The DirectAccess client security group contains "Domain computers" without "Enable DirectAcces for mobile computers only" ...