2 Replies Latest reply: Jun 12, 2012 3:22 PM by rmueller RSS

    VDI interaction with Active Directory

    rmueller
      New to VDI...

      So, how much interaction does VDI have with Active Directory?

      For instance,

      If I delete a desktop in VDI should it delete the machine from Active Directory?

      How does cloning, template versioning and recycling interact with AD?

      When a template is updated (new version), and cloning is updated to use the newest template version, what actually happens to the desktop, does it end up with the same identifier so AD recognizes it, does it get a new SID and a new entry in AD?

      The reason for asking is, that currently, desktops and AD seem to be getting out of sync in our environment (new 3.4 install; first time with VDI). The following are the events we followed...what did we miss?

      Starting fresh...nothing in AD
      We have a template XP machine
      The pool is setup as Flexable
      Cloning is setup to use the last and most current version of the template
      Two machines are to be cloned

      Cloning is enabled
      Two machines build

      Login via MS-RDP login to a AD domain account - works perfectly
      Login as a second user via MS-RDP login to a AD domain account - works perfectly

      Logout both sessions...wait for 120 minute timeout for desktops to recycle

      Shows both desktops as idle

      Login via MS-RDP - does not allow domain loging
      Login as another user (to get onto the second desktop) - warns that duplicate machine found on network




      ron.

      Edited by: rmueller on Jun 11, 2012 2:48 PM
        • 1. Re: VDI interaction with Active Directory
          800109
          Hi Ron,

          VDI mostly reads data (users) from Active Directory.
          The only 'write' action VDI does in Active Directory is to delete the machine from AD when the cloned desktop is destroyed (provided the Administrator you configured in VDI to access AD has 'write' access to the machine location).

          Some customers with large AD deployments (multi-sites), have reported a problem with VDI (3.3.x) where new machines cannot be created in AD because the previous one with the same name has not yet been deleted from every site, due to the replication latency between sites.
          So in VDI 3.4, we introduced a new pool setting (domain-cleanup) to disable the deletion of machines from AD (see more details in the doc http://docs.oracle.com/cd/E26217_01/E26214/html/tshoot-directory.html#tshoot-directory-computer-cleanup).

          HTH,
          Katell
          • 2. Re: VDI interaction with Active Directory
            rmueller
            Thanks...makes sense.

            I think the issue I had was a krb5.conf issue, and then I had to reset the authentication. Did that and poof all works again..

            now new problems...different thread

            ron