Product documentation
Citrix DaaS
View PDF

On-premises Active Directory service accounts

October 10, 2024
Contributed by: 
C

An on-premises Active Directory service account is a container to store the user name and password of a privileged domain user account. The user account must have sufficient permissions to manage computer accounts in an Active Directory. Machine Creation Service can use this service account to do computer accounts related operations without entering the domain credentials every time.

Create an on-premises Active Directory service account

Create an on-premises Active Directory service account using Studio or PowerShell.

Prerequisite

To create an on-premises Active Directory service account, make sure to complete the following task:

  • Create a domain user account in your Active Directory with sufficient permissions to create, update, and delete computer objects in your Active Directory or specific OUs.

Use Studio

  1. In the DaaS tile, click Manage.
  2. In the left pane, select Administrators.
  3. In the Service Accounts tab, click Create Service Account.
  4. On the Identity Type page, select On-premises Active Directory. Click Next.
  5. On the Credentials page, click Enter credentials to provide the username and password of a privileged domain user account which you want to use as the service account.
  6. Set the password expiration date or leave it as never expired.
  7. Select one or more scopes for this service account.
  8. Enter a friendly name and a description (optional) for the service account.
  9. Click Finish to complete the creation.

Use PowerShell

You can use PowerShell commands to create an on-premises Active Directory service. For example:

$credential = ConvertTo-SecureString -String $password -AsPlainText -Force
New-AcctServiceAccount -IdentityProviderType ActiveDirectory -IdentityProviderIdentifier test.local -AccountId test\svcacct_mcs -AccountSecret $credential -SecretExpiryTime 2030/08/15 -DisplayName 'scvacct_mcs' -Description 'Service account for test.local'
<!--NeedCopy-->

Note:

The $password is the matching password for the provided domain user account.

Associate on-premises Active Directory service account with machine catalog

The MCS machine catalogs with on-premises Active Directory or Hybrid Azure Active Directory joined machine identities can be associated with an on-premises Active Directory service account. Machine catalogs can use the capabilities provided by the service account to do machine identity-related actions without asking for domain credentials every time.

Use Studio or PowerShell commands to associate an on-premises service account with an MCS machine catalog.

Use Studio

The following information is a supplement to the guidance in Create machine catalogs.

  1. Sign in to Citrix Cloud.
  2. In the DaaS tile, click Manage to open Studio.
  3. In the left pane, select Machine Catalogs.
  4. Select Create Machine Catalog. The catalog creation wizard opens.

  5. On the Machine Identities page, click Select service account and select an available service account from the list. If a suitable service account is not available for the selected domain, you can create a service account.

    Note:

    Selecting a service account for catalogs with on-premises Active Directory or Hybrid Azure Active Directory joined machine identities is optional. You can enter domain credentials manually.

Modify the service account association

To change the associated service account or add an association to an existing MCS machine catalog, use the Edit Machine Catalog page.

  • To add a service account, click Select service account on the Service Account page.
  • To change the service account association, click the edit icon on the Service Account page.

Use PowerShell

To associate an on-premises service account with an MCS created machine catalog, associate it with the identity pool that is used by the machine catalog. You can create an identity pool or update an existing identity pool to associate it with a service account.

For example: To create a new identity pool and associate it with a service account, run the following:

New-AcctIdentityPool -IdentityType ActiveDirectory -IdentityPoolName MyPool -NamingScheme Acc#### -Domain MyDomain.com -NamingSchemeType Numeric -OU "CN=MyOU,DC=MyDomain,DC=com" -ServiceAccountUid $serviceAccountUid
<!--NeedCopy-->

For example: To update an existing identity pool to associate it with a service account, run the following:

$identityPoolUid = (Get-ProvScheme -ProvisioningSchemeName "MyProvScheme").IdentityPoolUid
Set-AcctIdentityPool -IdentityPoolUid $identityPoolUid -ServiceAccountUid $serviceAccountUid
<!--NeedCopy-->

Note:

The $serviceAccountUid must be a valid UID of an on-premises service account.

After an Active Directory or a Hybrid Azure AD based identity pool is associated with a service account, you can do various machines identity-related actions without requiring to enter the domain credentials.

  • To create a new identity account using a service account

     New-AcctADAccount -IdentityPoolName MyPool -Count 2 -UseServiceAccount
 <!--NeedCopy-->

  • To repair the identity accounts using a service account

     Repair-AcctADAccount -ADAccountName "Domain\account","Domain\account2" -UseServiceAccount
 <!--NeedCopy-->

  • To remove identity accounts using service account

     Remove-AcctADAccount -IdentityPoolName MyPool -RemovalOption Delete -ADAccountName "Domain\account","domain\account2" -UserServiceAccount
 <!--NeedCopy-->
On-premises Active Directory service accounts
October 10, 2024
Contributed by: 
C
October 10, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.