4 ms·

FWIW, GPO templates are what I consider the minimum to call something manageable, which is most of why I want things on Active Directory. This definitely moves

FWIW, GPO templates are what I consider the minimum to call something manageable, which is most of why I want things on Active Directory. This definitely moves this into "I might introduce this to our environment" level.

croutonwagon 6y ago
I would say the same but for authentication. We have linux servers on our domain, specifically becaeuse there are certain things they do better than windows, and im a tool for a trade kinda guy. But authentication and management of creds is a hard requirement. The rest i can work with. We setup Ansible to handle much of the day to day config things. GPO"s might be nice. At one and for years i was using PBIS, and whatever it was called before it was bought out, forked and named PBIS - https://github.com/BeyondTrust/pbis-open https://github.com/BeyondTrust/pbis-open I liked it because it kept GID/UID's consistent across the domain. But it was flaky for samba shares specifically ad group enumeration. There are paid add-ons that leverage GPO but never went that route. More recently we are just leveraging SSSD/Chrony/Smb/Nmb to do the same, there are a few tweaks, but its solid. Its actually more stable now. Some GPO's would be nice I supposed.
lordlimecat 6y ago
The problem is that GPOs are really a terrible way to do configuration, and people (like myself) who grew up on them simply were Stockholm'd into accepting them. The moment you learn about things like Ansible, and then ask "wait, what if I want to programatically make GPOs"-- and try to do so-- you realize just how horrendously bad they are. Their permissions inheritance is terrible, so trying to do least-privelege / granular rights for admins is awful. Their supercedence structure is confusing, overly complex, and naturally inclines people towards abusing "enforce" and "block" in the worst possible ways. Un-screwing GPO inheritance messes is essentially impossible, so in production the answer is generally "create a new GPO" rather than "clean up the old mess". And the settings structure itself is a terrible organizational mess; things "sort of" have a logical structure, except for the thousand odd exceptions. You can't set preferences on items that may not exist (such as disabling insecure services from old OSes) without generating a bunch of logged errors. You can't really target your GPO without some rather expensive client-side queries. Logging what is actually happening (e.g. why did that printer mapping fail) is awful, which I have generally seen solved by writing one's own drive and printer mapping scripts. The whole thing is a relic of the 90s that never quite got finished, polished, or maintained and mostly exists because it was "good enough" and there were no real alternatives. There still aren't, really, unless you want a third-party solution which is inevitably almost as big of a maintenance burden as GPO-- and GPO being free and mostly reliable makes it easy to just accept its awfulness.
- ocdtrekkie 6y ago
  "GPOs is the worst form of policy management, except for all the others." I've yet to see something as comprehensive, navigable, and flexible. Sure, it can be horrendously complicated, especially if you chose not to clean up the old mess, but it's still... basically better than everything else.
  - bluedino 6y ago
    Novell had it 20 years ago. Zenworks!
  - Spivak 6y ago
    In the Windows world — SCCM! Setting up SCCM is an exercise in hating your life but once you have the servers up it’s stupidly powerful. In the Linux world — Ansible if you want push, Puppet if you want pull.
    - ocdtrekkie 6y ago
      I've never worked somewhere with SCCM money, that crud's expensive. I've used some more affordable third party tools which I find quite serviceable. And WSUS. Which is beautiful in it's simplicity, yet horrifying once you stray from the narrow path.

croutonwagon 6y ago

I would say the same but for authentication. We have linux servers on our domain, specifically becaeuse there are certain things they do better than windows, and im a tool for a trade kinda guy. But authentication and management of creds is a hard requirement. The rest i can work with. We setup Ansible to handle much of the day to day config things. GPO"s might be nice. At one and for years i was using PBIS, and whatever it was called before it was bought out, forked and named PBIS - https://github.com/BeyondTrust/pbis-open https://github.com/BeyondTrust/pbis-open I liked it because it kept GID/UID's consistent across the domain. But it was flaky for samba shares specifically ad group enumeration. There are paid add-ons that leverage GPO but never went that route. More recently we are just leveraging SSSD/Chrony/Smb/Nmb to do the same, there are a few tweaks, but its solid. Its actually more stable now. Some GPO's would be nice I supposed.

lordlimecat 6y ago

The problem is that GPOs are really a terrible way to do configuration, and people (like myself) who grew up on them simply were Stockholm'd into accepting them. The moment you learn about things like Ansible, and then ask "wait, what if I want to programatically make GPOs"-- and try to do so-- you realize just how horrendously bad they are. Their permissions inheritance is terrible, so trying to do least-privelege / granular rights for admins is awful. Their supercedence structure is confusing, overly complex, and naturally inclines people towards abusing "enforce" and "block" in the worst possible ways. Un-screwing GPO inheritance messes is essentially impossible, so in production the answer is generally "create a new GPO" rather than "clean up the old mess". And the settings structure itself is a terrible organizational mess; things "sort of" have a logical structure, except for the thousand odd exceptions. You can't set preferences on items that may not exist (such as disabling insecure services from old OSes) without generating a bunch of logged errors. You can't really target your GPO without some rather expensive client-side queries. Logging what is actually happening (e.g. why did that printer mapping fail) is awful, which I have generally seen solved by writing one's own drive and printer mapping scripts. The whole thing is a relic of the 90s that never quite got finished, polished, or maintained and mostly exists because it was "good enough" and there were no real alternatives. There still aren't, really, unless you want a third-party solution which is inevitably almost as big of a maintenance burden as GPO-- and GPO being free and mostly reliable makes it easy to just accept its awfulness.

ocdtrekkie 6y ago
"GPOs is the worst form of policy management, except for all the others." I've yet to see something as comprehensive, navigable, and flexible. Sure, it can be horrendously complicated, especially if you chose not to clean up the old mess, but it's still... basically better than everything else.
- bluedino 6y ago
  Novell had it 20 years ago. Zenworks!
- Spivak 6y ago
  In the Windows world — SCCM! Setting up SCCM is an exercise in hating your life but once you have the servers up it’s stupidly powerful. In the Linux world — Ansible if you want push, Puppet if you want pull.
  - ocdtrekkie 6y ago
    I've never worked somewhere with SCCM money, that crud's expensive. I've used some more affordable third party tools which I find quite serviceable. And WSUS. Which is beautiful in it's simplicity, yet horrifying once you stray from the narrow path.