1/3
Integrating VDC with AD
  

EduardoOliveira Lv1  Posted 2026-Oct-20 03:49

Sangfor VDI (aDesk) Integration with Active Directory (LDAP)
This guide adds an Active Directory domain as an external LDAP server in Sangfor VDI (Virtual Desktop Controller) and imports AD users so they can access their desktops. It works for any domain: replace the values in < > with your own. Screenshots use an example domain on VDI 5.9.6.
Before you startCollect the values below. They are used throughout this guide.
Value
Description
Example
<DOMAIN>
Domain DNS name
company.local
<DOMAIN_DN>
Domain in DN format
DC=company,DC=local
<DC_IP>
IP of a domain controller reachable from VDI
192.168.1.10
<SERVICE_OU>
OU that holds the bind account
Service Accounts
<VDI_BIND_ACCOUNT>
Service account VDI uses to read AD
BIND VDI
<USERS_OU>
OU with the users who will access desktops
VDI Users
Requirements:
  • Administrator access to AD (ADUC) and to the Virtual Desktop Controller (Super Admin).
  • Network access from VDI to the domain controller on port 389 (LDAP) or 636 (LDAPS).

Part 1 — Active DirectoryOn the domain controller, open Active Directory Users and Computers (ADUC). If the OUs already exist (for example, from the SCP integration), skip to Step 2.
Step 1 — Create the OUs
  • Right-click the domain root <DOMAIN> and select New → Organizational Unit.
  • Create <SERVICE_OU> for the bind account and <USERS_OU> for VDI users. Sub-OUs are optional (for example, one per company or customer).

New-ADOrganizationalUnit -Name "<SERVICE_OU>" -Path "<DOMAIN_DN>" New-ADOrganizationalUnit -Name "<USERS_OU>" -Path "<DOMAIN_DN>"



Step 2 — Create the bind account and copy its DNUse a bind account dedicated to VDI, separate from other products: changing one password does not break the other integration, and auditing stays clear.
  • In <SERVICE_OU>, right-click and select New → User. Create <VDI_BIND_ACCOUNT> with a strong password and check Password never expires.
  • Enable View → Advanced Features in ADUC.
  • Open the account properties, Attribute Editor tab, and double-click distinguishedName.
  • Copy the value. It follows this format:

CN=<VDI_BIND_ACCOUNT>,OU=<SERVICE_OU>,<DOMAIN_DN>Example: CN=BIND VDI,OU=Service Accounts,DC=company,DC=local. The account does not need administrator rights.

Part 2 — Add the LDAP server in VDIStep 3 — Open external authenticationIn the Virtual Desktop Controller, open the main menu (☰) and go to Services → Authentication. In the side menu, select External LDAP/RADIUS.

Step 4 — Add the LDAP serverClick New → Add New LDAP Server.
Step 5 — Fill in the server details
Field
Value
Server Status
Enabled
Server Name
A friendly name (e.g. AD-COMPANY)
Description
Optional
Protocol
LDAP (389) or LDAPS (636, requires a certificate on the DC)
Server IP
Click Add and enter <DC_IP> and the port. You can add more than one DC and order them with Up/Down
Admin DN
Bind account DN (Step 2)
Password
Password of <VDI_BIND_ACCOUNT>
Base DN
Where the user search starts (Step 6)
Subtree included
Checked, to include sub-OUs

Step 6 — Select the Base DN
  • Click the list icon to the right of the Base DN field.
  • In the Select window, choose <USERS_OU> (or the domain root, to search all of AD) and click OK.

If the AD tree loads, the Admin DN and password are correct. The result looks like OU=<USERS_OU>,<DOMAIN_DN>.

Step 7 — Domain extension, attributes and authenticationEnable domain name extensions appends the domain suffix to imported users, avoiding username conflicts between domains. When enabled, users who do not pick a domain at login must sign in as user@<DOMAIN>. Once saved, the domain cannot be changed. If you enable it, enter <DOMAIN> in Domain.
Under User Basics, the defaults already work for AD:
Field
Default
Type
MS ActiveDirectory
User Filter
objectCategory=person
Username
sAMAccountName
Mobile Number
telephoneNumber
Expiration Date
accountExpires
Description
Optional, one attribute per line (e.g. displayName, mail)
Under Authentication Settings:
Option
Recommendation
Password Encryption
No
Authentication timeout
15 s (accepts 5–60)
Use cached credentials for authentication if LDAP server is down
Checked: imported users keep signing in for up to 30 days if AD is down
Display domains on the login page
Optional; useful with more than one domain
Allow LDAP users to change password at client side
Optional
Specify authentication range / Allow login without password
Unchecked

Step 8 — Save and verifyClick Save. The server appears under External LDAP/RADIUS with a green status (✓). The Priority column sets the lookup order when there is more than one server (Move button).

Part 3 — Import AD usersStep 9 — Configure the importOn the server row, click Import Users and fill in:
Field
Value
OU
Source OU within the Base DN. Use / to import everything under the Base DN, or a specific sub-OU
Imported To
Destination group in VDI (e.g. /All/Default Group)
User Group
Import OUs from LDAP server: recreates the OUs as groups. Ignore original OU: places everyone in the destination group
Import
All the users on LDAP server: syncs additions, deletions and changes. Only new users: new accounts only
Sync user expiration date to local
Checked
Newly imported user accounts are disabled by default
Unchecked (if checked, the account status in AD is no longer synced)
Change user phone number
Optional: replaces the phone number with the one in AD
Enable scheduled import
Recommended: every 10–1440 min or once a day, so AD changes show up automatically
Click Save and Import Now to import right away, or Save to store the schedule only.

Step 10 — VerifyImported users appear under Services → Users, in the group chosen in Imported To. Then assign resources (desktops) to the imported users or groups.

507596ad673dfb4158.png (263.79 KB, Downloads: 5)

507596ad673dfb4158.png

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

Humayun Ahmed Lv4  Posted 2026-Oct-20 11:48
  
Thanks to share!