The account running the CVAD Setup Wizard should have the following permissions for the OU specified in the wizard.

• Create Computer Objects
• Delete Computer Objects
• Read Computer Objects
• Write Computer Objects

If any of these permissions are missing, the wizard may report an Active Directory permission error and stop processing.

An example investigation the wizard reported that the user does not have permission to delete computer accounts.

Permissions can be checked in Active Directory Users and Computers, by checking the Advanced Permissions on the OU and using the Effective Permissions tab.

When checked the user had correct permissions on the OU specified in the Wizard, but still the Wizard failed reporting that the user does not have permission to delete computer accounts.

"The above mentioned sample code is provided to you as is with no representations, warranties or conditions of any kind. You may use, modify and distribute it at your own risk. CITRIX DISCLAIMS ALL WARRANTIES WHATSOEVER, EXPRESS, IMPLIED, WRITTEN, ORAL OR STATUTORY, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT. Without limiting the generality of the foregoing, you acknowledge and agree that (a) the sample code may exhibit errors, design flaws or other problems, possibly resulting in loss of data or damage to property; (b) it may not be possible to make the sample code fully functional; and (c) Citrix may, without notice or liability to you, cease to make available the current version and/or any future versions of the sample code. In no event should the code be used to support ultra-hazardous activities, including but not limited to life support or blasting activities. NEITHER CITRIX NOR ITS AFFILIATES OR AGENTS WILL BE LIABLE, UNDER BREACH OF CONTRACT OR ANY OTHER THEORY OF LIABILITY, FOR ANY DAMAGES WHATSOEVER ARISING FROM USE OF THE SAMPLE CODE, INCLUDING WITHOUT LIMITATION DIRECT, SPECIAL, INCIDENTAL, PUNITIVE, CONSEQUENTIAL OR OTHER DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Although the copyright in the code belongs to Citrix, any distribution of the sample code should include only your own standard copyright attribution, and not that of Citrix. You agree to indemnify and defend Citrix against any and all claims arising from your use, modification or distribution of the sample code."

In the example investigation the PVS CVAD Setup Wizard reported that the user does not have permission to delete computer accounts, despite the user having correct permissions in the OU specified.

However, it was not clear that the deletion failure was in reference to another OU, where the test account --PVS--TEST--- already existed, but the user did not have delete permissions.

Because the account already existed and existed in an OU where the user did not have permission, the wizard could not complete its validation account and subsequently failed.

Before creating target devices, the CVAD Setup Wizard performs Active Directory validation checks.

As part of this validation process, the wizard attempts to:

1. Create a temporary test computer account named: --PVS--TEST---
2. Then confirms it can delete the temporary account.

Use the following PowerShell script to verify the account running the PVS CVAD Setup Wizard can create computer objects in the target OU, matching the testing completed by PVS CVAD Setup Wizard.

If there are any failures the output can be used to identify the problem and the script can be run again afterwards to validate no further issues remain.

#Create test computer account
$ou = [ADSI]"LDAP://OU=PVS,OU=Reproductions,DC=lab,DC=local"
$comp = $ou.Create("computer", "CN=--PVS--TEST---")
$comp.Put("sAMAccountName", "--PVS--TEST---$")
$comp.SetInfo()

#Delete test computer account
$dn = "CN=--PVS--TEST---,OU=PVS,OU=Reproductions,DC=lab,DC=local"
#Bind to the object
$comp = [ADSI]"LDAP://$dn"
#Bind to the parent OU
$parent = [ADSI]$comp.Parent
#Delete the computer object
$parent.Delete("computer", "CN=--PVS--TEST---")

An example investigation used the script, and it showed a failure executing the first part around account creation, showing the account already existed.

Searching active directory for the account --PVS--TEST---, found a stale --PVS--TEST--- account already existed in another OU where the user did not have delete permission.

Removing the stale account resolved the issue, allowing PVS CVAD Setup Wizard to complete its checks correctly and then proceed with the rest of PVS target device creation.

When running Citrix Provisioning Services (PVS) CVAD Setup Wizard, administrators may receive errors relating to Active Directory computer account creation, deletion, or permission validation.

Common symptoms include:

• CVAD Setup Wizard reports insufficient permissions.
• Machine creation fails during validation.
• AD account creation succeeds manually but fails from the wizard.
• Existing AD computer accounts prevent machine creation.
• Wizard reports account creation or deletion failures despite delegated permissions.