why dont you make your LAG criteria based on your VPN address pool, or whatever DirectAccess IPv6 addresses are being assigned when you connect?
I'll plead my ignorance and ask if this is what you're mentioning as it's outside "location" settings:
You're looking at creating the ruleset by tab 3 network options and then associating the range of IPv6 address' that are assigned, correct? That's outside what we've been tasked to do but I hadn't looked at that yet. Could be a solution.
Yes, thats what im describing. Setting up your network options to include your IPv6 ranges. Assuming you properly authenticated to your internal network and are pulling one of these IPv6 addresses, this would be probably no less or more secure than using the registry key, or any of the other settings.