Accessing DFS network shares via VPN

I have DFS setup on my windows domain so users can access network shares via a drive mapped to \\my.domain\shares. Folders are stored on a WS2008 file server (path is \\server01.my.domain\sharedata$).
When accessing via VPN (SSL), users cannot get to the shares via \\my.domain\shares, but they're able to get to them via the UNC path \\server01.my.domain\sharedata$. Stranger still, after accessing once to the shares via \\server01.my.domain\sharedata$, they are also able to access to the drive mapped to \\my.domain\shares.
I am using a Zyxel USG310 firewall with Secuextender SSL VPN client. The IPSec client (also called secuextender, a rebranded version of thegreenbow VPN client) works fine with both paths. Client settings seems to be the same.
Any setting comes to mind?

1 Answer

By default, DFS referrals are sent using "short" (NetBIOS) names, e.g. \\server01, which external clients cannot resolve if the VPN client does not set the correct 'DNS Search Suffix'. (The suffix tells the OS how to expand single-word hostnames to full domain names.)

You'll probably want to configure your DFS root server to send full domain name (FQDN) referrals instead, so that clients would be redirected to \\server01.my.domain which can always be resolved using DNS.

The full instructions can be found at , but the summary is:

1. Remove all domain-based namespaces from your DFS root server.

2. Set the registry parameter:

   Set-DfsnServerConfiguration -ComputerName ABC -UseFqdn $true
   dfsutil server registry dfsdnsconfig set %COMPUTERNAME%
   reg add HKLM\SYSTEM\CurrentControlSet\Services\Dfs /v DfsDnsConfig /t REG_DWORD /d 1

3. Restart the dfs service.

4. Re-add all domain-based namespaces.