Active Directory Integration

Thinfinity® Workspace integrates with Windows Active Directory (AD) to authenticate users and authorize access to published resources. There are two integration models, depending on where the directory lives relative to the Workspace host:

• Native Winlogon / Active Directory — used when the Thinfinity Workspace host is joined to the domain. Authentication is handled by Windows’ native Winlogon subsystem against the local domain controller.
• AD Cache (RemoteAD) — used when the Active Directory domain is not on the same network as Thinfinity Workspace (for example, a cloud-hosted Workspace authenticating against an on-premises domain). A local service synchronizes and caches the directory and validates credentials without requiring a domain trust.

In This Section

• Winlogon and Active Directory — How Workspace uses Winlogon for local (SAM) and domain authentication, the benefits of AD integration, and the domain authentication flow.
• Understanding AD Cache (RemoteAD) — The AD Cache Directory Services Connector: what it does, how it is deployed, and the security model for integrating an out-of-network domain.
• AD Cache — Service Account and Required Permissions — Where the service account and trusted-domain credentials are configured, the Active Directory rights the account needs, and how to grant them with least privilege.
• Configuring AD Cache for Multiple Domains — The two multi-domain models (trusted domains with a single AD Cache, or one AD Cache per unrelated domain), their prerequisites, and the step-by-step configuration.