Maybe I'm just naive, but... who needs group policy when you have other tools that can accomplish the same goals? With Linux, it's possible to do periodic imag

Maybe I'm just naive, but... who needs group policy when you have other tools that can accomplish the same goals? With Linux, it's possible to do periodic image-based deployment (ie roll out preconfigured, immutable core OS images to all managed machines) and then set up the FS to "overlay" any per-machine customisations on top of the base image. User files / home directories can be kept in their own partition, entirely separate from the OS image. If desired, one could even set up a system for overlaying generated customization images (based on a template) on user partitions - allowing IT to systematically override particular files in user trees with immutable versions, if they so choose. As for managing subgroups of machines which need different software/settings, or dealing with revisions? Use git to manage everything that goes into the deployed OS images. If a subgroup of machines just needs a few different configs, that can be a patchset. If the changes are more significant, it might make more sense to implement a branch. Then IT gets to control, at a fine-grained level, the update status and configuration of every machine they manage - and easily make organisation-wide changes by pushing new images, while also having the ability to cleanly roll back to an older revision of the image if showstopper regressions are found. Most likely you'd push image deltas (no sense wasting bandwidth routinely sending whole images if it can be avoided) once per diem, in the middle of the night. Once the tooling is in place, I'd imagine a system like that ought to be far slicker / more convenient, not to mention more powerful and (albeit dependent on implementation) secure than Windows' Group Policy could ever hope to be.