# Microsoft Active Directory

> Configure and use the OneFuse Microsoft Active Directory module with VMware vRealize Automation 7.6

---

Site [llms.txt](/llms.txt)

---

To learn more about this OneFuse module, refer to [Microsoft Active Directory](/docs/onefuse/configure/modules/microsoft-active-directory/).

## Prerequisites

1. Configure OneFuse [Property Set(s)](/docs/onefuse/templating/property-sets/) and OneFuse Module Policies.
1. Run [OneFuse Configuration](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/installation-and-setup/#run-the-onefuse-configuration-workflow) per vRA Tenant.
1. Review the [OneFuse Modules](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/modules/) overview for vRealize Automation 7.6.
1. Create a new **vRA Blueprint** (if none exist) or determine which existing Blueprint(s) will utilize this OneFuse Module.
   - Resource: [Designing Machine Blueprints](https://docs.vmware.com/en/vRealize-Automation/7.6/com.vmware.vra.prepare.use.doc/GUID-62A92480-A122-4C89-A4E3-F8F6EC26C19E.html#GUID-62A92480-A122-4C89-A4E3-F8F6EC26C19E)

## Configure the Blueprint

1. **Know the name of the OneFuse Endpoint** created via [OneFuse Configuration](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/installation-and-setup/#run-the-onefuse-configuration-workflow).
1. **Determine *which* OneFuse Microsoft Active Directory Policy to run** for this Blueprint.
1. **Update the Blueprint** to add in the necessary vRA Property to invoke a OneFuse Microsoft Active Directory Policy.
1. **Deploy the Blueprint** to provision a vRA Deployment and create a computer account in Microsoft Active Directory.
1. **Destroy the vRA Deployment** to remove the computer account from Microsoft Active Directory.

### Update the Blueprint

1. Log in to the **vRA Tenant**
1. Select the **Design** tab from the top menu bar
1. Select the **Blueprints** tab from the left menu
1. **Edit the Blueprint** and perform the below:

#### Add in necessary vRA property

The following vRA Property needs to be added to the Blueprint's **Properties** > **Custom Properties** section under the **Resource(s)** of interest.

**Call a Microsoft Active Directory Policy:**

| Property Name Format | Property Value Format |
| --- | --- |
| `OneFuse_ADPolicy` | `<OneFuse Endpoint Name>` `:` `<Microsoft AD Policy Name>` |

**Example vRA Custom Property** (in `key: value` pair format):

```yaml
# -- Property Value
# <OneFuse Endpoint Name>  is onefuse
# <Microsoft Active Directory Policy Name> is global

OneFuse_ADPolicy: onefuse:global
```

##### Additional helpful vRA properties

**Purpose: Relate OneFuse Policy executions from different OneFuse Modules together with a Tracking ID.**

| Property | Value format |
| --- | --- |
| `OneFuse_Tracking_Id` | A GUID (globally unique identifier) that links OneFuse Policy Executions and the resulting Managed Objects together for a given resource on a deployment. The first OneFuse Module Policy execution will populate this vRA property and it will be passed into other OneFuse Modules automatically. Learn more about OneFuse [Tracking ID](/docs/onefuse/concepts/tracking-id/). |

<div class="alert alert-info" role="alert">


When a Tracking ID is not provided, a Tracking ID gets generated for the Policy execution.
</div>


**Purpose: Reference a specific NIC's values to get hostname, IP address, etc.**

| Property format | Example |
| --- | --- |
| `OneFuse_VmNic<#>.<value>` | See examples below |

Replace `<#>` with a number from `0` to `9`, one for each NIC.

Replace `<value>` with an appropriate key: `dnsSuffix`, `fqdn`, `gateway`, `hostname`, `ipAddress`, `macAddress`, `netmask`, `network`, `subnet`, `target`

<div class="alert alert-info" role="alert">


For most use cases, NIC 0 is the primary network interface and the target hostname is a Fully Qualified Domain Name (FQDN).
</div>


Examples:

- `OneFuse_VmNic0.dnsSuffix`
- `OneFuse_VmNic0.fqdn`
- `OneFuse_VmNic0.hostname`
- `OneFuse_VmNic0.ipAddress`
- `OneFuse_VmNic0.target`: when DNS Suffix is provided, will be the FQDN; otherwise, will be the hostname (without domain).

##### Custom property placement methods

Influence **Custom Properties** for Resources using different methods:

| Method | Description |
| --- | --- |
| Basic | Add a Custom Property to the vSphere machine on the blueprint canvas, or to the blueprint layer itself. |
| Advanced 1 | Add a Custom Property to an existing or new vRA [Property Group](https://docs.vmware.com/en/vRealize-Automation/7.6/com.vmware.vra.prepare.use.doc/GUID-73D5DB94-3B5D-410A-8E9C-CF42D4ADF6F0.html). |
| Advanced 2 | Add a Custom Property to a more global level, such as vCenter Endpoint (to run on all deployments) and/or a Reservation (to run on all deployments using that reservation), etc. |

Learn more: [Understanding Custom Properties Precedence](https://docs.vmware.com/en/vRealize-Automation/7.6/com.vmware.vra.prepare.use.doc/GUID-F45F332E-1003-45BC-BC05-0EA2FDE1B31F.html)

### Provision

Deploy a Blueprint with OneFuse Microsoft Active Directory Policy configured. A computer account will register in Microsoft Active Directory.

#### Outputs

The following vRA Properties will exist on the Deployment.

| Property Name | Property Value |
| --- | --- |
| `OneFuse_AD` | *JSON string of OneFuse Microsoft Active Directory Managed Object* |
| `OneFuse_AD_State` | `build` or `final` depending on the state. |

### Deprovision

Destroy an existing deployment with OneFuse Microsoft Active Directory Policy configured. The computer account will be removed from Microsoft Active Directory.

## vRA EBS

| EBS Execution | Subscription State | EBS Priority | EBS Name |
| --- | --- | --- | --- |
| **Provision** | | | |
| BuildingPre | Early | 1500 | OneFuse_Provision_AD |
| ProvisionedPre | Early | 1500 | OneFuse_Move_OU_AD |
| **Deprovision** | | | |
| MachineDisposingPost | - | 1200 | OneFuse_De-Provision_AD |

## Troubleshooting

Troubleshoot in vRealize Orchestrator.

1. Log in to **vRealize Orchestrator**.
1. Turn on [Verbose Logging](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/modules/#troubleshooting-verbose-logging) and try again to see additional log messages in vRO Workflows:
   - Select **Library** > **Workflows** from the left menu
   - Go to: **OneFuse** > **AD** > **vRA7** to find corresponding workflow runs and view logs
   - Optionally, run the workflows in the **Manual** folder to manually test
1. Optionally, [configure timeouts for EBS](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/modules/event-broker-subscriptions/#configure-ebs-timeouts) and/or [Configure timeouts for OneFuse modules](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/installation-and-setup/#configure-timeouts-for-onefuse-modules).

**Additional resources:**

- Review [Troubleshooting in OneFuse](/docs/onefuse/getting-started/troubleshooting/)
- Review [VMware troubleshooting resources](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/getting-started/#troubleshooting)