Integrating with an Existing Active Directory Domain

Flexxible|Suite only supports Active Directories within Organizational Units built-in English. If English is not the AD language, the group "Authenticated users" won´t exist. This can lead to very poor performance.

Integrate with Active Directory Forest

In this case, during the domain integration process, a trust relationship is not needed between the resources and the customer domains. Also, all the objects or items involved such as Groups, GPOs, OUs, etc are included in the client domain. Therefore, the client is able to customize the Groups and the OUs. Apart from that, we should follow the same process we did for the integration with an Active Directory, which has already been illustrated in this article.

Remark

When you choose to integrate your Windows domain into the deployment, a series of changes are made to your domain controller to integrate it into the automatic orchestration process.

During the domain integration process for full and mixed deployments, a trust relationship will be created between the resource domain, so you'll have an environment that works in two domains:

• Desktops, application servers, and templates will be in the customer domain.
• Citrix servers, hypervisors, and the rest of the infrastructure will be in the resource domain.

Note: in full integration deployments all users, machines, GPOs, and even the infrastructure servers will be in the customer domain.

In addition, a number of requirements must be met, such as:

• Conditional forwarders are created in both domains so that they can be resolved between them (only for full and mixed deployment).
• FlexxibleIT Organizational Unit (OU) is created with full account control permissions for the FlexxibleVDIServices account. This group contains the MSA accounts used by the orchestration layer.
• The structure of OUs, groups, and users created from this OU (Desktops, AppServers, etc.) is the following:

• Security groups: to manage the activation of functionalities on users and resources, new groups will be created within the base organizational unit. The list of groups to be created is as follows:
  • Template Designers: users with permission to edit templates
  • Users: all users in the virtualization environment
  • Managers: administrators of the environment
  • Remote support team: users who can provide remote assistance to other users
  • Users with USB redirection: enable USB redirection
  • Users with COM redirection: activation of COM redirection
  • Users with LPT1 redirection: activation of LPT1 redirection
  • Users with Local Units redirection: enable redirection of local units
  • Users with Audio redirection: enable audio redirection
  • Users with Printer redirection: enable printer redirection
  • Users with TWAIN redirection: enable TWAIN redirection
  • Users with Network drive redirection: enable network drive redirection

AD Integration for Flexxible|Appliances

There are two types of integration with client domains for deployments performed on Flexxible|SUITE:

1. Mixed deployment: The Resource domain, which is integrated with an existing client domain gets auto-generated. A two-way Trust relationship between both domains is created.
2. Full integration: No Resource domain generated, as the entire solution is installed under an existing domain. There is no trust relationship created for this deployment.

The possibility to integrate multiple domains will be enabled depending on the type of deployment:

1. Enterprise Deployment, it allows integration with only ONE client domain.
2. MT Deployment(multitenant), it allows integration with multiple domains in two formats:
   1. Dedicated Domain, a domain will be imported from Active Directory to be totally dedicated to a single tenant. It can be a client in the DaaS environments, a site in a multisite client, a department in a large company, etc.
   2. Multitenant Domain, a domain will be imported enabling the multitenant functionality, which allows the orchestration of different clients (or sites, departments, etc) in the same domain isolating each tenant into a unique 'domain OU' and orchestrating all the processes related to the mentioned tenant under this specific "Base OU".

In Multitenant environments, each tenant has a tenant code which is made of three characters. Such code, which is the tenant code in a multitenant domain, also represents the name of the tenant's Base OU.

In both cases, the requirements are shown below:

Users and Groups

The following users and groups should be created for the specified domains:

The Users and Groups specific for Flexxible|SUITE can be created in any OU, although for the sake of the infrastructure management, the prefered OU would be *\VDI OS\Users.

OUs

A series of OUs are required in the client/MT domain and in the infrastructure domain as well. In the client domain, only one OU is required. In a Multitenant environment, a Base OU should be created for each tenant. For both cases, the results will be the following (See below):

Regarding the OUs created in the infrastructure domain:

Permissions

The below table includes a brief description of the privileges to be granted:

Group Directives

Several group directives should be imported to assure the right performance of Flexxible|SUITE and its relationship to some OUs (Once they have been created inside the VDI OS OU).

VDI OS OU

An OU is needed to host all the domain objects used by Flexxible|SUITE:

• OUs (children)
• Users (optional, as they would already exist in the client OUs)
• Groups used by Flexxible|SUITE
• Equipment Account
• Service Account

The OU may not be a child of the Root Domain. However, it is recommended to enable the "Block inheritance" option so that the defined GPOs are not applied accidentally at any level above the OU, except in cases, the "enforce" option has been checked intentionally.

Service Accounts

It is required to create the Managed Service Accounts needed to identify the VDI OS services.

It is recommended that the “MSA” prefix is included in the accounts names, and also the name of their corresponding infrastructure server. For example, for the server DB01, the name of the MSA account should be MSADB01$.

“VDI OS Services” Group

In the OU created for Flexxible|SUITE, the group is formed by the Managed Service Account of the Flexxible|SUITE services. This group should:

• Have the MSA accounts created for our infrastructure machine included as members of the group
• Have Local Administrator privilege on the six Flexxible IT machines as the mentioned services send commands over the machines, which require privileges (to get the system uptime, analyze and start services, restart or shut down the machine, etc).
• Have Local Administrator access to the templates which use Personal vDisk. If this is not the case, Flexxible|SUITE won´t be able to process the template inventory during the Ready for Deploy process.

The “AD Accounts / VDIOSServicesGroup” parameter should be notified within the Domain\Name\Group associated with this group. 

DDControllers Group

This group should be formed by the AD accounts of the Desktop Delivery Controllers for all the XenDesktop sites, as it is used to grant access to XenDesktop to create objects in the "Desktops" OU.

Once the group is created, its name will be included in the “AD Accounts / DDControllersGroup” application parameter

This group must have the following permissions on the OUs where the machines are created:

Redirection Groups

The Groups of Users to be created are:

• Double factor authentication (Deprecated 4.4)
• USB redirection
• COM redirection
• LPT1 redirection
• Local Units redirection
• Audio redirection
• Printer redirection
• TWAIN redirection
• Network drives redirection

These groups should be included in the VDI OS parameters, in the “Users policies” Group and in the VDI OS Domain properties.

Please, refer to the Active Directory Integration for FLEXXIBLE|Appliances for more information.