Constrained delegation is used to join computers to the Active Directory. You provide constrained delegation
information through the HX Data Platform Installer. Constrained delegation uses a service account, hxadmin
that is created manually. This service account is used to then log in to Active Directory, join the computers,
and perform the authentications from the HyperFlex Storage Controller VM. The Active Directory computer
accounts applied to every node in the HyperFlex cluster include:
• Hyper-V host
• HyperFlex Storage Controller VM
• Hyper-V host cluster namespace
• Server Message Block (SMB) Share namespace for the HyperFlex cluster
a) Use the Active Directory Users and Computers management tool to create the OU.Select View > Advanced
Features to enable advance features. Select the OU that you created. For example, HyperFlex >
Properties > Attribute Editor.
b) Find the distinguished name attribute in the OU, and record the information as this will be required in the
Constrained Delegation wizard of the HX Data Platform Installer wizard. The values will look like this:
OU=HyperFlex,DC=contoso,DC=com.
Use the Get-ADOrganizationalUnit cmdlet to get an organizational unit (OU) object or to perform a
search to get multiple OUs.
Use Active Directory Users and Computers management tool to grant full permissions for the hxadmin user
for the newly created OU. Ensure that Advanced features are enabled. If not, go back to Step 2.
a) Select the OU that you created. For example, HyperFlex > Properties > Security > Advance.
b) Click Change Owner and choose your hxadmin user.
c) Click Add in the Advanced view.
d) Select the principal and choose the hxadmin user. Then, choose Full Control, and click OK.
