Workflow for moving newly provisioned VM to different AD container

[tsmori]

I'm trying to figure out the best way to do this. In vCAC, with a template and customization spec, I can request a VM that will be added to the domain, so that part works. However, that drops the VM into an unspecified container. We have specific containers for different types of VMs for different uses, e.g. database server vs. application server.

I've added the AD plugin to the default vCO instance, but the only available workflows for AD have to do with configuring the AD servers. Is there a better way to automate this? I might be able to script it, but I was sort of hoping for a more out-of-the-box method. Seems to me like it would be a fairly common requirement for self-provisioning.

[Burke-]

The AD plug-in that ships with vCAC 6 built-in vCO server includes more workflows than that... it includes all the Library workflows that the AD plug-in provides such as "Create a computer in an organizational unit", "Enable a computer", etc... there are several workflows available. If you do not specify in the OU a computer should join to then the default behavior of Active Directory is to place the computer object in the "Computers" container. However, if a computer object is already in the Domain with a matching name then upon joining, the new VM will be tied to the existing computer account. For example, if I pre-create a computer account msSQLTest in OU=MySpecialServer,CN=vmware,CN=com then provision out a new Windows server named msSQLTest and have it join the domain, it will be tied to that account I pre-created. An alternative to pre-creating the computer account using the "Create a computer in an organizational unit" workflow or using a PowerShell script to do same would be to use dsmove.exe to move the computer account... of course this would require a Windows based vCO server if you want vCO to do it (For guidance on using the "command" object in vCO, see my post here: How to run a Perl Script from a vCenter Orchestrator Workflow) or figuring out how to run such a command in vCAC

[stacycarter]

I would like to see VMware add a more out-of-the-box solution for this, especially since this is something so BASIC for Windows VMs.  While there are additional AD library workflows, they're not that helpful for this task. Ran into issues having vCAC call the"Create a computer in an organizational unit" because of the input strings (you would have to create a "wrapper"and add it to the workflow to convert the input).  Plus, if you run a modified vCO workflow that does that during machineprovisioning as a stub workflow, you still have to figure out how run the domain join after that stage. Can't use the built-in vCenter customization (unless I call a script) to have it join the domain because I'm using a network profile (see KB).  So then perhaps I'm left to a script. Since this isn't a cheap product, I would like to see this included as a custom property (ie. something native) for cloned machines.  When you have a product like this,  I don't think all of the automation should be me building a bunch of home grown scripts.

[qc4vmware]

Don't get me stared on the AD plugin.  I abandoned it long ago and just wrote some simple wrappers for the windows NT AD commands dsquery, dsadd, and dsmod for the common things I need to do and have been much happier.  The AD plugin breaks with our directory structure and is unusably slow.

With vCAC  I have been using the vSphere customization spec along with a workflow during the buildingMachine workflow stub where I add a machine object to the desired location in active directory.  You can use a property in the blueprint to set that or prompt the user for the location or sit an advanced service in front of it all if you want even more control.  Anyway when the buildingMachine stub kicks off the workflow assigned to it adds a computer object to the correct OU then when the customization kicks in the computer will join and be in the desired OU.

It is a pain in the ass and should be 100% no brainer easy to accomplish task but for whatever reason VMware cannot seem to wrap its head around this.  Hopefully some of this is helpful.  If you would like I can probably go ahead and send you the workflows I created for wrapping the AD commands if you think they will be useful.

[stacycarter]

Hi qc4vmware,

Are you using a network profile for the networking?  When I was trying to use the customization, it seemed that it was trying to join the domain before it got the proper IP.  If you are able to share those vCO workflows you created, I would be interested in checking them out. 

[qc4vmware]

Yes I am using a network and they are getting their ip addresses set correctly.  One thing we have had issues with in our environment when using sysprep to also do the domain join are failures if dhcp is not enabled on the network or there are no available addresses left in the dhcp range defined for that network.  For whatever reason it seems like there is a brief period where that must be available for the domain join to occur.  Also are you testing with W2K8 or 2012?  There area some bugs we've recently hit that caused customizations to fail on 2012 that appear to be resolved in later versions of vCenter.  Both 5.0 and 5.1 had these issues and later updates address it.

[stacycarter]

Ah, ok, there is no DHCP available on the network these VMs are getting placed on.  I'm testing on Windows 2008 R2.

[qc4vmware]

Then dhcp might be the culprit.  It should be easy enough to test if you can create a small range.

[stacycarter]

I'm sure if I made DHCP available on this network, that would resolve the issue, but was not planning on going that route....

[tsmori]

In a way I have an answer, which is that this is more difficult than it needs to be. Some how I can tell VMware View what container to put new machines into when it creates desktops and joins them to the domain, but there's no easy way to do that in vCAC, which really doesn't make any sense to me. The network shouldn't make a difference. If I'm using a network profile and have an IP range provided, the machine should get an IP, join to the domain and then have some way to be moved to a specific OU.

Also, I'm almost positive that there's a method in sysprep itself to add new machines to a specific OU, however that may only apply if I'm building a new machine and not cloning from a template. After reading the responses here, it almost seems like this should be a function of the vCenter customization spec, rather than an entire workflow.

[AEsansun2]

So is there any simple answers. After i deployed a vm and joined the domain how can i move it to a specific ou

[steve669]

Can you share your workflow that you used for this?

Steve

[RidwaanK786]

Has the srcipt been shared