6.1

Users are authenticated against Active Directory for the View Connection Server host's domain and against
any additional user domains with which a trust agreement exists.
NOTE Because security servers do not access any authentication repositories, including Active Directory,
they do not need to reside in an Active Directory domain.
Trust Relationships and Domain Filtering
To determine which domains it can access, a View Connection Server instance traverses trust relationships
beginning with its own domain.
For a small, well-connected set of domains, View Connection Server can quickly determine the full list of
domains, but the time that it takes increases as the number of domains increases or as the connectivity
between the domains decreases. The list might also include domains that you would prefer not to offer to
users when they connect to their remote desktops and applications.
You can use the vdmadmin command to configure domain filtering to limit the domains that a View
Connection Server instance searches and that it displays to users. See the View Administration document for
more information.
Creating an OU for Remote Desktops
You should create an organizational unit (OU) specifically for your remote desktops. An OU is a subdivision
in Active Directory that contains users, groups, computers, or other OUs.
To prevent group policy settings from being applied to other Windows servers or workstations in the same
domain as your desktops, you can create a GPO for your View group policies and link it to the OU that
contains your remote desktops. You can also delegate control of the OU to subordinate groups, such as
server operators or individual users.
If you use View Composer, you should create a separate Active Directory container for linked-clone
desktops that is based on the OU for your remote desktops. Administrators that have OU administrator
privileges in Active Directory can provision linked-clone desktops without domain administrator privileges.
If you change administrator credentials in Active Directory, you must also update the credential
information in View Composer.
Creating OUs and Groups for Kiosk Mode Client Accounts
A client in kiosk mode is a thin client or a locked-down PC that runs the client software to connect to a View
Connection Server instance and launch a remote desktop session. If you configure clients in kiosk mode, you
should create dedicated OUs and groups in Active Directory for kiosk mode client accounts.
Creating dedicated OUs and groups for kiosk mode client accounts partitions client systems against
unwarranted intrusion and simplifies client configuration and administration.
See the View Administration document for more information.
View Installation
26 VMware, Inc.