAServer. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Windows / RemoteAccess · Windows Server 2025 documentation; feature/module prerequisites apply
-AsJob- Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete.
-CimSession- Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
-ClientIPv6Prefix- Specifies the prefix from which IPv6 addresses are assigned to the connecting clients in case of IP-HTTPS. The length should be 64 bits. In the case of a load balancing scenario the prefix length should be 59 bits. The client IPv6 prefix configuration is applicable per-server or per-site as in the case of multi-site deployments.
-ComputerName- Specifies the IPv4 or IPv6 address, or host name, of the computer on which the DA server computer specific tasks should be run.
-Confirm- Prompts you for confirmation before running the cmdlet.
-ConnectToAddress- Specifies the DA server or NAT public, if DA server is deployed behind a NAT, address to which clients connect. Specified as host name or IPv4 address. When the ConnectTo address is changed, the SSL certificate is also changed appropriately. Following are the rules associated with assigning a proper certificate. -- This cmdlet looks for an appropriate SSL certificate on the computer. -- If an appropriate SSL certificate is not found, then a self-signed certificate is created. -- In the case of external load balancer configuration, if one or more computers are down, then the cmdlet bails out and the ConnectTo Address is not changed. -- In a load balancing scenario, if all computers are up and an appropriate SSL certificate is found only on some computers, then the cmdlet fails the operation of changing the ConnectTo address. If none of the computers has a proper SSL certificate, then a self-signed certificate is created on all computers and the ConnectTo change goes through. If one or more computers are down, then the certificate is updated only on the other computers. But the DA server GPO is updated to ensure that when these computers come up load balancing is in stopped state on them due to a certificate mismatch. For the certificate change, and as a result the ConnectTo address change, to take effect the administrator needs to install a similar certificate with the same name on the computers and re-run this cmdlet. If a self-signed certificate is being used, then the user just needs to re-run the cmdlet and it automatically creates a self-signed certificate. -- In a multi-site scenario, this cmdlet does not create a self-signed certificate and always expects a proper certificate to be present on the computer itself. The ConnectTo address is applicable per-DA server or per-site, in the case of multi-site deployments.
-DAInstallType (required)- Changes the configuration in which DA has been deployed. The acceptable values for this parameter are: -- FullInstall. -- ManageOut. This parameter is a global configuration and applies to the entire DA deployment.
-DisableComputerCertAuthentication (required)- Specifies that computer certificate authentication is to be disabled. Disabling this setting disables PKI for the DA deployment. Following are conditions for computer certificate authentication. -- Computer certificate authentication cannot be disabled if health checks are enabled using the HealthCheck parameter or Two-factor authentication is used for user authentication or when multi-site deployment is enabled or when firstref_client_7 client support is enabled. -- User authentication configuration is automatically changed to UserPasswd when computer certificate authentication is disabled. Computer certificate authentication is re-enabled by configuring an IPsec root certificate using the IPsecRootCertificate parameter. Disabling of computer certificate authentication is a global configuration that applies to the entire DA deployment.
-EntrypointName- Specifies the identity of a site in a multi-site deployment and indicates that the DA server properties should be configured for that site. Only the following properties are applicable at the site level. The rest of the properties are global and therefore this parameter has no meaning to them. -- ClientIPv6Prefix. -- ConnectToAddress. -- TeredoState. If this parameter is not specified in a multi-site deployment, then the entry point name to which the server on which the cmdlet is run is used. The server could also be represented by using the ComputerName parameter. If both this parameter and ComputerName parameter are specified and the computer name does not belong to the site represented by the entry point name, then the entry point takes precedence.
-Force- Forces the command to run without asking for user confirmation. When suppressed the cmdlet assumes user confirmation for the following conditions. -- ConnectTo change would result in a change in the SSL certificate. -- During SSL certificate change if an appropriate certificate is not found then a self-signed certificate is created. -- Changing DA installation type.
-IPsecRootCertificate- Specifies the root certificate to which DA should chain. The acceptable values for this parameter are: -- Change the IPsec root certificate. -- Enable PKI if there is no IPsec root certificate already configured. However, this cmdlet configures the certificate only on the server on which this cmdlet finally runs.
-IntermediateRootCertificate- Specifies that the IPsec root certificate specified is an intermediate root certificate.
-InternalIPv6Prefix- Represents the native IPv6 prefixes used in the internal network, in corporate network. The list of prefixes specified always overwrites the existing list of prefixes. The list of internal IPv6 prefixes is a global configuration and applies to the entire DA deployment.
-PassThru- Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
-TeredoState- Configures the state of Teredo. The acceptable values for this parameter are: -- Enabled. -- Disabled. The following are the behavioral aspects of Teredo State. -- Teredo can be enabled only if two consecutive Public IPv4 addresses are present on the Internet interface of the server. -- In a load balancing scenario. ---- If a 3rd party load balancer is being used and Teredo has to be enabled, then the load balancer should have two consecutive IP addresses. Additionally each DA server that is part of the Load balancer must have 2 consecutive public IPv4 addresses. ---- Teredo can be enabled on a cluster if the cluster has VIPs that are two consecutive public IPv4 addresses. If such IPs are not found, then the cluster should be destroyed first and two consecutive IPs should be configured on the DA server. -- The Teredo configuration is applicable per-computer or per-site, in the case of multi-site deployments.
-ThrottleLimit- Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.
-UserAuthentication- Sets the type of authentication that is used to authenticate a DA user. The acceptable values for this parameter are: -- TwoFactor. -- UserPasswd. Here two-factor refers to certificate authentication, OTP authentication, or smartcard based authentication. Note: To setup OTP authentication enabling two-factor alone is not enough. It needs to be configured separately using the DAOtpAuth cmdlets. User authentication is a global configuration that applies to the entire DA deployment.
-WhatIf- Shows what would happen if the cmdlet runs. The cmdlet is not run.
Windows with the RemoteAccess module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.