Setting Organizational Unit (OU) for a WAP VM Role

Question

In VMM we can define the OU that a VM created from a VM Template is created within using a custom VM template property:-
Set-SCVMTemplate -VMTemplate $VMTemplate -DomainJoinOrganizationalUnit $OU
I cannot find something similar in WAP VM Roles though, and I think I'm going to have to use SMA to move the computer acct post build.
Does anyone know whether or not there is a similar method for setting the OU on VM Roles that are deployed?
Thanks
Steve

Answer 1

Hi Steve,
Unfortunately
there is no way to customize the OU path beforehand at this time.
I use SMA to create the ComputerObject in the correct OU during deployment and remove it when the VM Role is removed. If you want to create a
similar
method you should know that the ComputerName of the VM Role which gets deployed cannot be taken from the ResourceObject (which is passed to the SMA runbook by SPF) directly as this could be a name range instead of a single name. Instead use the
data provided by the ResourceObject to
interrogate VMM for the correct ComputerName(s).
I have given an SMA training a few times this year where I covered this scenario:
New VM Role gets deployed by the tenant user which triggers a SMA runbook which handles these tasks
Create an OU per VM Role on a
dedicated parent OU (as a VM Role can scale up and down it make sense to do this with GPO in mind. Think of a VM Role as a Unit of Automation, Configuration and governance).
Create the Computer Accounts in the OU (when scaling up and down, another runbook should add / delete
computer accounts)
Create a domain local security group for the VM Role.
Create and link a GPO to the VM Role OU and configure it with restricted groups setting to add the domain local security group to the local administrators group.
Another runbook should be created to clean everything up once the CloudService containing the VM Role deployments gets deleted.
If you are interested, I could send you this example.
Ben