Configuring an AD Domain

Scenario

This section describes how to configure the networks of the AD domain and domain user on the console. If the created desktop needs to connect to the Windows AD domain, refer to this section when purchasing a desktop for the first time.

NOTE:

• After you purchase a desktop for the first time, your selection (connecting to the AD domain or canceling the connection to the AD domain) cannot be changed. Exercise caution when performing this operation.
• Multiple subprojects in the same region can interconnect with the same Windows AD server.

Prerequisites

If an AD domain needs to be configured, enable related ports on the AD server by referring to Configuring Network Connection Between Workspace and Windows AD (If multiple subprojects interconnect with the same AD server, connect the network of these subprojects to the network of Windows AD by referring to Configuring Network Connection Between Workspace and Windows AD.) and prepare the following data:

• Domain
• Domain Administrator Account
• Domain Administrator Password
• Active Domain Controller Name
• Active Domain Controller IP Address
• Active DNS Server IP Address
• (Optional) Backup Domain Controller Name
• (Optional) Backup Domain Controller IP Address
• (Optional) Backup DNS Server IP Address

Procedure

(Optional) Setting an enterprise ID

1. Log in to the console.

2. In the navigation pane, choose Tenant Configuration > Basic Settings.

   The Basic Settings page is displayed.

3. Set the enterprise ID.
   NOTE:

   • Enterprise ID is the unique identifier of your tenant environment. End users need to enter the enterprise ID when logging in to the system.

     You are advised to use identifiable fields such as the enterprise name pinyin as the enterprise ID. The enterprise ID can be changed.

   • The enterprise ID contains a maximum of 32 characters and can only include digits and letters.

Configuring the AD domain

4. Configure the connection to Windows AD.
   • Domain Name: Windows AD domain name
   • Domain Administrator Account: administrator name for logging in to the Windows AD server
   • Domain Administrator Password: administrator password for login
   • Active Domain Controller Name: It can be the host name of the AD service or the combination of the host name of the AD service and the domain name.
     • The host name of the AD service: Log in to the AD server using the corresponding IP address, choose Control Panel > System and Security > System to obtain the computer name as the host name, replace the letters of the host name with uppercase letters, and use the host name as the active domain controller name. For example, if the host name is Fa-2016Ad-01, the active domain controller name is FA-2016AD-01.
     • The combination of the host name of the AD service and the domain name: Log in to the AD server using the corresponding IP address, choose Control Panel > System and Security > System, obtain the computer name as the host name, add the domain name to the host name, and use the combined name as the active domain controller name. For example, if the host name is Fa-2016Ad-01 and the domain name is vdesk.cloud.com, the active domain controller name is Fa-2016Ad-01.vdesk.cloud.com or FA-2016AD-01.vdesk.cloud.com.
   • IP Address of Active Domain Controller: service plane IP address of the Windows AD server
   • Active DNS IP Address: service plane IP address of the DNS server
   • Delete Computer Objects on AD
     • Yes: When a desktop is deleted, the computer object in the AD domain is also deleted.
     • No: When a desktop is deleted, the computer object in the AD domain is not deleted.
   • (Optional) Advanced Settings
     • Backup Domain Controller Name
     • Backup Domain Controller IP Address
     • Backup DNS IP Address

Network settings

5. Configure VPC and Service Subnet, as shown in Figure 1.
   Figure 1 VPC and service subnet
   
   • To configure an existing VPC, select an existing VPC and service subnet.
   • To configure a new VPC, click Create on Console, and create a VPC and service subnet. For details, see Creating a VPC.
   NOTE:

   • The resources required by Workspace will be created in the selected VPC subnet. After the desktop is purchased for the first time, the VPC cannot be modified.
   • A VPC is an isolated, configurable, and manageable virtual network environment for cloud desktops, facilitating internal network management and configuration. Your cloud desktops will be created in the selected VPC subnet for your access to the resources and applications on the enterprise intranet.
   • Each desktop has a network interface card (NIC) of a service subnet. The service subnet is used to interconnect desktops and cloud hosts or enterprise intranets for easy access of applications and resources on cloud hosts or enterprise intranets.
   • The DNS server address of the selected subnet will be automatically changed. Do not manually change it. You are advised to select a dedicated Workspace subnet and ensure that the DHCP function is enabled for the subnet.

6. Select a network access mode, as shown in Figure 2. By default, Internet is selected. You can select multiple options.
   Figure 2 Network access mode
   
   NOTE:

   • If you have high requirements on network quality and security, you can purchase Direct Connect and perform network construction in advance. For details, see the Direct Connect Documentation.
   • To enable Direct Connect, you need to create an endpoint service client which is charged. If you disable Direct Connect, the endpoint service client will be deleted.
   • The Direct Connect access mode provides the load balancing capability. You do not need to add a third-party load balancing device in front of the access address.
   • If you want to upgrade the client online through Direct Connect, you need to configure an endpoint (free) for accessing OBS intranet address. For details, see Configuring a VPC Endpoint for Accessing OBS Using the OBS Private Address. For details about the endpoint service of the corresponding site, submit a service ticket.

7. Click Save Configuration to start deploying cloud desktops.

   Cloud desktops are successfully deployed, that is, Workspace has been enabled. You can purchase a desktop.

   If the service fails to be enabled, perform operations as prompted.

Follow-up Operations

To improve network security, you can enable LDAPS so that cloud desktops can communicate with AD server applications through LDAPS. For details, see Configuring AD Domain Certificate Authentication.