Virtual Desktop access not possible when joined to a domain

[ragazzi]

Hi,

I have set up a VDI infrastructure (ESX Server, VDM, VC). Everything works fine and I could create a Template workstation from where I created two guest workstations (virtual desktops). Both are working without problem when they are in a Workgroup. Then I joined one of them to the company domain. This worked without issues. Unfortunately, as soon as the guest workstation has joined the domain, it was not accessible anymore from a physical client connectig via the VDM to the virtual desktop. It seemed that a RDP connection could not be established with the client. Pinging the workstation resulted in no answer (A network analyser installed on the workstation showed that the ICMP packets (Ping) requests arrived at the workstation, but the workstation did not send a reply...). I know this is typical behavior for a Firewall or a Antivirus software, but we considered this and there should be nothing which blocks any communication.

Has anyone an idea what might be the issue here?

[korpy]

Hi Ragazzi,

Are you sure about teh firewall thing? There could be a domain policy active which enables the windows firewall.

greetz -frank-

[ragazzi]

Thanks for your answer. We really checked the firewall issues and hot even the service is running (On the virtual machin). Altough, I will check the policies, maybe there is somethin which prevents the access.

[TomHowarth]

are you sure that the domain user group is in the local Remote Desktop Group

Tom Howarth

VMware Communities User Moderator

[mittim12]

In my opinion if you are able to login to the VM's console from the VI client using a network username and password and then utilize network resources such as file shares and printers then it is definitely some type of firewall or ipsec policy being pushed by GP. I hope that you get it resolved.

If you found this or any other post helpful please consider the use of the Helpful/Correct buttons to award points

[jswt]

I had a connection issue like that after I installed sp3, after I uninstalled it and uninstalled / reinstalled the agent it seemed to work fine again. Also be sure to check that remote desktop connections are enabled uner your system settings, and that your domain account has rights to access the remote desktop connection.

[ragazzi]

Thanks for your answers guys. The problem is solved. We checked the policies and no policy prevented any acces. So I tried again to start the virtual desktop on my workstation. I wanted to wait until a error message appear. Surprisingly, no error message appeared and the virtual desktop started maybe 5-8 minutes after starting it. From then on starting took only a few second.

It semms to me that, especially when joined to a domain, it takes a long while to start up the virtual desktop from a workstaion the first time.

Thanks again for your support!

[ragazzi]

I have to re-open the thread. I still have problems after creating a virtual desktop to access it by RDP but I managed to get them working. Maybe someon had the same problem and knows an answer.

Here's how I have to proceed to get the virtual Desktop running in a Domain and access it by RDP directly or through the VDM Client.

After I creted the virtual desktop from the template, a Computer account in the Active directory is created but not located in the directory where all other computers are. So I move the computer account to the correct place.

then I have to login to the virtual desktop an take it out of the domain manually. After the reboot I can join the workstation again to the domain using also the domain suffix .local (I.e. <domainname>.local). Then reboot again. The it works.

Has anyone an idea why this procedure is needed? Should in the configuration file which is used to configure the created virtual machines, contain the complete domainname --> <domainname>.local ??

Should the computer account in AD being created before the virtual machine is created from the template?

[TomHowarth]

I have to re-open the thread. I still have problems after creating a virtual desktop to access it by RDP but I managed to get them working. Maybe someon had the same problem and knows an answer.

Here's how I have to proceed to get the virtual Desktop running in a Domain and access it by RDP directly or through the VDM Client.

After I creted the virtual desktop from the template, a Computer account in the Active directory is created but not located in the directory where all other computers are. So I move the computer account to the correct place.

then I have to login to the virtual desktop an take it out of the domain manually. After the reboot I can join the workstation again to the domain using also the domain suffix .local (I.e. <domainname>.local). Then reboot again. The it works.

Has anyone an idea why this procedure is needed? Should in the configuration file which is used to configure the created virtual machines, contain the complete domainname --> <domainname>.local ??

Should the computer account in AD being created before the virtual machine is created from the template?

It sounds to me that you are having duplicate SSID issues in the domain. when you provsion the XP Guest, are you running Sysprep on it to give it uniqueness. my reasoning behind this is fact that if you remove the guest from the domain and rejoin it it works, the removal of the machine from the domain removes the duplicate SSID by removing it from the guests registory, when you re-add it to the domain it recreates a new SSID that is unique to the domain.

Remember to award points for helpful and correct answers

Tom Howarth

VMware Communities User Moderator

[ragazzi]

Does Sysprep not taking care of duplicate SSID's? Why am I the only one having this problem?

UP to now I have found a procedure which works (tested two or three times):

1. Moving the Computer account from the Computers folder into another especially created.

2. Grant Access in the WDM

3. Login as Administrator and configure the Remote login by adding a group which may access remotely a PC

4. Rebooting and login as a normal Domain user

[Ubiratam]

I had some problems like this your the solutions was enable direct RDP in register.

Use this settings:

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware VDM\Agent\Configuration

"AllowDirectRDP"="true"

[]'s

[ragazzi]

Did you add this key or was it already available and you had only to change the value? I don't see this regi key on my virtual Desktop?

[Ubiratam]

It was created and the value changed to true.

Use teh reg file attached.

[]'s

[mittim12]

That resolution that that key gives should only affect a VM with VDM 2.1 agent and the SSO feature installed. By default this blocks direct RDP (VDM still works) and the key specified above will change that value to allow you to RDP into the box. With that being said some of your original symptoms included not being able to ping the host or acessing it through RDP and VDM which I don't think the block direct RDP would cause. You would also get a message when trying to RDP that says somethign to the affect of VMware VDM Agent - Access is Denied". is this the case?

If you found this or any other post helpful please consider the use of the Helpful/Correct buttons to award points