Elastic Desktop Service (EDS) Enterprise supports both convenience accounts and enterprise Active Directory (AD) accounts. When creating office networks (formerly workspaces), you can specify their account types. This topic describes how to create enterprise AD office networks.
Billing rules
Enterprise AD office networks connect to AD systems through AD connectors. Charges are based on a pay-as-you-go model, with fees determined by the duration of use and the unit price of the AD connectors. For more information about the prices of AD connectors of different types, see the AD Connector Price section on the Pricing page in the EDS portal.
Delete your enterprise AD office network if it's no longer in use to avoid unnecessary charges. For more information, see Delete an enterprise AD office network.
Prerequisites
An enterprise AD system is deployed. If the AD domain controller and DNS server are on separate servers, ensure the AD domain controller's DNS address is set to the DNS server's IP address.
A Cloud Enterprise Network (CEN) instance is created, and the virtual private cloud (VPC) of the enterprise AD system and the enterprise AD office network are attached to the CEN instance. For more information about how to create a CEN instance, see Enable communication between cloud and on-premises networks.
NoteTo connect the on-premises and cloud networks, use Express Connect, Smart Access Gateway (SAG), or VPN Gateway if the AD domain controller and DNS server are deployed in an on-premises data center. For more information, see Select a private network service.
Specific ports are opened. The enterprise AD office network's VPC must access the AD domain controller's ports. Ensure these ports described in the following table are open on the domain controller, DNS server, and any security software.
Protocol type
Port/Port range
Description
Authorization object
Custom User Datagram Protocol (UDP)
53
DNS
The IPv4 CIDR block of the office network. Example: 192.168.XX.XX/24.
88
Kerberos
123
Windows Time
137
NETBIOS
138
NETBIOS
389
LDAP
445
CIFS
464
Password change or reset based on Kerberos
Custom Transmission Control Protocol (TCP)
53
DNS
The IPv4 CIDR block of the office network. Example: 192.168.XX.XX/24.
88
Kerberos
135
Replication
389
LDAP
443
HTTPS
445
SMB/CIFS
636
LDAP SSL
9389
PowerShell
Ports 49152 to 65535
RPC
Ports 3268 to 3269
Lightweight Directory Access Protocol (LDAP) Global Catalog (GC) and LDAP GC Secure Sockets Layer (SSL)
Create an enterprise AD office network
Log on to the Elastic Desktop Service Enterprise console.
In the left-side navigation pane, choose .
In the upper-left corner of the top navigation bar, select a region.
On the Office Networks page, click Create Office Network.
In the Create Office Network step, select Advanced Office Network, configure parameters as prompted, and then click Next: Configure Account System. The following table describes the parameters.
In the Configure Account System step, set Account Type to Enterprise AD Account, configure parameters as needed, and then click OK.
In the Create Office Network panel, click Close. On the Office Networks page, find the Status column of the enterprise AD office network.
If the status shows Configure users, the creation is successful. Click the ID of the office network. In the Basic Information section of the office network details page, click Configure to the right of the Status parameter.
If the status shows Configure the domain information, the domain is misconfigured—either the domain name or DNS address is invalid. Click the ID of the office network. In the AD Configuration section of the office network details page, modify parameter settings as needed.
If the status shows Registering, verify the office network's connection to the AD domain server. Click Retry to create a new office network if no problem is found. For more information, see FAQ about AD office networks.
Configure users
In the left-side navigation pane, choose .
In the upper-left corner of the top navigation bar, select a region.
On the Office Networks page, find the office network that you want to manage and click its ID.
On the office network details page, perform one of the following operations:
In the Basic Information section, click Configure to the right of the Status parameter.
In the AD Configuration section, click Configure to the right of the Domain Username parameter.
In the Configure AD Domain panel, enter the domain username and password, confirm the password, and then click Verify.
NoteAD domain users must have permission to add domains and read user properties from the AD domain controller. This allows the system to add cloud computers within the office network to the AD domain controller and assign them.
After the verification is complete, select an OU from the OU drop-down list and click Close.
Once the office network is in the Registered state, you can create cloud computers or establish many-to-many shares within it.
Update the domain controller
After an AD office network is created, if the domain controller address changes, update the domain controller hostname or DNS server address of the AD office network.
In the left-side navigation pane, choose .
In the upper-left corner of the top navigation bar, select a region.
On the Office Networks page, find the office network that you want to manage and click its ID.
Click AD Configuration. Click Edit to the right of Domain Controller Hostname/DNS Address. Enter a new domain controller hostname or DNS server address and click OK.
NoteIf an error occurs during the process, the previous configuration is restored.
Configure local administrators
Only local administrators of cloud computers can download software and perform tasks that require the local admin permissions on the cloud computers. You can choose one of the following methods to configure local administrators:
Method 1: Configure local administrators in the EDS Enterprise console.
Method 2: Configure local administrators in an AD domain controller.
Configure local administrators | Advantage | Disadvantage |
Method 1 | When creating an enterprise AD office network, you can make authorized end users local administrators on cloud computers by selecting the Specify AD User as Local Administrator check box. This grants all permitted users local admin permissions on their assigned cloud computers. | This method grants local admin permissions to end users on their assigned cloud computers within an enterprise AD office network. While simple to implement, it does not support fine-grained permission management. |
Method 2 | You can also grant local admin permissions to specific end users for fine-grained control. | This method allows granting local admin permissions to end users. It requires configuring the permissions for domain users in the AD domain controller and is more complex than Method 1. |
For more information, see FAQ about AD office networks
Manage an enterprise AD office network
Refer to following guides to manage an enterprise AD office network:
Delete an enterprise AD office network
Only office networks with released cloud computers can be deleted. The system stops billing for an AD connector once its associated enterprise AD office network is deleted.
Before you delete an office network, make sure that you have backed up important resources and data of cloud computers in the office network. You cannot restore deleted office networks. Proceed with caution.
In the left-side navigation pane, choose .
In the upper-left corner of the top navigation bar, select a region.
On the Office Networks page, find the office network that you want to delete and click Delete in the Actions column.
In the message that appears, read the message and click OK.
What to do next
After you create an enterprise AD office network, perform the following operations as needed: