Microsoft Remote Desktop Services (RDS) requires the use of a Microsoft Active Directory (AD) domain. When creating a new deployment using itopia's Cloud Automation Stack (CAS), you can create or connect to an existing Active Directory domain, or create a new instance of Google Managed Service for Microsoft Active Directory (Managed Microsoft AD).

Managed Microsoft AD provides a simplified Active Directory administration experience by eliminating the need to manage domain controllers or their associated services, such as AD DNS.

With Managed Microsoft AD, a full Microsoft Active Directory instance is provisioned, configured, and updated by Google Cloud; your VMs use Google Cloud DNS to locate the Active Directory endpoints and connect to the domain controllers across your internal Virtual Private Cloud (VPC) network.

For more details, Google's Managed AD Home page is here.

Although it can be used in many scenarios, Managed Microsoft AD is an ideal option for smaller CAS deployments that do not require the advanced capabilities of a full Microsoft Active Directory environment. Managed Microsoft AD delivers a pre-hardened Active Directory domain and standard administration tasks such as monitoring, patching, and upgrading are handled automatically by Google Cloud. It is well-suited for organizations that do not have an existing Active Directory and only wish to fulfill the AD requirements for Remote Desktop Services or other AD-integrated systems.

Managed Microsoft AD also supports integration with existing Active Directory environments through the use of standard domain trusts; this makes it a good candidate for itopia CAS deployments that must maintain a certain level of isolation from your primary network while still offering unified authentication experience for your users.

There is no cost in itopia CAS for Managed Microsoft AD. For information on the GCP pricing for the managed service, refer to Google Cloud's documentation.

Managed Microsoft AD has some important distinctions from a traditional, full Active Directory implementation. These differences and limitations are important to consider when planning your CAS deployment:

This section describes current known issues and limitations when using Managed Microsoft AD in a CAS RDS deployment. This section will be updated as issues are remediated.

DESCRIPTION: CAS deployments cannot be created using both Managed Microsoft AD and the NetApp Cloud Volumes service. This is due to a limitation of the GCP Service Networking API that does not permit different managed services to communicate with one another. Because NetApp Cloud Volumes rely on Active Directory for file permissions on its SMB file shares, Cloud Volumes are not compatible with Google's Managed Service for Microsoft Active Directory.

STATUS: This is a known limitation. Google Cloud may address this limitation in the future, but no timeframe is available.

WORKAROUND: CAS deployments can be configured with either Managed Microsoft AD and an alternative file share system (such as Windows File Server), or with NetApp Cloud Volume Services and an alternative AD model (such as New Domain using Active Directory Domain Services or Existing Active Directory).

To create a new deployment using Managed Microsoft AD, simply select the option "Google Managed Service for Microsoft Active Directory" in the Active Directory portion of the Deployment Configuration, and provide a DNS name for the Managed Microsoft AD domain; refer to Microsoft's naming conventions in Active Directory when choosing a name.

When your deployment is created, you'll notice the following differences from using a full Active Directory domain:

With these exceptions, CAS is configured identically to a full Active Directory deployment, and all CAS functionality is supported.