VMware View Manager 4.5 Installation Manual page 27

Add UPNs for Smart Card Users
Because smart card logins rely on user principal names (UPNs), the Active Directory accounts of users that
use smart cards to authenticate in View must have a valid UPN.
If the domain a smart card user resides in is different from the domain that your root certificate was issued
from, you must set the user's UPN to the SAN contained in the root certificate of the trusted CA. If your root
certificate was issued from a server in the smart card user's current domain, you do not need to modify the
user's UPN.
N You might need to set the UPN for built-in Active Directory accounts, even if the certificate is issued
OTE
from the same domain. Built-in accounts, including Administrator, do not have a UPN set by default.
Prerequisites
Obtain the SAN contained in the root certificate of the trusted CA by viewing the certificate properties.
n
If the ADSI Edit utility is not present on your Active Directory server, download the Windows Support
n
Tools from the Microsoft Web site.
Procedure
1 On your Active Directory server, start the ADSI Edit utility.
2 In the left pane, expand the domain the user is located in and double-click
3 In the right pane, right-click the user and then click Properties.
4 Double-click the
5 Click OK to save the attribute setting.
Add the Root Certificate to Trusted Root Certification Authorities
If you use a CA to issue smart card login or domain controller certificates, you must add the root certificate to
the Trusted Root Certification Authorities group policy in Active Directory. You do not need to perform this
procedure if the Windows domain controller acts as the root CA.
Procedure
1 On your Active Directory server, select Start > All Programs > Administrative Tools > Active Directory
Users and Computers.
2 Right-click your domain and click Properties.
3 On the Group Policy tab, click Open to open the Group Policy Management plug-in.
4 Right-click Default Domain Policy, and then click Edit.
5 Expand the Computer Configuration section and then open Windows Settings\Security Settings\Public
Key.
6 Right-click Trusted Root Certification Authorities and select Import.
7 Follow the prompts in the wizard to import the certificate and click OK.
8 Close the Group Policy window.
All of the systems in the domain now have a copy of the certificate in their trusted root store.
VMware, Inc.
attribute and type the SAN value of the trusted CA certificate.
userPrincipalName
Chapter 3 Preparing Active Directory
.
CN=Users
27