For a long time we have used WPAD to simplify teachers moving their laptops between home and school and its worked very well. Laptops have the 'automatically detect settings' box ticked in Internet Settings. The location of the wpad file is distributed by both DHCP and DNS.

However, after implementing DirectAccess its became apparent that when machines were connecting at home, they would pick up the WPAD settings and all Internet traffic was routed through our gateway/filter/firewall (which we didn't want it to do). The wpad even had an IP check in it which I thought would make the clients use a direct connection.

I believe that this is because the DirectAccess remote clients would find the wpad entry in DNS and use its internal IP, not its local IP, so according to the wpad function the machine was 'on network' with an internal IP so it tells the browser to route traffic through the on-site proxy.

A simple fix for this was to only publish the wpad location via DHCP. All major browsers now support the DHCP method (unlike a few years ago). Therefore when a DA client connects, it checks DHCP for the location (using its local DHCP server, which fails), then checks DNS (which fails) so uses a direct connection.