7.0

Creating an OU for Remote Desktops
You should create an organizational unit (OU) specifically for your remote desktops. An OU is a subdivision
in Active Directory that contains users, groups, computers, or other OUs.
To prevent group policy settings from being applied to other Windows servers or workstations in the same
domain as your desktops, you can create a GPO for your View group policies and link it to the OU that
contains your remote desktops. You can also delegate control of the OU to subordinate groups, such as
server operators or individual users.
If you use View Composer, you should create a separate Active Directory container for linked-clone
desktops that is based on the OU for your remote desktops. Administrators that have OU administrator
privileges in Active Directory can provision linked-clone desktops without domain administrator privileges.
If you change administrator credentials in Active Directory, you must also update the credential
information in View Composer.
Creating OUs and Groups for Kiosk Mode Client Accounts
A client in kiosk mode is a thin client or a locked-down PC that runs the client software to connect to a View
Connection Server instance and launch a remote desktop session. If you configure clients in kiosk mode, you
should create dedicated OUs and groups in Active Directory for kiosk mode client accounts.
Creating dedicated OUs and groups for kiosk mode client accounts partitions client systems against
unwarranted intrusion and simplifies client configuration and administration.
See the View Administration document for more information.
Creating Groups for Users
You should create groups for different types of users in Active Directory. For example, you can create a
group called View Users for your end users and another group called View Administrators for users that
will administer remote desktops and applications.
Creating a User Account for vCenter Server
You must create a user account in Active Directory to use with vCenter Server. You specify this user account
when you add a vCenter Server instance in View Administrator.
You must give the user account privileges to perform certain operations in vCenter Server. You can create a
vCenter Server role with the appropriate privileges and assign the role to the vCenter Server user. The list of
privileges you add to the vCenter Server role varies, depending on whether you use View with or without
View Composer. See “Configuring User Accounts for vCenter Server and View Composer,” on page 97 for
information on configuring these privileges.
If you install View Composer on the same machine as vCenter Server, you must add the vCenter Server user
to the local Administrators group on the vCenter Server machine. This requirement allows View to
authenticate to the View Composer service.
If you install View Composer on a different machine than vCenter Server, you do not have to make the
vCenter Server user a local administrator on the vCenter Server machine. However, you do have to create a
standalone View Composer Server user account that must be a local administrator on the View Composer
machine.
Chapter 5 Preparing Active Directory
VMware, Inc. 31