All Products
Search

This Product

    Elastic Desktop Service:AD office network FAQ

    Document Center

    Elastic Desktop Service:AD office network FAQ

    Last Updated:Apr 08, 2026

    This topic answers frequently asked questions about creating AD office networks.

    Incorrect domain name or DNS error

    • Symptom

      When creating an AD office network, you may receive the error message Incorrect domain name or DNS.

    • Cause

      This error can occur for the following reasons:

      • During the office network creation, you entered an incorrect value for the Domain Name, Domain Controller Hostname, or DNS address.

      • Network connectivity is missing between your enterprise AD domain controller and the AD office network.

    • Solution

      1. Verify that the configuration parameters for the office network are correct.

        • Check the domain name

          Verify that the domain name is in the correct format, such as example.com.

        • Check the domain hostname

          Verify that the domain hostname is correct.

          Note

          • If the AD domain controller and the DNS server are deployed on different devices, you must specify the domain hostname. This helps the system identify the correct domain controller and ensures the office network is created successfully.

          • If the AD domain controller and the DNS server are deployed on the same device, this parameter is optional.

        • Check the DNS address

          Verify that the DNS address is a valid private IP address, such as 192.168.XX.XX.

      2. Ensure that the VPC containing your AD domain controller and the VPC of the AD office network are connected through a Cloud Enterprise Network (CEN) instance.

        Note

        If your AD domain controller and DNS server are in an on-premises data center, connect your on-premises network to the cloud by using Smart Access Gateway (SAG), Express Connect, or VPN Gateway.

        1. Log on to the AD domain controller.

        2. In the Administrator: Command Prompt window, run the following command to test network connectivity: ping <Connection address>.

          Note

          Find the IP address in the Connection Address field in the AD Settings section of the AD office network details page.

          • A successful ping confirms network connectivity.

          • If the ping fails, attach the VPC of the AD domain controller and the VPC of the AD office network to the same CEN instance.

            If your AD domain controller and DNS server are deployed on different devices, you must attach the VPCs of the AD domain controller, the DNS server, and the AD office network to the same CEN instance.

            Follow these steps:

            • Attach the VPCs of the AD domain controller and DNS server to a CEN instance

              Log on to the Cloud Enterprise Network (CEN) console. On the CEN Instance page, click the ID of the target CEN instance. Then, click the 加号 icon next to VPC and complete the configuration.

            • Attach the VPC of the AD office network to the CEN instance

              Log on to the Elastic Desktop Service console. On the Office Network page, find the target AD office network. In the Actions column, click Attach to CEN Instance and complete the configuration in the dialog box. For more information, see Join and unbind a CEN instance.

      3. Check whether the required network ports are open

        The AD office network VPC must be able to access the AD domain controller over the following network ports. Ensure that these ports are open on your AD domain controller, DNS server, or in your security software.

        Protocol

        Port or port range

        Description

        Source

        Custom UDP

        53

        DNS

        The IPv4 CIDR block of the office network, e.g., 192.168.XX.XX/24.

        88

        Kerberos

        123

        Windows Time

        137

        NETBIOS

        138

        NETBIOS

        389

        LDAP

        445

        CIFS

        464

        Kerberos password change or reset

        Custom TCP

        53

        DNS

        The IPv4 CIDR block of the office network, e.g., 192.168.XX.XX/24.

        88

        Kerberos

        135

        Replication

        389

        LDAP

        443

        HTTPS

        445

        SMB/CIFS

        636

        LDAP SSL

        9389

        PowerShell

        49152–65535

        RPC

        3268–3269

        LDAP GC and LDAP GC SSL

    Configure local administrator permissions

    Users with local administrator permissions for a cloud computer can install software and perform tasks that require elevated privileges. You can configure local administrator permissions when you create an AD office network or on demand in your AD domain controller.

    • Configure local administrator permissions in the AD office network settings. For more information, see Create and manage an enterprise AD-based office network.

    • Configure local administrator permissions in the AD domain controller.

      Note

      The following steps, using Windows Server 2022 as an example, describe how to create an organizational unit (OU) in the AD domain controller and grant local administrator permissions to users in the OU. The actual steps may vary based on your operating system.

      1. Open Server Manager.

      2. In Server Manager, click Tools in the upper-right corner and select Active Directory Users and Computers.

      3. Create an organizational unit (OU). For example, create an OU named test.

        In the Active Directory Users and Computers panel, right-click the domain name and select . In the New Object - Organizational Unit dialog box, enter test and click OK.

      4. Create a user group in the OU. For example, create a group named Admin Group.

        Right-click test and select . In the New Object - Group dialog box, configure the following parameters and then click OK.

        • Group name: Admin Group

        • Group name (pre-Windows 2000): Admin Group

        • Group scope: Global.

        • Group type: Security.

        Note

        You can add the user accounts that require local administrator permissions to this group.

      5. In the AD panel of the Elastic Desktop Service console, find OU. Then, click the 图标 icon and select the target OU. For example, select test.

      6. In Group Policy Management on the AD domain controller, create a Group Policy Object (GPO). For example, create a GPO named User GPO.

        1. In Server Manager, click Tools in the upper-right corner and select Group Policy Management.

        2. In the Group Policy Management dialog box, find and right-click test, and then select Create a GPO in this domain, and Link it here.

        3. In the dialog box that appears, enter User GPO and click OK.

      7. Grant local administrator permissions to the user group.

        1. Right-click the new GPO. For example, right-click User GPO and select Edit.

        2. In the Group Policy Management Editor panel, go to . Then, right-click Local Users and Groups and select .

        3. In the New Local Group Properties panel, select the Local Group tab and configure the parameters.

          • Actions: Update.

          • Group name: Administrators (built-in)

        4. Click Add to add the Admin Group to the group's members.

      8. Click Apply.

      9. Restart the cloud computer for the local administrator permissions to take effect.