VDM Pooling, issue adding VMs to AD over existing computer accounts

[mark_j]

I've read through this discussion board and haven't found anyone else with this particular issue of mine.

A little background..

VDM 2.1 on domain A , customization setup to add computers to Domain A using domain admin credentials for domain A.

VirtualCenter and ESX hosts on DomainB. No shared DNS between domain A and B, we use host file entries on all clients that need resolution.(but its probably not relavant to this problem)

The template was added to the domain before being converted to a template, agent is running, and the customization is running sysprep to change the SID.

OK. Non-persistant pool. When I deploy a VM through VDM and the computer account does not exist in AD, it creates it properly. If the account already exists from a previous instance of a similarly named VM, it disables the computer account. If I go in AD and manually enable the account, all is well.

If I go in to VirtualCenter to deploy the template manually, it does the same thing - disables the existing computer account. When I enable it, all is well immediately.

Ideas anyone?The goal is to successfully add a new VM to a pool and properly taker ownership of an existing computer account.

[mike_laspina]

Hi,

Did you leave the base image in a workgroup before it was set as the template?

If it was not then I think you would initially have a GUID collision.

[mark_j]

I have tried with the template on the domain and on a workgroup, each have the same result.

If I manually (windows gui) add the created computer to the domain over an existing computer account, it also disables the computer account in AD. But the difference with this is, then the computer can successfully access domain resources. Which strange, because if a computer account is disabled in AD you'd assume it couldn't access domain resources.

I've appended the bottom of the guestcust file. It appears the customization did add the computerr successfully to the domain, but for some reason the domain disables the account afterwards.

Successfully opened key SOFTWARE\VMware, Inc.\Guest Customization\

Size of reg_multi_sz 21.

Read multi_sz value from registry autocheck autochk *, size 21.

string value from registry autocheck autochk *.

Returning 1 elements

Successfully opened key SYSTEM\CurrentControlSet\Control\Session Manager\

Size of reg_multi_sz 22.

Read multi_sz value from registry sysprepDecrypter.exe, size 22.

string value from registry sysprepDecrypter.exe.

Returning 1 elements

Going to delete file C:\WINDOWS\system32\sysprepDecrypter.exe

Deleted file C:\WINDOWS\system32\sysprepDecrypter.exe

Creating object for MAC: 00:50:56:9e:16:eb

SELECT * FROM Win32_NetworkAdapter WHERE MACAddress = '00:50:56:9e:16:eb' and Manufacturer != 'Microsoft'

Found 1 objects. Pointer 7a0308. return code 0(0x0)

Found 0 objects. Pointer 0. return code 1(0x1)

Returning value
TESTF1\ROOT\CIMV2:Win32_NetworkAdapter.DeviceID="1" for system property

ASSOCIATORS OF {
TESTF1\ROOT\CIMV2:Win32_NetworkAdapter.DeviceID="1"} where ResultClass = Win32_NetworkAdapterConfiguration

Found 1 objects. Pointer 7a04a0. return code 0(0x0)

Found 0 objects. Pointer 0. return code 1(0x1)

Setting tcpip netbios options to 0

Getting method object for method name SetTcpipNetbios

Set status called with flag 0, result 0

Returning value
TESTF1\ROOT\CIMV2:Win32_NetworkAdapterConfiguration.Index=1 for system property

Joining domain domain using account domainadmin and password '*****'

Unable to update the password. The value provided as the current password is incorrect.

Retrying join operation with user = domainadmin@domain

Successfully joined domain on second try.

Customization in progress set to 0 at 2008-Jun-24 08:28:49

Rpci: Sending request='deployPkg.update.state 5 0 C:\WINDOWS\TEMP\vmware-imc\guestcust.log'

Rpci: Sent request='deployPkg.update.state 5 0 C:\WINDOWS\TEMP\vmware-imc\guestcust.log', reply='', len=0, status=1

SysprepDecrypter has unobfuscated the password successfully

[Ainsley_Campbel]

Hi Mark,

I am having the same issue... I want to add computers to domain w/o giving it Domain Admin rights. We have delegated rights to a domain user account to join computers to domain under a specific OU. VMware support has no answers.... Looks like a bug...

[mark_j]

I'm working on using netdom to get around it. If I use a script that run the netdom join command on first log then reboots, it seems to take care of the issue. It's strange how netdom join would work perfectly, but the customization wouldn't - they must not work the same way.

[Ainsley_Campbel]

Thats cool... but my issue will be running additional scripts after joining domain.. So will have logon twice to run scripts... It would be easier for me to enabled the computer account.

[mark_j]

Not if you configure the customization wizard to automatically login 1 time after it's created. No?

[Ainsley_Campbel]

Not sure.. Do you know how to modify the sysprep.inf VMWare is using? We can proberly add server to domain and specify the exact OU to add server.. So we don't have to pre-create computer account..

[mark_j]

when you use netdom join, you can specify the OU it joins the computer to.. and it actually works i was amazed. i don't modify sysprep, you can add run-commands via the customization wizard. You can specify the computer to login 2x times if you need to, then have a script reboot afterwards. when using non-persistant pools i can't be concerned with enabling all the computer accounts, so i need it to be automated.

I personally didn't modify the sysprep, but you can do it fairly simply when you create a customization. It will allow you to paste in the contents of the sysprep.ini as an unattended installation

[Ainsley_Campbel]

Sorry.. I understand what you are doing... But @ what point are you running your netdom script? Are you setting the script to run before you convert to template..

[mark_j]

Yes, I set my script to run once then delete itself since it has credentials in it. It's very crude, but it works. Alternatively I could probably just run it from a network location.

I tried the "Run" section of the customization wizard, but it didn't work consistantly.. a batch script is fairly bullet proof. I'm still disappointed the customization wizard wouldn't properly add computers to the domain over existing computer accounts, hopefully domain-joining/cleanup will be improved in future releases.

[mark_j]

I determined the best solution would be to use a combination of the netdom join command and 1 automatic logon when a VM is created, followed by a reboot and deleting of the script that had the netdom credentials.