6 ms·
Right, it’s stuff like Active Directory and how everything’s tied together. Once you’re using that for auth, it’s really tough to back out without a lot of effo
by firesteelrain 1y ago
Right, it’s stuff like Active Directory and how everything’s tied together. Once you’re using that for auth, it’s really tough to back out without a lot of effort.
We’ve looked into FreeIPA and similar options, but honestly, nothing really holds a candle to Active Directory yet.
- AnonymousPlanet 1y agoAD and Domain Servers are like a cancer that will grow metastases around your org, costing user and client cals all over the place, even for every desk phone if you're not careful. The only winning move is never to play their game in the first place.
- firesteelrain 1y agoI'm in a situation where due to staff skillsets and ease of management then GPOs are required. Local GPOs would be insane to manage across thousands of PCs
- thewebguyd 1y agoInTune/MDMs are finally eating away at the need for GPOs for most use cases. Someone already familiar with AD & Group Policy should be able to easily transition to InTune Configuration Policies. MS even has a tool now to import your GPOs. There's still a few that don't have direct equivalents, but the list is growing smaller and smaller.
- AnonymousPlanet 1y agoInTune is part of Microsoft's strategy to make everyone dependent on their cloud. It's like switching from Heroin to Fentanyl because you want to get off of your addiction.
- AnonymousPlanet 1y agoYes and that is a very common case. Windows is designed so that you barely have a chance to deal with your case without Microsoft components all the way. You would need a company with enormous resources to play catch up with the highly integrated and proprietary connections between each component. It's a rigged monopoly and has nothing to do with a market economy. Once you have been forced to use Windows, you are doomed.
- mnadkvlb 1y agogenuinely interested, what are the alternatives ? i know ping/forgerock and some old ibm stuff. what is state of the art today that compares to ActiveDirectory (not talking azureAd - or whatever they call it these days) ?
- firesteelrain 1y agoSamba4 is the closest you can get. It is not as nice as ActiveDirectory.
- smaudet 1y ago> Samba is an important component to seamlessly integrate Linux/Unix Servers and Desktops into Active Directory environments. It can function either as an Active Directory Domain Controller or as a member server. What's something that AD provides that this does not? It certainly sounds like an (almost) drop-in replacement.
- firesteelrain 1y agoSamba4 covers core AD features like Kerberos, LDAP, and can act as a DC, but it’s not a full drop-in. GPO support is limited, management tools aren’t as robust (no full RSAT equivalent), and some advanced AD features (like DAC or ADCS) aren’t supported. Fine for smaller setups, but not 1:1 with enterprise AD.
- xcrunner529 1y agoWhy not Okta? I know a company that uses it and no AD. (But they are mostly Mac)
- cyberax 1y agoAD is one of the few good MS projects. But you can use it with Macs and Linux just fine! Just keep a couple of Windows servers running AD, and migrate everything else.
- p_ing 1y agoApple doesn't recommend joining Macs to AD -- their implementation is awful, along with their SMB implementation. But it is technically possible.
- xcrunner529 1y agoThe new way is local account with synced password and Kerberos.