Background

In a complex Active Directory environment, the scenario would be that the Desktop Delivery Controller (DDC) would be in a different Forest or domain to where the Virtual Desktop Agent (VDA) might reside. This could also be true for users who connect to these Virtual Machines, would be in a different forest or domain to where the DDC and VDA machines might reside.

Following are the examples of environments, which are considered as complex AD environment:

• Multiple Forests with two-way or one-way trusts

• Multiple Forests with selective trusts

• Single Forest with multiple domains

Note: Two way trust is mandatory for VDI deployments using Windows Server 2012 and Windows Server 2016. For more information, refer - Server 2012 VDI collection require two-way trust when adding user group of external domain.

The following environments assume that XenDesktop 5.x is installed on all DDCs and VDAs. This article is based on the registry based Controller Discovery – this is the recommended method for multiple forest registration.

The NetBIOS and Fully Quality Domain Name (FQDN) can be different. For example, the NetBIOS name could be BOB but the FQDN could be parent1.local or the NetBIOS name and FQDN can be the same:
Example: NetBIOS name is parent and the FQDN would be parent.local.
Note: Dots in NetBIOS names are not recommend.

Appropriate user access permissions are given for successful machine creation. In a cross-forest setup, use Delegation Control Wizard to keep permissions to minimum use. Permission must be given for the DDC Administrator to create machines in a different forest in a specific Organizational Unit (OU). The following minimum permission can be given for successful machine creation:

1. Open Active Directory Users and Computers Microsoft Management Console (MMC).

2. Right-click your OU and select Delegate Control.

3. On the first screen, click Next.

4. In the Users & Groups screen, click Add and pick a user or group you want to delegate rights to and click Next.
   The best practice is to assign a group rather than a single user, as it is easier to manage and audit.

5. In the Tasks to Delegate screen, select Create a custom task to delegate and click Next.

6. In the Active Directory Object Type screen, select Only the following objects in folder and select Computer objects.

   

7. Select Create selected objects in this folder and click Next.

8. In the Permissions screen, select General and then select Read and Write.

9. Click Next.

   

10. Click Finish to complete the delegation control.

Different types of Active Directory Setups

Simple Single Domain Deployment

The following diagram illustrates a XenDesktop deployment in a single Active Directory domain, where the DDCs, VDAs, and the users are all in the same domain.

In this Single domain setup, all relevant components and objects are based on one single domain. Registration of VDAs with the DDC should be successful and no additional configuration, that is, the registry key changes is required.

Following is a list to check if VDA is unable to register with the DDC:

1. Check Event Viewer for errors on both the DDC and the VDA.

2. Ensure that the firewall is open for port 80 between the VDA and the DDC.

3. Check that the FQDN of the DDC is correct in the registry setting of the VDA machine. On the VDA, check the following Reg Key:
   Caution! Refer to the Disclaimer at the end of this article before using Registry Editor.
   HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\VirtualDesktopAgent\ and confirm the parameter ListOfDDCs had the correct FQDN.
   If using 64-bit Virtual Machine, the VDA Reg Key is HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\VirtualDesktopAgent\ListOfDDCs

4. Ensure that the DNS settings are correct on VDA and DDC, and both the computers can resolve each other by DNS name and reverse lookups. Use the XDPing tool, downloadable from the Knowledge Center article CTX123278 - XDPing Tool to further troubleshoot.

5. Check that the Time is in sync between the VDA and DDC are correct. 
   For further troubleshooting, see Troubleshooting Virtual Desktop AgentRegistration with Controllers in XenDesktop.

Single Forest with Multiple Domains or Single Forest with Multiple Domains with shortcut trusts

The following two diagrams illustrate a XenDesktop deployment in a single forest with multiple domains and a Single Forest with multiple domains with shortcut trusts - where the DDC, VDA, and Users are all based in different domains.

The following is the illustration for Multiple Domains:

The following is an illustration for Multiple Domains with short cut trusts:

The following diagram illustrates XenDesktop deployment in a Multi-Forest Deployment. This is where the DDC is in a different Active Directory forest and the end users and desktops can be either in the same forest or in a separate Active Directory forest.
Note: For Forest trusts, both Forests must be in Win2003 Forest Functional Level.

The preceding illustration shows two separate Active Directory forest with a two-way forest trust. DDC and Users are in the same forest (parent.local) but the VDAs are located in different forest (parent2.local).

To enable support for DDCs located in a separate forest; this value must be present and set to 1.

Note: The next step is only required if External Trusts are only being used.

1. If the Active Directory FQDN does not match the DNS FQDN or if the domain where the DDC resides has a different NetBIOS name to that of the Active Directory FQDN, you must add the following registry key on the Virtual Desktop Agent machine.
   • For a 32-bit VDA: HKEY_LOCAL_MACHINE\Software\Citrix\VirtualDesktopAgent\ListOfSIDs
   • For a 64-bit VDA: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Citrix\VirtualDesktopAgent\ListOfSIDs

2. • 

The ListOfSIDs registry key contains the DOMAIN SID of the DDC. By using this key, DNS lookups are using the true DNS name of the DDC.

To obtain the correct domain SID of the DDC, the domain SID can be found in the results of the PowerShell cmdlet Get-BrokerController from an elevated PowerShell prompt on the delivery controller. 
Note: You must restart the Citrix Desktop Service for the changes to have an effect.

Multiple Forests with One-Way Selective trusts

The following diagram illustrates XenDesktop deployment in a Multi-Forest Deployment using One-way Selective Trusts. The DDC is in a different Active Directory forest and the end users and existing VDAs (created either manually or through an alternative method) are in a separate Active Directory forest. In a one-way selective trust, automatic creation of Virtual Machines through DDC will fail, because of authentication issues.
For this example, the NetBIOS and FQDN are different in each Forest and domain.
Note: For One-Way Selective trusts, both Forests must be in Win2003 Forest Functional Level or above.

Selective authentication is used in environments where users are explicitly granted/ allowed to authenticate to servers and resources on the trusting domain. This method gives domain administrators control on what rights users can be given to access services on the trusting domain. See Enable Selective Authentication over a Forest Trust for more information on Selective trusts.

Configure the following for successful registration of the VDA with the DDC:

1. DNS for name and reverse lookups. Depending on the approach taken, the use of DNS Forwarders and Conditional forwarders, Forward/Reverse lookup zones, and Stub zones are all acceptable for name lookup/resolution.

2. Create the Selective trust on the relevant Domain Controllers.

3. Follow steps provided in the Multiple Forests with trusts (External trusts - NTLM or Forest trusts Kerberos) section.

4. The VDAs must be granted authentication access to the DDC.  This is done through Active Directory Computer and Users snap-in.
   Note: VDAs can be added to a group to make management easier (granting rights).  This is recommended.
       a)  In Active Directory Computers and Users, browse to the location of the DDCs.
       b)  Right-click DDC and click Properties.
       c)  Click the Security tab.
       d)  Click Add and click Locations to change the domain to where the VDAs reside.
       e)  Click on Advanced, and click on Object Types.  Choose ‘Computers’
       f)  Select all the relevant VDA or Group (recommended) and click OK.
       g)  Select the VDA’s or Group and give the rights – Read and Allowed to authenticate, as displayed in the following screen shot:
    

   1. 1. 

5. On the DDC, select an Existing Catalog and create a relevant Assignment. When done, the Virtual Machines should show in a Ready State, as displayed in the following screen shot:

   

For further troubleshooting of VDA not registering, 

If you see VDA registration failure with event "The registration was refused due to AgentNotContactable" please follow VDA failing to register with the error "The registration was refused due to AgentNotContactable"