Product documentation
XenCenter
Current Release
View PDF

Join a domain and add users

June 18, 2026
Contributed by: 
X

Before you can assign a user or group account an RBAC role, you must add the account to XenServer® through RBAC. This process consists of the following tasks:

  1. Join the pool or server to the domain. The domain can be one of the following:

    • The domain that the user or group belongs to
    • A domain that is in the same Active Directory forest
    • A domain that has a trust relationship with the user’s domain

  2. Add the user’s Active Directory account or group to XenServer.

After you add the user’s Active Directory account or group to XenServer, the user is assigned a fixed role of Pool Admin. In XenServer Premium Edition, you must assign a role to the user or group manually. For more information, see Assign roles to users and groups.

To change domains, leave the current domain and then join the new domain.

Secure LDAP (LDAPS)

LDAPS protects LDAP traffic between XenServer and your Active Directory domain controllers by using TLS on port 636.

Before you enable LDAPS, ensure that LDAPS certificates are configured on your domain controllers and that you have the required CA certificates installed in the pool. For the detailed prerequisites and certificate requirements, see Secure LDAP (LDAPS).

When LDAPS is enabled, XenServer validates each domain controller certificate against the trusted CA certificates that you install in the pool.

Note:

XenServer validates certificate chains against CA certificates only. Leaf or self-signed (non-CA) certificates are not supported.

To join the XenServer or pool to a domain

  1. In the Resources Pane, select the pool or server for which you want to grant somebody permissions.
  2. Select the Users tab.
  3. Select Join Domain.
  4. Enter Active Directory credentials with sufficient privileges to add servers to the domain you want to join. The domain to be joined must be specified as a fully qualified domain name (FQDN) rather than a NetBIOS name. For example, enter your_domain.net instead of your_domain.

  5. To join with LDAPS, select the Use LDAP over TLS (LDAPS) for secure AD communication check box, and then click OK. This check box appears only when your XenServer version supports LDAPS.

    If a certificate error appears, click Install Certificate… in the error dialog, browse to the CA certificate in PEM format, and click Install. After the certificate is installed, XenCenter automatically retries the domain join.

When a pool or server is joined to a domain, the Users tab shows the access protocol (LDAP or LDAPS). To change the LDAPS setting, click Configure…, select or clear the Use LDAP over TLS (LDAPS) for secure AD communication check box, and then click OK.

To add an Active Directory user or group to a pool

  1. After joining the user’s domain, in the Users tab, click Add.
  2. In the Add Users dialog box, enter one or more user or group names. Separate multiple names by commas. To specify a user in a different trusted domain (other than the one currently joined), supply the domain name with the user name. For example, specify other_domain\jsmith. Alternatively, you can enter a fully qualified domain name (FQDN). For example, specify jsmith@other_domain.com.
  3. Select Grant Access.
  4. Follow Assign roles to users and groups to assign the account a role and grant access.

To leave the domain

Note:

When you leave the domain, any users who authenticated to the pool or server with Active Directory credentials are disconnected.

  1. In the Resources Pane, select the pool or server that you want to disconnect from its Active Directory domain.
  2. Select Leave Domain and select Yes to continue.
  3. Enter Active Directory credentials with sufficient privileges to disable servers in the domain you want to leave.
  4. Decide whether to disable the computer accounts in the Active Directory server, and then click one of the following:
    • Disable. Removes the pool or server from the domain and disables the computer account for the server or pool coordinator in the Active Directory database.
    • Ignore. If you didn’t fill the username/password or know an account with sufficient privileges, select this option to remove the server or pool coordinator’s computer account from the Active Directory database. This option removes the pool or server from the domain, but leaves the computer account for the server or pool coordinator in the Active Directory.

XenServer 8.4

Join a domain and add users
June 18, 2026
Contributed by: 
X
June 18, 2026
Contributed by: 
X

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.