Installation

You can place Horizon Agent machines, View Composer servers, and users and groups, in the following
Active Directory domains:
n
The View Connection Server domain
n
A dierent domain that has a two-way trust relationship with the View Connection Server domain
n
A domain in a dierent forest than the View Connection Server domain that is trusted by the View
Connection Server domain in a one-way external or realm trust relationship
n
A domain in a dierent forest than the View Connection Server domain that is trusted by the View
Connection Server domain in a one-way or two-way transitive forest trust relationship
Users are authenticated using Active Directory against the View Connection Server domain and any
additional user domains with which a trust agreement exists.
If your users and groups are in one-way trusted domains, you must provide secondary credentials for the
administrator users in View Administrator. Administrators must have secondary credentials to give them
access to the one-way trusted domains. A one-way trusted domain can be an external domain or a domain
in a transitive forest trust.
Secondary credentials are required only for View Administrator sessions, not for end users' desktop or
application sessions. Only administrator users require secondary credentials.
You can provide secondary credentials by using the vdmadmin -T command.
n
You congure secondary credentials for individual administrator users.
n
For a forest trust, you can congure secondary credentials for the forest root domain. View Connection
Server can then enumerate the child domains in the forest trust.
For details, see "Providing Secondary Credentials for Administrators Using the -T Option" in the View
Administration document.
N Because security servers do not access any authentication repositories, including Active Directory,
they do not need to reside in an Active Directory domain.
Trust Relationships and Domain Filtering
To determine which domains it can access, a View Connection Server instance traverses trust relationships
beginning with its own domain.
For a small, well-connected set of domains, View Connection Server can quickly determine the full list of
domains, but the time that it takes increases as the number of domains increases or as the connectivity
between the domains decreases. The list might also include domains that you would prefer not to oer to
users when they connect to their remote desktops and applications.
You can use the vdmadmin command to congure domain ltering to limit the domains that a View
Connection Server instance searches and that it displays to users. See the View Administration document for
more information.
If a forest trust is congured with name sux exclusions, the congured exclusions are used to lter the list
of forest child domains. Name sux exclusion ltering is applied in addition to the ltering that is specied
with the vdmadmin command.
View Installation
28 VMware, Inc.