Traditionally, virtual desktops run Windows, and the servers that provide the virtual desktop infrastructure services also run on Windows. Because of the heavy reliance on Windows, Active Directory plays a huge role in Horizon environments. Even Linux desktops, which are a new option, can be configured for Active Directory and utilize the Horizon user’s AD credentials for Single Sign-On.
When you’re planning a new Horizon deployment, or re-architecting an existing deployment, the design of your Active Directory environment is a critical element that needs to be considered. How you organize your virtual desktops, templates, and security groups impacts Group Policy, helpdesk delegation rights, and Horizon Composer.
Some Active Directory objects need to be configured before any Horizon View components are installed. Some of these objects require special configuration either in Active Directory or inside vCenter. The Active Directory objects that need to be set up are:
- An organizational unit structure for Horizon Desktops and desktop templates
- Basic Group Policy Objects for the different organizational units
- An organization unit for Microsoft RDS servers if published apps or RDSH-desktops are deployed
Optionally, you may want to set up an organizational unit for any security groups that might be used for entitling access to the Horizon View desktop pools. This can be useful for organizing those groups and/or delegating access to Help Desk or other staff who don’t need Account Operator or Domain Administrator rights.
CREATING AN ORGANIZATIONAL UNIT FOR HORIZON DESKTOPS
The first think that we need to do to prepare Active Directory for a Horizon deployment is to create an organizational unit structure for Horizon View desktops. This OU structure will hold all of the desktops created and used by Horizon View. A separate OU structure within your Active Directory environment is important because you will want to apply different group policies to your Horizon desktops than you would your regular desktops. There are also specific permissions that you will need to delegate to the Horizon Composer and/or Instant Clones Administrator service account.
There are a lot of ways that you can set up an Active Directory OU structure for Horizon. My preferred organizational method looks like this:
View Desktops is a top-level OU (ie – one that sites in the root of the domain). I like to set up this OU for two reasons. One is that is completely segregates my VDI desktops from my non-VDI desktops and servers. The other is that it gives me one place to apply group policy that should apply to all VDI desktops.
I create three child OUs under the View Desktops OU to separate persistent desktops, non-persistent desktops, and desktop templates. This allows me to apply different group policies to the different types of desktops. For instance, you may want to disable Windows Updates and use Persona Management on non-persistent desktops but allow Windows Updates on the desktop templates.
You don’t need to create all three OUs. If your environment consists entirely of Persistent desktops, you don’t need an OU for non-persistent desktops. The opposite is true as well.
Finally, I tend to create use-case specific OUs for pools that require additional Group Policy options above and beyond the top-level. These grandchild OUs are completely optional. If there is no need to set any custom policy for a specific use case, then they don’t need to be created. However, if a grandchild OU is needed, then an entire pool will need to be created as desktop pools are assigned to OUs. Adding additional pools can add management overhead to a VDI environment.
I’ve found that there is less of a need for these use-case specific OUs as I’ve learned more about modern UEM tools like RES and VMware User Environment Manager. These tools can be a scalpel that allow administrators to dynamically apply context-aware policies and settings to specific users or groups without having to create additional pools or OUs for Group Policy configurations.
Creating an Organizational Unit for RDS Servers
Horizon 6.0 added PCoIP support for multi-user desktops running on Windows Server with the Remote Desktop Session Host role. These new abilities also added support for remote application publishing.
RDSH servers need to be handled differently than virtual desktops. They’re managed differently than your virtual desktops, and some features such as Persona Management are not available to RDS servers.
If application remoting or multi-user desktops are going to be deployed, an organizational unit for RDS servers should be created underneath your base servers organizational unit. Since RDSH servers are often heavily locked down through Group Policy, I also recommend creating an RDSH Maintenance Mode OU. This OU is where RDSH servers can be placed when administrators need to remove restrictive group policies such blocking the command prompt or MSI installers removed to perform maintenance on the server.
Horizon Group Policy Objects
Horizon contains a number of custom group policy objects that can be used for configuring features like Persona Management and optimizing the PCoIP protocol. The number of Group Policy objects and templates is same as what was available in Horizon 6.
Unfortunately, most of the Group Policy templates are distributed as ADM files. There are a number of drawbacks to ADM files in modern Active Directory environments. The main one is that you cannot store the Group Policy files in the Central Store.
If you plan on using the Group Policy templates, it’s a good idea to convert them into the ADMX format. I had previously written about converting the View Group Policy templates into the ADMX format and the reasons for converting here.
Horizon Service Accounts
Horizon requires a service account for accessing vCenter to provision new virtual machines. If Horizon Composer or Instant Clones are used, a second service account will be needed to create computer accounts in Active Directory for managing computer accounts for the clones. I will cover setting up those account in a future section.
In the next section, I’ll cover SSL certificates for Horizon servers.
The Virtual Horizon 
You must be logged in to post a comment.