How to configure Microsoft App-V with Network Load Balancing (NLB)

Article ID: 2605366
Expand all | Collapse all

Symptoms

The information below outlines the basic steps necessarily to configure Microsoft Application Virtualization (App-V) for use in a Microsoft Network Load Balancing (NLB) configuration.  By doing this, Microsoft NLB can be used with App-V to perform RTSP Server refresh and streaming, deploying several servers behind a virtual name.

Keep in mind that this only applies to client refresh and streaming using RTSP. The App-V admin console cannot be opened using the virtual name because the virtual name is not an actual object in Active Directory and delegation cannot occur, causing the connection to fail. For the Admin console to work you will need to continue to point to any of the individual server names.

Cause

Resolution

1) Install each App-V server and configure the App-V management service to run under a domain account. Register the SoftGrid Service Principal name for each server to the domain account using the setspn tool:

FQDN:

setspn -A SoftGrid/server1.domain.x domain\service-account

setspn -A SoftGrid/server2.domain.x domain\service-account

NETBIOS:

setspn -A SoftGrid/server1 domain\service-account

setspn -A SoftGrid/server2 domain\service-account

If the APP-V Server was already installed with the network service account and now you need to change it to a domain account you need to give the service account NTFS permissions to the APPV install directory that match network service account. You can also give local administrator rights to the service account to the APPV server.

In SQL server you need to add the domain account to the APPV database and give it the SFTeveryone role and SFTuser role.

When the App-V server was installed it should register the SPN to the computer account in Active directory, thus causing duplicate SPNs on the network. To avoid this, run the setspn command to delete the SoftGrid SPN registered to each server account in AD. A sample is provided below:

These commands will list the existing SPN registered to the server account, verify the existence of the SoftGrid SPN, SoftGrid/server1.domain.x

setspn -L server1

setspn -L server2

If the SoftGrid SPN exists delete it by running the setspn -d command against the computer account. Example:

FQDN:

setspn -D SoftGrid/server1.domain.x server1

setspn -D SoftGrid/server2.domain.x server2

NETBIOS:

setspn -D SoftGrid/server1 server1

setspn -D SoftGrid/server2 server2

2) For redundancy, the content share must reside on a DFS share or NAS. You must configure each App-V server to use the UNC path of the virtual name of the DFS share or NAS in the system options in the Admin console as well as in the content registry path (HKLM\Software\Microsoft\SoftGrid\4.5\Server\SOFTGRID_CONTENT_DIR). The content share could reside on one of the servers but this will not provide the redundancy in case one of the servers should fail.

Note If HTTP streaming is used you must configure NLB to use port 80 as well as creating the content virtual directory on each IIS server.

3) Install and configure the NLB service on each server and create the virtual name for the NLB cluster. You must create a DNS record for this virtual name. For this process follow the below link:

http://technet.microsoft.com/en-us/library/cc770689(WS.10).aspx

In my lab I usually just leave all of ports open to the NLB cluster but you can restrict the ports in the NLB to only answer to specific ports if you prefer. Follow the SoftGrid ports guide below to know what ports to allow. If using HTTP streaming, keep in mind that port 80 must also be allowed in the NLB.

http://support.microsoft.com/kb/932017

Once NLB is up and running and the virtual name registered in DNS, you must register the SoftGrid SPN for the virtual name to the service account that is configured in the App-V server service. To accomplish this use the example below:

FQDN:

Setspn -A SoftGrid/virtualname.domain.x domain\service-account

NETBIOS:

Setspn -A SoftGrid/virtualname domain\service-account

This process will allow the App-V client to query AD for the SPN and will return the correct name. This process leverages the use of Kerberos and does not have to fallback to NTLM like some hardware load balancers may do.

More Information

We use SETSPN in this guide but if you are experienced with the ADSIEDIT tool you can accomplish the same results with that as well.

Once the Microsoft NLB is in place you must change all the clients to point to the virtual name in the APPV client server section.

If using ASR's, OSR's or ISR's , these must be updated with the corresponding virtual name.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Properties

Article ID: 2605366 - Last Review: September 8, 2011 - Revision: 6.0
Keywords: 
KB2605366

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com