An administrator manages a Nutanix cluster that hosts Omnissa Horizon virtual desktops. The administrator is troubleshooting a desktop provisioning problem where Omnissa Horizon virtual desktops are not joining the domain automatically on creation. The administrator is able to log onto the virtual desktop console and join the domain using their own account. What could the problem be?

During Horizon instant-clone or linked-clone provisioning, VMware Horizon uses an Active Directory service account to join new VMs to the domain. That account must have delegated “Create” and “Delete” computer-object permissions on the target OU. If those rights are missing, automated joins fail, while manual joins succeed when performed by an administrator, exactly matching the observed behavior.

A – Horizon performs domain join natively; no extra PowerShell script is required. B – Schema Admin membership is unnecessary; only OU-level computer object rights are needed. D – DNS misconfiguration would also break manual joins; manual join success rules this out.

1. VMware Horizon 8 Instant-Clone Administration, “Delegate Active Directory Permissions”, §Prerequisites, p. 24-25 (docs.vmware.com)

2. VMware Horizon 8 Installation Guide, “Service account for domain join”, Table 5-1, p. 41 (docs.vmware.com)