3 ms·

Maybe. Some things go deep, true. However most businesses don't use most of Microsoft products - even the ones that do, the usage of the more complicated produ

Maybe. Some things go deep, true. However most businesses don't use most of Microsoft products - even the ones that do, the usage of the more complicated products is far more minuscule than imagined by e.g. CFOs, etc. The real thing keeping many "in the fold" as it were would be authentication services. Which are overcomplicated and probably easier to manage without...

firesteelrain 1y ago
Right, it’s stuff like Active Directory and how everything’s tied together. Once you’re using that for auth, it’s really tough to back out without a lot of effort. We’ve looked into FreeIPA and similar options, but honestly, nothing really holds a candle to Active Directory yet.
- AnonymousPlanet 1y ago
  AD and Domain Servers are like a cancer that will grow metastases around your org, costing user and client cals all over the place, even for every desk phone if you're not careful. The only winning move is never to play their game in the first place.
  - firesteelrain 1y ago
    I'm in a situation where due to staff skillsets and ease of management then GPOs are required. Local GPOs would be insane to manage across thousands of PCs
    - thewebguyd 1y ago
      InTune/MDMs are finally eating away at the need for GPOs for most use cases. Someone already familiar with AD & Group Policy should be able to easily transition to InTune Configuration Policies. MS even has a tool now to import your GPOs. There's still a few that don't have direct equivalents, but the list is growing smaller and smaller.
      - AnonymousPlanet 1y ago
        InTune is part of Microsoft's strategy to make everyone dependent on their cloud. It's like switching from Heroin to Fentanyl because you want to get off of your addiction.
    - AnonymousPlanet 1y ago
      Yes and that is a very common case. Windows is designed so that you barely have a chance to deal with your case without Microsoft components all the way. You would need a company with enormous resources to play catch up with the highly integrated and proprietary connections between each component. It's a rigged monopoly and has nothing to do with a market economy. Once you have been forced to use Windows, you are doomed.
  - mnadkvlb 1y ago
    genuinely interested, what are the alternatives ? i know ping/forgerock and some old ibm stuff. what is state of the art today that compares to ActiveDirectory (not talking azureAd - or whatever they call it these days) ?
    - firesteelrain 1y ago
      Samba4 is the closest you can get. It is not as nice as ActiveDirectory.
      - smaudet 1y ago
        > Samba is an important component to seamlessly integrate Linux/Unix Servers and Desktops into Active Directory environments. It can function either as an Active Directory Domain Controller or as a member server. What's something that AD provides that this does not? It certainly sounds like an (almost) drop-in replacement.
        firesteelrain 1y ago
        Samba4 covers core AD features like Kerberos, LDAP, and can act as a DC, but it’s not a full drop-in. GPO support is limited, management tools aren’t as robust (no full RSAT equivalent), and some advanced AD features (like DAC or ADCS) aren’t supported. Fine for smaller setups, but not 1:1 with enterprise AD.
      - xcrunner529 1y ago
        Why not Okta? I know a company that uses it and no AD. (But they are mostly Mac)
- cyberax 1y ago
  AD is one of the few good MS projects. But you can use it with Macs and Linux just fine! Just keep a couple of Windows servers running AD, and migrate everything else.
  - p_ing 1y ago
    Apple doesn't recommend joining Macs to AD -- their implementation is awful, along with their SMB implementation. But it is technically possible.
    - xcrunner529 1y ago
      The new way is local account with synced password and Kerberos.
okanat 1y ago
It really depends on the size of the business. With smaller businesses it is easy to use alternatives. However any business beyond 1000 employees will give in to shareholder pressure and adopt distrust as its core value. Microsoft Active Directory has excellent tooling for middle-management-heavy businesses. For better or for worse it provides the most integrated solution to reduce a desktop PC to a perfect thing for repetitive, boring, soul crushing office work. No other software solution comes close. While I like Windows as a desktop platform, the reasons that it was designed as it is are very clear. To make cheapest laptops as dystopian as possible, you need systems that can run the same boring software for decades. Not for the good for the environment but for profits. Windows provides all APIs to deeply integrate with Active Directory and MS Office. All engineering, accounting and finance software are deeply integrated with them. They literally run entire countries. I have seen engineering software that used Visio diagrams for designing factory pipelines. It is near impossible to pull the bigger businesses and governments out of this trap without completely upending entire sectors worth trillions. I think only very determined regimes like China can pull it off.
- andyferris 1y ago
  Out of curiosity, how hard would it be to copy Active Directory in an open source project (like how Excel is copied by LibreOffice)? Like if orgs need this capability why is there no good open source solution?
  - Spooky23 1y ago
    It’s been done for years. You can also always pirate windows if there’s a trade embargo. The problem is that the modern approach is to run Entra directory in the cloud.
  - okanat 1y ago
    Active Directory is not one single product. It is an ecosystem. Windows desktops, Windows servers, Microsoft Office, Azure, third party apps running on Windows using Windows APIs and Microsoft server products are all supporting it. Here is a typical office use case in an engineering environment: A user logs into their Windows laptop. It uses a Windows domain which is part of Active Directory system. It connects to the domain server to check the credentials. Those credentials are regularly cached into the Windows laptop. Moreover the company issues smartcards for sensitive access. The user can use the smartcard to login to the laptop too. Active Directory handles the certificates. The manufacturer's driver software integrates with Windows and the Active Directory system. Group Policy is also stored by the domain server and depending on the user's credentials and the roles in the Active Directory system, the relevant engineering apps can be automatically installed on the user's laptop (let's say Altium or Autodesk). The engineering app then integrates with Active Directory to associate the license with the user's identity on Active Directory. The user does their work and want to save a report from the engineering app (let's say a Bill of Materials report), it can be automatically saved to user's OneDrive account as an Excel file. The user can then take this report and share it on SharePoint which is OneDrive but more businessy and it supports creating web pages. So now the user can publish this as a web page in their department's SharePoint instance which they use as the main documentation portal. All of the other third party software like VPN logins, HR systems etc. are all also depend on Active Directory to get the credentials. The scenario above is not just hypothetical. A majority of the biggest conglomerates and even smaller companies are completely locked in. Most of the Western governments too. The usual infrastructure roads, pipelines, power lines etc. were all designed and managed in Active Directory connected Windows PCs. You cannot just replace Active Directory. You need to replace all the infrastructure around it. That includes not only Microsoft systems but also all the third party software that integrates with it. It is a multi-hundered billion dollar industry of proprietary apps all integrating with each other. > Out of curiosity, how hard would it be to copy Active Directory in an open source project (like how Excel is copied by LibreOffice)? > > Like if orgs need this capability why is there no good open source solution? Btw if you think LibreOffice Calc is anywhere close to being an alternative to Excel, you are very mistaken. Just in the basic set of functionality, Calc is 2 decades behind. Excel has a lot of integration with databases to automatically fetch data and update the fields accordingly. If you have a big spreadsheet, Calc struggles a lot while Excel can scale millions of rows quite easily. Why there is no open-source solution? Because it requires a central entity to develop those elementary APIs combined with an operating system and office suite combo. The entity needs to convince all those multi-billion dollar companies to buy their product. Then it needs to send engineers to work with both clients and software vendors to handle all sorts of kinks and weird use cases. Microsoft has been doing this since 90s. The entire corporate desktop ecosystem has developed around them and they ensured that Windows and Office would be a centerpiece of all those systems. A bazaar-style open source ecosystem will not be able to manage the scale. Without a central vision and strong product management, it is not possible to mesh multiple projects together. The current open-source systems cannot even agree on which GUI display protocol to use which is just microscopic compared to everything else. Only a very determined government with virtually unlimited funds and very stable decision making (very likely to be authoritarian) can force all the companies to switch something else. China is that government and they are somewhat successful but not entirely.

firesteelrain 1y ago

Right, it’s stuff like Active Directory and how everything’s tied together. Once you’re using that for auth, it’s really tough to back out without a lot of effort. We’ve looked into FreeIPA and similar options, but honestly, nothing really holds a candle to Active Directory yet.

AnonymousPlanet 1y ago
AD and Domain Servers are like a cancer that will grow metastases around your org, costing user and client cals all over the place, even for every desk phone if you're not careful. The only winning move is never to play their game in the first place.
- firesteelrain 1y ago
  I'm in a situation where due to staff skillsets and ease of management then GPOs are required. Local GPOs would be insane to manage across thousands of PCs
  - thewebguyd 1y ago
    InTune/MDMs are finally eating away at the need for GPOs for most use cases. Someone already familiar with AD & Group Policy should be able to easily transition to InTune Configuration Policies. MS even has a tool now to import your GPOs. There's still a few that don't have direct equivalents, but the list is growing smaller and smaller.
    - AnonymousPlanet 1y ago
      InTune is part of Microsoft's strategy to make everyone dependent on their cloud. It's like switching from Heroin to Fentanyl because you want to get off of your addiction.
  - AnonymousPlanet 1y ago
    Yes and that is a very common case. Windows is designed so that you barely have a chance to deal with your case without Microsoft components all the way. You would need a company with enormous resources to play catch up with the highly integrated and proprietary connections between each component. It's a rigged monopoly and has nothing to do with a market economy. Once you have been forced to use Windows, you are doomed.
- mnadkvlb 1y ago
  genuinely interested, what are the alternatives ? i know ping/forgerock and some old ibm stuff. what is state of the art today that compares to ActiveDirectory (not talking azureAd - or whatever they call it these days) ?
  - firesteelrain 1y ago
    Samba4 is the closest you can get. It is not as nice as ActiveDirectory.
    - smaudet 1y ago
      > Samba is an important component to seamlessly integrate Linux/Unix Servers and Desktops into Active Directory environments. It can function either as an Active Directory Domain Controller or as a member server. What's something that AD provides that this does not? It certainly sounds like an (almost) drop-in replacement.
      - firesteelrain 1y ago
        Samba4 covers core AD features like Kerberos, LDAP, and can act as a DC, but it’s not a full drop-in. GPO support is limited, management tools aren’t as robust (no full RSAT equivalent), and some advanced AD features (like DAC or ADCS) aren’t supported. Fine for smaller setups, but not 1:1 with enterprise AD.
    - xcrunner529 1y ago
      Why not Okta? I know a company that uses it and no AD. (But they are mostly Mac)
cyberax 1y ago
AD is one of the few good MS projects. But you can use it with Macs and Linux just fine! Just keep a couple of Windows servers running AD, and migrate everything else.
- p_ing 1y ago
  Apple doesn't recommend joining Macs to AD -- their implementation is awful, along with their SMB implementation. But it is technically possible.
  - xcrunner529 1y ago
    The new way is local account with synced password and Kerberos.

okanat 1y ago

It really depends on the size of the business. With smaller businesses it is easy to use alternatives. However any business beyond 1000 employees will give in to shareholder pressure and adopt distrust as its core value. Microsoft Active Directory has excellent tooling for middle-management-heavy businesses. For better or for worse it provides the most integrated solution to reduce a desktop PC to a perfect thing for repetitive, boring, soul crushing office work. No other software solution comes close. While I like Windows as a desktop platform, the reasons that it was designed as it is are very clear. To make cheapest laptops as dystopian as possible, you need systems that can run the same boring software for decades. Not for the good for the environment but for profits. Windows provides all APIs to deeply integrate with Active Directory and MS Office. All engineering, accounting and finance software are deeply integrated with them. They literally run entire countries. I have seen engineering software that used Visio diagrams for designing factory pipelines. It is near impossible to pull the bigger businesses and governments out of this trap without completely upending entire sectors worth trillions. I think only very determined regimes like China can pull it off.

andyferris 1y ago
Out of curiosity, how hard would it be to copy Active Directory in an open source project (like how Excel is copied by LibreOffice)? Like if orgs need this capability why is there no good open source solution?
- Spooky23 1y ago
  It’s been done for years. You can also always pirate windows if there’s a trade embargo. The problem is that the modern approach is to run Entra directory in the cloud.
- okanat 1y ago
  Active Directory is not one single product. It is an ecosystem. Windows desktops, Windows servers, Microsoft Office, Azure, third party apps running on Windows using Windows APIs and Microsoft server products are all supporting it. Here is a typical office use case in an engineering environment: A user logs into their Windows laptop. It uses a Windows domain which is part of Active Directory system. It connects to the domain server to check the credentials. Those credentials are regularly cached into the Windows laptop. Moreover the company issues smartcards for sensitive access. The user can use the smartcard to login to the laptop too. Active Directory handles the certificates. The manufacturer's driver software integrates with Windows and the Active Directory system. Group Policy is also stored by the domain server and depending on the user's credentials and the roles in the Active Directory system, the relevant engineering apps can be automatically installed on the user's laptop (let's say Altium or Autodesk). The engineering app then integrates with Active Directory to associate the license with the user's identity on Active Directory. The user does their work and want to save a report from the engineering app (let's say a Bill of Materials report), it can be automatically saved to user's OneDrive account as an Excel file. The user can then take this report and share it on SharePoint which is OneDrive but more businessy and it supports creating web pages. So now the user can publish this as a web page in their department's SharePoint instance which they use as the main documentation portal. All of the other third party software like VPN logins, HR systems etc. are all also depend on Active Directory to get the credentials. The scenario above is not just hypothetical. A majority of the biggest conglomerates and even smaller companies are completely locked in. Most of the Western governments too. The usual infrastructure roads, pipelines, power lines etc. were all designed and managed in Active Directory connected Windows PCs. You cannot just replace Active Directory. You need to replace all the infrastructure around it. That includes not only Microsoft systems but also all the third party software that integrates with it. It is a multi-hundered billion dollar industry of proprietary apps all integrating with each other. > Out of curiosity, how hard would it be to copy Active Directory in an open source project (like how Excel is copied by LibreOffice)? > > Like if orgs need this capability why is there no good open source solution? Btw if you think LibreOffice Calc is anywhere close to being an alternative to Excel, you are very mistaken. Just in the basic set of functionality, Calc is 2 decades behind. Excel has a lot of integration with databases to automatically fetch data and update the fields accordingly. If you have a big spreadsheet, Calc struggles a lot while Excel can scale millions of rows quite easily. Why there is no open-source solution? Because it requires a central entity to develop those elementary APIs combined with an operating system and office suite combo. The entity needs to convince all those multi-billion dollar companies to buy their product. Then it needs to send engineers to work with both clients and software vendors to handle all sorts of kinks and weird use cases. Microsoft has been doing this since 90s. The entire corporate desktop ecosystem has developed around them and they ensured that Windows and Office would be a centerpiece of all those systems. A bazaar-style open source ecosystem will not be able to manage the scale. Without a central vision and strong product management, it is not possible to mesh multiple projects together. The current open-source systems cannot even agree on which GUI display protocol to use which is just microscopic compared to everything else. Only a very determined government with virtually unlimited funds and very stable decision making (very likely to be authoritarian) can force all the companies to switch something else. China is that government and they are somewhat successful but not entirely.