hawks76
Enthusiast
Enthusiast

AD Integration/Customization Spec vRA 8.9/8.10 created 2 AD Computer Objects

We have been using vRA 8.x since Sept. 2022.  No issues at all with deployments up until Dec. Suddenly, deployments started creating 2 AD Computer objects (1 that is prestaged by vRA and another that is created when joined to the domain by customization spec). I have a support request open with VMware, but so far they have been stumped.  Wondering if anyone else has seen something similar. I've narrowed it to something with the customization spec through testing different configurations on blueprints. For whatever reason, the cusotmization spec stopped seeing the staged computer object in the a specified OU and creates a new on in the default OU

0 Kudos
3 Replies
DanielStastka
Contributor
Contributor

I create a Computer-Object on Subscription by "compute.provision.pre" by Build-in vRo Workflow "Create a computer in an organizational unit".  If you have large AD-Enviroment you must check thats replication of ad-objects are on all DC's. It's possible thats Computer-Object are not on all DC's present. I think the best time is to create that before cloning.

The Join to AD will performed by Sysprep "VM Customization Specifications" (vSphere). Sysprep does not support Join with specified OU. He take the existing Object.

Testet on vRA 8.6/8.8/8.10

You can create own workflow with "netdom join"  Join domain to a specific OU for guest operating system customization. (88471) (vmware.com)

By default, Active Directory will not allow a duplicated computer name in the Domain. Attempting to rename or join a machine with an existing name will cause the error as "Object already exist" or similar.

Dany

Tags (2)
0 Kudos
hawks76
Enthusiast
Enthusiast

I understand Customization Specs don't have the ability to create AD objects in specific locations, by prior to early December, when the customization spec was applied by vCenter as part of vRA provisioning, it always saw the pre-existing AD object created by the AD Integration in vRA and joined the domain using that object instead of creating a new one.

0 Kudos
DanielStastka
Contributor
Contributor

Windows updates released on and after 11. October 2022, contain additional protections introduced by CVE-2022-38042. Maybe is that your Problem. What was your last update from your template?

You can change the Owner of ComputerObject or you change regestry-Value of NetJoinLegacyAccountReuse on your template.

0 Kudos