4 ms·

> It's nuts Windows is still the go-to for anything these days despite everyone knowing what a parasitic Linux still doesn't have anywhere near as nice and coh

> It's nuts Windows is still the go-to for anything these days despite everyone knowing what a parasitic Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. Plus you can pay Microsoft to host it all for you on Azure.

forinti 6mo ago
Yes, liberty comes at a cost. It seems that convenience is no longer the main motivator for many people.
- lionkor 6mo ago
  Convenience comes as a result of mass market adoption, for products for which convenience was not already the main selling factor. Look at cars; they were kind of difficult to drive and maintain 60 years ago, now they're super convenient to drive and maintain as you essentially just press buttons and look at screens to get all needed information about the car and drive it. It's probably something like "inception -> adoption -> convenience". For Windows it was the same, was it not? It wasn't absolutely convenient to use, it was just better (in terms of usability and features for the average consumer), and convenience came after (Windows XP, Windows 7). Sadly the functionality degraded, and now all that is left is convenience.
- veber-alex 6mo ago
  [flagged]
  - cgio 6mo ago
    If you don’t depend on someone that’s freedom.
  - pjc50 6mo ago
    Freedom from suddenly being cut off is potentially important.
  - mechoblast 6mo ago
    If your email was forcefully terminated would you call that an infringement on your freedoms.
llarsson 6mo ago
Imagine what can happen if the French and other governments would start pouring all the money into developing that further in the open, rather than just giving it all to Microsoft instead?
- orochimaaru 6mo ago
  Why haven’t they done it yet? I just think they’re incentivized enough for it.
  - sph 6mo ago
    Because until literally a year ago, the country that hosted Microsoft was one of France's most trusted allies. It takes time to find a suitable replacement to a global monopoly.
    - orochimaaru 6mo ago
      Not really. I mean Trump has amped the rhetoric, but there have been no new laws passed. The privacy threats were always there.
      - pjc50 6mo ago
        Law is irrelevant under the power of the gun; it was the threat to invade Greenland and the threat to leave NATO which have triggered this. (people keep saying things like "only Congress has the power to declare war"; that may be technically true, but a war declaration is a piece of paper, and practically the authorization of force is at the personal disposition of the President)
      - bootsmann 6mo ago
        Not everything makes US news but the decision by Microsoft to shut down ICC accounts after a Trump EO on sanctions really spooked a lot of EU governments.
      - bulbar 6mo ago
        There were general and abstract privacy threats. The current US administration however has managed to alienate the EU population as well as EU politicians. Trump has basically ended the alliance between the western world and the US and everybody has started to built around that fact. Just one example is that the EU has finalized multiple huge trade contracts, some were in the making for decades. I don't think the next US administration - if the US remains a democracy - will be able to fix that. The US lately has been very vocal that they don't want to be the center of the western world anymore and the western world got the message. Reorganizing the post-WWII world order will take some time, of course, but I feel like the world is proceeding quite fast.
hug 6mo ago
Group Policy and Active Directory are dead, for all intents and purposes. It's now Intune (via OMA-DM), and Entra. Both of those products are about as bad as you might imagine the "cloud" versions of GP & AD might be. They are better, in ways -- no longer having to care and feed for domain controllers is nice, and there's no longer an overhead for additive policy processing, so endpoints only get a single set of policy and log on much quicker -- but for the most part, enterprise management of Windows devices is in a worse place than it was ten years ago. Try to figure out how long it will take an online Intune device to discover a new policy: As far as I can tell the answer is "eventually". There are bandaids for this, because of how infuriating it is, of course, but all time guarantees are basically gone. Ask me a decade ago what an enterprise should do, and my answer would be straightforward: AD, GPO, Exchange. The answer now is not simple.
- mbreese 6mo ago
  > Ask me a decade ago what an enterprise should do, and my answer would be straightforward: AD, GPO, Exchange. That was also the answer two decades ago. But if AD and GPO are now dead, what killed them and what are the options? Is the problem mobile and BYOD? I’ve been primarily on Macs since that time where endpoint management isn’t much, so there are fewer knobs to fiddle with. In some ways it’s nice in that admins can’t screw around too much with my system. In other ways, I’m sure Macs feel limiting for those in charge of enterprise security. However, most endpoint management feels like it’s written for Windows with Macs as an afterthought for checklist security. Knowing that, I’m happy there are fewer places for dodgy software to be able to interface with the OS. (Edit: added quote to top)
  - kgwxd 6mo ago
    No alternative, you can't realistically fully control everything everyone does on every device in their possession. It was job security for useless control freaks, the products never should have existed.
    - ethbr1 6mo ago
      Spoken like someone who has never provided computers to non-technical, minimum-wage users.
ndriscoll 6mo ago
I've never understood the management thing. People manage fleets of Linux machines all the time. What does group policy do that e.g. nix or ansible don't?
- ethbr1 6mo ago
  Fuse membership and inheritance-based object (in the sense of 'any computing thing or person') ontology with configurability? The insight in AD+GPO wasn't in either thing, but in the +. Each would be far less useful without the other.
- jodrellblank 6mo ago
  Group policy just sets registry keys. That's nothing you can't do any other way. The important bit is the inertia of 30 years of Windows subsystems and integration with Active Directory and 3rd party Windows ecosystem software all being written to expose internal config and look to registry keys for the settings. For the first part, Group Policy (GPO) can set the screen to lock after 2 minutes of inactivity, say, which works because there are Windows subsystems built to look for a reg key for their config, and policy templates exposing that config in the GUI management tools. Or group policy configures which security group can "logon as a service" which works because Windows has system-wide and domain-wide pervasive Access Control Lists (ACLs). GPO configures that Background Intelligent Transfer Service (BITS) should limit its bandwidth use, which works because Windows Updates use BITS. Or sets the machine-wide SSL cipher order, because Windows software uses system-wide schannel not OpenSSL. Or GPO sets what your default printer will be and that's only useful because decades of 3rd party Windows software was written to use the standard Windows printer dialog, or User Documents path, or whatever. For the second part, Active Directory is a tree-shaped organization tool; in screenshot[5] that I quickly Googled, the tree on the left has a folder named "Sydney" and below that "Sydney Users"; this lets sysadmins organise the company computer accounts, user accounts, and security groups by whatever hierarchy makes sense for that company - e.g. by country, office, team, department, building floor, etc. Then Group Policy overlays on that structure, and the policies are composable. e.g. in this basic screenshot of the group policy manamement GUI[6] it's showing at the bottom a list of all group policy configurations that have been made in a domain such as "Block PowerShell", and higher up it shows the policy "PsExec Allow" has been linked inside the "ADPRO Computers" folder. So users and computers in that folder in AD, will get those policies applied. In screenshot[7] you can see a basic example showing corporate computers getting machine-wide settings, corporate users getting user-level MS Office config, and Executives get settings that nobody else gets. (This echoes the registry having separate HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER subtrees). Screenshot[8] shows the relatively tidy GUI on the right for seeing which settings have been configured in a policy. If you apply more than one GPO to a folder, the users/computers will get the all the policy settings combined. This is often what people complain about when logging on to a corporate Windows machine takes ages, btw. You can filter GPOs on a case-by-case basis to build patterns like "apply this machine-wide policy to all computers in the Sydney folder which are members of the WarehouseComputer security group" or "apply these logon-settings to employees in New York who are members of Finance and logging onto a laptop". So companies which have been around for years can have really (messy) big and intricate designs which would be a lot of work to migrate. 3rd party programs can release XML files which plug into the GPO management, and the programs were written to expect to be configured by registry keys so they can pick up those settings; there are templates for configuring FireFox[1], Chrome[2] Adobe Acrobat[3], Word, Excel, Office[4], VMWare Horizon, Lenovo Dock Manager, Zoom, RealVNC, LibreOffice, Citrix, FoxIT Reader, and so on. The more enterprisey a tool is, the more likely it will plug into that ecosystem. Then all kinds of 3rd party reporting and auditing tools look there to see if your company is compliant with this or that; the whole thing is integrated with Windows' domain-wide ACLs so you can give some admins permissions to view or edit just their regional subset of this. As usual the lockin is not that they do something amazing that nothing else can do, the lockin is that Windows domains have been around in this format for 30 years since NT4 and Windows 2000, and it has huge inertia, familiarity, is deeply embedded in a lot of companies, you can easily and cheaply hire lots of people who know how to use and manage it, you can send screenshots of it to auditors and they understand it, if you don't know how but you have a bit of (oldschool) Windows experience then clicking around will get you the basics, you can buy 3rd party auditing software that will send you a management friendly report with green ticks saying almost everything is fine but you should change this setting for security... [Yes of course you can build your own custom replacement for every single thing, just like you can build your own custom replacement for any software; it's "just" ldap and kerberos and dns and some scripts and site-to-site policy replication and management tools und und und]. [1] https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows https://support.mozilla.org/en-US/kb/customizing-firefox-usi... [2] https://support.google.com/chrome/a/answer/187202?hl=en https://support.google.com/chrome/a/answer/187202?hl=en [3] https://www.adobe.com/devnet-docs/acrobatetk/tools/DesktopDeployment/gpo.html https://www.adobe.com/devnet-docs/acrobatetk/tools/DesktopDe... [4] https://www.microsoft.com/en-us/download/details.aspx?id=49030 https://www.microsoft.com/en-us/download/details.aspx?id=490... [5] https://www.windows-active-directory.com/wp-content/uploads/2021/06/enable.png https://www.windows-active-directory.com/wp-content/uploads/... [6] https://activedirectorypro.com/wp-content/uploads/2022/09/gpmc-overview.webp https://activedirectorypro.com/wp-content/uploads/2022/09/gp... [7] https://www.varonis.com/hs-fs/hubfs/blog%20posts/Group%20Policy%20Best%20Practices/gpo_linking.png https://www.varonis.com/hs-fs/hubfs/blog%20posts/Group%20Pol... [8] https://redmondmag.com/articles/2016/01/12/~/media/ecg/redmondmag/images/2016/01/grouppolicy_fig2.ashx https://redmondmag.com/articles/2016/01/12/~/media/ecg/redmo...
pjc50 6mo ago
> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. Isn't it about time someone developed one? The foundations are there; you can imagine an organization deploying laptops with, say, Ansible, and not giving users root on them. LDAP sort of matches the old capabilities of AD, but not completely. There's even a "SAMBA as fake domain controller" mode. Ironically what it needs is a product or service which organizations can pay to take the problem off their hands. But then people get stuck in never paying for anything in the open source world.
- xorcist 6mo ago
  > Isn't it about time someone developed one? Honest question: Why? If you want a Windows-like environment, run Windows. I get this all the time when people ask about a Linux equivalent for something, and aren't really satistied when it doesn't work or look the same. Linux isn't a clone of Windows. Linux comes from an older heritage, and has a unique culture. You are in for a hard time if you want to use Linux like you would use Windows. That's a suboptimal experience, at best. That said, of course Linux should be easy to manage. But Windows is from a single corporate entity, of course their management tools will be different. It used to be unix admins that laughed about people using Windows as servers. The culture around Linux is one of scriptabiliy where even the user interface, the basic shell, is one where every command is inherently a script. That's why management on Linux looks like Ansible and OpenSSH, not like Remote Desktop and Group Policies. You could write something like Group Policies for Linux of course, but it wouldn't be a complete solution so people would just continue using Ansible, OpenSSH, and the respective package managers.
  - ethbr1 6mo ago
    What's the Linux version of AD and group policies? (honestly curious; linux sysadmin at scale not my day job)
    - xorcist 6mo ago
      I don't know. What's the Windows equivalent of dpkg (from 1993) and ssh (from 1995)? Still nothing, three decades later. Not because Microsoft engineers couldn't do it, of course, but becasue they didn't want to. It doesn't fit the Windows model. They did recently adopt SSH, but that was because they want to use Windows in cloud-like environments, where expectations are set by Linux-style tools. By the time Windows got to the point where it even could be centrally managed in any reasonable fashion, Linux environments was routinely run an order of magnitude larger still. There is a reason why the whole cloud runs Linux. Anything else is a rounding error. That's because Linux is inherently so much less work to manage at scale. If something like Group Policies would somehow be accepted by the Linux community, that could only be a step backwards. A well run Ansible or Puppet or similar environment works on a completely different scale.
Levitating 6mo ago
> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. I am sure that's something the Gnome Foundation could figure out if they had a grant to do so.
- tremon 6mo ago
  Putting it in the hands on the GNOME foundation will just result in a lot of new soon-to-be-mandatory APIs and numerous configuration variables with only one allowed value.
kgwxd 6mo ago
Even the old companies have moved away from that nonsense. Huge waste of resources.
Bayart 6mo ago
The primitives are there and they're solid, beyond that it's "just" architecture and integration work. Hopefully the French government will be rational with this (I believe the time and financial constraints will for it to be, we're broke and we lack time) and they won't fall into the trap of trying to internalize every bit of the platform. A good example of that would be what happened with Docker. Off the top of my head cgroups, namespaces, seccomp, overlays and capabilities had been around for a while before it got rolled up in a nice utility in 2013 and opensourced in 2015. Hence the containerization movement. Solaris zones and FreeBSD jails were nice but they always were let's say a bit too bearded.
ninjagoo 6mo ago
> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. Enterprise environments use a number of tools like Powerbroker, UCS, Centrify/Delinea etc to bind linux machines to active directory and manage identity and access through active directory. This is for mixed environments with both Windows and Linux machines. For pure linux environments, there are a number of tools like FreeIPA/IdM, Samba AD/DC (for A/D like management), and OpenText's eDirectory for the current version of Novell's eDirectory counterpart to A/D. They all provide centralized user/host/policy/access management. Since Entra+Intune are the recent MS products, cloud-based equivalents are Jumpcloud+Fleet, Okta PAM, FreeIPA/IdM.
- fenykep 6mo ago
  I don't know any of these tools but I believe your comment answers most questions in this thread. I really hope some of these answers are ergonomic enough for windows sysadmins to accomodate this transition.
Zigurd 6mo ago
Personal computers were used in office environments long before the technologies to make them administer-able as if they were a mainframe. Before blindly jumping in and reproducing those technologies, better to ask why they emerged in the first place. Most workplaces don't have strict bans on personal mobile devices, and some of the ones that do, don't have the kind of physical perimeter defense that can detect people getting lazy about whether or not they carry their personal mobile devices into the workplace. That makes perimeter defense into security theater anyway. We need a rethink about what we are guarding against and how we're doing it.
- ethbr1 6mo ago
  > Most workplaces don't have strict bans on personal mobile devices If you're talking about select work apps on your mobile device, sure, but that's limited attack surface. If you're talking about employers who let unmanaged mobile devices hop on their internal network... I've never seen that. Maybe at a hypothetically perfect zero-trust shop?
  - Zigurd 6mo ago
    I've seen a lot of un-seriousness about security. One that's easy to spot is old unpatched IP phones that aren't segregated on the network. I've given demos at companies that are serious, where a device I accidentally left behind caused an urgent search of every room I had been in. Security didn't have to be told which rooms those were.
    - ethbr1 6mo ago
      You likely know better than I, but I've always had a weird intuition that enterprise IT security is bifurcated into "Leaders who understand compliance+details" and "Leaders who confuse compliance for details" with very different results. And I get it's extra work, but I've seen some weird "But if you'd just built this a bit differently, you would have gotten all these free security bonuses to your posture" gaps. Imho, a huge part of the problem is invisibility. I'm firmly of the belief the US government should be running scans on entities in regulated industries (defense, healthcare, utility, telecom) with regulated redress of any findings. Trusting private industry isn't working.
oneplane 6mo ago
It does, it's called FreeIPA (or RedHat IdM). The only GPO parts it doesn't do are those that are not related to policy in the IAM sense (i.e. configuring some application related thing). There's other systems for that, just like on Windows you practically never run GPO without anything else. On top of that, you can pay RedHat or Canonical to host it all for you on any cloud or non-cloud.
Lihh27 6mo ago
that's the catch with gp/ad. for a lot of orgs the hard part is intune/entra now. swapping the desktop is easy. replacing identity and device management is the real migration
- ethbr1 6mo ago
  Doesn't the Azure team own Intune/Entra now? Read: less inclined to give a fuck about artificially protecting Windows desktop. I've no idea what current internal Microsoft org divisions are.
XorNot 6mo ago
Honestly as wide spread as it is, managing group policy sanely is still a challenge I've found - it's very resistant to configuration as code. Linux has a lot of the pieces but is principally lacking a solid distribution system - in particular a big missing component is the network-based SELinux policy distribution system which you can see some hooks in for the concept of a "policy server" which never eventuated. SELinux would be a lot more viable if it had a solid way to federate and distribute policy and has some nice features in that regard (i.e. the notion that networked systems can exchange policy tags to preserve tagging across network connections).
- ethbr1 6mo ago
  > managing group policy sanely is still a challenge I've found - it's very resistant to configuration as code Imho, this was historically (and continues to be) Microsoft's Achilles heel. Large parts of the company reflexively wrote features / tooling as manual-first, code-second (or never). In hindsight, what was missing was a Gates-level memo circa 2000 similar to Amazon's API one: all teams are required to build their configurators to be programmatically exposed. Unfortunately, I don't think Ballmer was enough of a technologist (and was likely too distracted) to intuit that path not taken.
otikik 6mo ago
Must be the only nice and cohesive parts left. Perhaps they have not figured out how to put ads on AI on it because it doesn't have many users.
Spooky23 6mo ago
This is actually a good time to disrupt that, as Microsoft’s attention is not on windows and Active Directory is slowly moving to Entra, although big enterprises are mostly hybrid. Some places are using Okta for many of those functions too. Trump’s instinctive parasitic slumlord behavior may be enough for the sleepy Europeans to get their shit together.
kakacik 6mo ago
No non-US government should host anything on azure, or any other US-owned cloud. Thats security and sovereignity 101, or more like 100. Reality with hostile US being as it is. What you list are no showstoppers, and since its a well known topic I cant imagine why some EU-funded effort in say 2 billions over next 3-5 years shouldnt reaolve it once and for all, for entire world. Well invested money.
guenthert 6mo ago
> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. I take your word for it (I know of Kerberos and LDAP and Netscape and Sun trying to make such palatable, but clearly haven't followed that in the last quarter-century). That assumes however the server to be currently MS Windows. For government agencies, I'd rather expect some Mainframe to be (and remain) in place. Surely IBM (or here rather Groupe Bull) has user authentication/authorization figured out (more than half a century ago, methinks).
franktankbank 6mo ago
I'm sorry, but how hard is that? Seriously.
radiator 6mo ago
But isn't that the whole point, that foreign governments perhaps do not want Microsoft to host all their data, users, groups, software on Azure, because then the CIA also might obtain access?

forinti 6mo ago

Yes, liberty comes at a cost. It seems that convenience is no longer the main motivator for many people.

lionkor 6mo ago
Convenience comes as a result of mass market adoption, for products for which convenience was not already the main selling factor. Look at cars; they were kind of difficult to drive and maintain 60 years ago, now they're super convenient to drive and maintain as you essentially just press buttons and look at screens to get all needed information about the car and drive it. It's probably something like "inception -> adoption -> convenience". For Windows it was the same, was it not? It wasn't absolutely convenient to use, it was just better (in terms of usability and features for the average consumer), and convenience came after (Windows XP, Windows 7). Sadly the functionality degraded, and now all that is left is convenience.
veber-alex 6mo ago
[flagged]
- cgio 6mo ago
  If you don’t depend on someone that’s freedom.
- pjc50 6mo ago
  Freedom from suddenly being cut off is potentially important.
- mechoblast 6mo ago
  If your email was forcefully terminated would you call that an infringement on your freedoms.

llarsson 6mo ago

Imagine what can happen if the French and other governments would start pouring all the money into developing that further in the open, rather than just giving it all to Microsoft instead?

orochimaaru 6mo ago
Why haven’t they done it yet? I just think they’re incentivized enough for it.
- sph 6mo ago
  Because until literally a year ago, the country that hosted Microsoft was one of France's most trusted allies. It takes time to find a suitable replacement to a global monopoly.
  - orochimaaru 6mo ago
    Not really. I mean Trump has amped the rhetoric, but there have been no new laws passed. The privacy threats were always there.
    - pjc50 6mo ago
      Law is irrelevant under the power of the gun; it was the threat to invade Greenland and the threat to leave NATO which have triggered this. (people keep saying things like "only Congress has the power to declare war"; that may be technically true, but a war declaration is a piece of paper, and practically the authorization of force is at the personal disposition of the President)
    - bootsmann 6mo ago
      Not everything makes US news but the decision by Microsoft to shut down ICC accounts after a Trump EO on sanctions really spooked a lot of EU governments.
    - bulbar 6mo ago
      There were general and abstract privacy threats. The current US administration however has managed to alienate the EU population as well as EU politicians. Trump has basically ended the alliance between the western world and the US and everybody has started to built around that fact. Just one example is that the EU has finalized multiple huge trade contracts, some were in the making for decades. I don't think the next US administration - if the US remains a democracy - will be able to fix that. The US lately has been very vocal that they don't want to be the center of the western world anymore and the western world got the message. Reorganizing the post-WWII world order will take some time, of course, but I feel like the world is proceeding quite fast.

hug 6mo ago

Group Policy and Active Directory are dead, for all intents and purposes. It's now Intune (via OMA-DM), and Entra. Both of those products are about as bad as you might imagine the "cloud" versions of GP & AD might be. They are better, in ways -- no longer having to care and feed for domain controllers is nice, and there's no longer an overhead for additive policy processing, so endpoints only get a single set of policy and log on much quicker -- but for the most part, enterprise management of Windows devices is in a worse place than it was ten years ago. Try to figure out how long it will take an online Intune device to discover a new policy: As far as I can tell the answer is "eventually". There are bandaids for this, because of how infuriating it is, of course, but all time guarantees are basically gone. Ask me a decade ago what an enterprise should do, and my answer would be straightforward: AD, GPO, Exchange. The answer now is not simple.

mbreese 6mo ago
> Ask me a decade ago what an enterprise should do, and my answer would be straightforward: AD, GPO, Exchange. That was also the answer two decades ago. But if AD and GPO are now dead, what killed them and what are the options? Is the problem mobile and BYOD? I’ve been primarily on Macs since that time where endpoint management isn’t much, so there are fewer knobs to fiddle with. In some ways it’s nice in that admins can’t screw around too much with my system. In other ways, I’m sure Macs feel limiting for those in charge of enterprise security. However, most endpoint management feels like it’s written for Windows with Macs as an afterthought for checklist security. Knowing that, I’m happy there are fewer places for dodgy software to be able to interface with the OS. (Edit: added quote to top)
- kgwxd 6mo ago
  No alternative, you can't realistically fully control everything everyone does on every device in their possession. It was job security for useless control freaks, the products never should have existed.
  - ethbr1 6mo ago
    Spoken like someone who has never provided computers to non-technical, minimum-wage users.

ndriscoll 6mo ago

I've never understood the management thing. People manage fleets of Linux machines all the time. What does group policy do that e.g. nix or ansible don't?

ethbr1 6mo ago
Fuse membership and inheritance-based object (in the sense of 'any computing thing or person') ontology with configurability? The insight in AD+GPO wasn't in either thing, but in the +. Each would be far less useful without the other.
jodrellblank 6mo ago
Group policy just sets registry keys. That's nothing you can't do any other way. The important bit is the inertia of 30 years of Windows subsystems and integration with Active Directory and 3rd party Windows ecosystem software all being written to expose internal config and look to registry keys for the settings. For the first part, Group Policy (GPO) can set the screen to lock after 2 minutes of inactivity, say, which works because there are Windows subsystems built to look for a reg key for their config, and policy templates exposing that config in the GUI management tools. Or group policy configures which security group can "logon as a service" which works because Windows has system-wide and domain-wide pervasive Access Control Lists (ACLs). GPO configures that Background Intelligent Transfer Service (BITS) should limit its bandwidth use, which works because Windows Updates use BITS. Or sets the machine-wide SSL cipher order, because Windows software uses system-wide schannel not OpenSSL. Or GPO sets what your default printer will be and that's only useful because decades of 3rd party Windows software was written to use the standard Windows printer dialog, or User Documents path, or whatever. For the second part, Active Directory is a tree-shaped organization tool; in screenshot[5] that I quickly Googled, the tree on the left has a folder named "Sydney" and below that "Sydney Users"; this lets sysadmins organise the company computer accounts, user accounts, and security groups by whatever hierarchy makes sense for that company - e.g. by country, office, team, department, building floor, etc. Then Group Policy overlays on that structure, and the policies are composable. e.g. in this basic screenshot of the group policy manamement GUI[6] it's showing at the bottom a list of all group policy configurations that have been made in a domain such as "Block PowerShell", and higher up it shows the policy "PsExec Allow" has been linked inside the "ADPRO Computers" folder. So users and computers in that folder in AD, will get those policies applied. In screenshot[7] you can see a basic example showing corporate computers getting machine-wide settings, corporate users getting user-level MS Office config, and Executives get settings that nobody else gets. (This echoes the registry having separate HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER subtrees). Screenshot[8] shows the relatively tidy GUI on the right for seeing which settings have been configured in a policy. If you apply more than one GPO to a folder, the users/computers will get the all the policy settings combined. This is often what people complain about when logging on to a corporate Windows machine takes ages, btw. You can filter GPOs on a case-by-case basis to build patterns like "apply this machine-wide policy to all computers in the Sydney folder which are members of the WarehouseComputer security group" or "apply these logon-settings to employees in New York who are members of Finance and logging onto a laptop". So companies which have been around for years can have really (messy) big and intricate designs which would be a lot of work to migrate. 3rd party programs can release XML files which plug into the GPO management, and the programs were written to expect to be configured by registry keys so they can pick up those settings; there are templates for configuring FireFox[1], Chrome[2] Adobe Acrobat[3], Word, Excel, Office[4], VMWare Horizon, Lenovo Dock Manager, Zoom, RealVNC, LibreOffice, Citrix, FoxIT Reader, and so on. The more enterprisey a tool is, the more likely it will plug into that ecosystem. Then all kinds of 3rd party reporting and auditing tools look there to see if your company is compliant with this or that; the whole thing is integrated with Windows' domain-wide ACLs so you can give some admins permissions to view or edit just their regional subset of this. As usual the lockin is not that they do something amazing that nothing else can do, the lockin is that Windows domains have been around in this format for 30 years since NT4 and Windows 2000, and it has huge inertia, familiarity, is deeply embedded in a lot of companies, you can easily and cheaply hire lots of people who know how to use and manage it, you can send screenshots of it to auditors and they understand it, if you don't know how but you have a bit of (oldschool) Windows experience then clicking around will get you the basics, you can buy 3rd party auditing software that will send you a management friendly report with green ticks saying almost everything is fine but you should change this setting for security... [Yes of course you can build your own custom replacement for every single thing, just like you can build your own custom replacement for any software; it's "just" ldap and kerberos and dns and some scripts and site-to-site policy replication and management tools und und und]. [1] https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows https://support.mozilla.org/en-US/kb/customizing-firefox-usi... [2] https://support.google.com/chrome/a/answer/187202?hl=en https://support.google.com/chrome/a/answer/187202?hl=en [3] https://www.adobe.com/devnet-docs/acrobatetk/tools/DesktopDeployment/gpo.html https://www.adobe.com/devnet-docs/acrobatetk/tools/DesktopDe... [4] https://www.microsoft.com/en-us/download/details.aspx?id=49030 https://www.microsoft.com/en-us/download/details.aspx?id=490... [5] https://www.windows-active-directory.com/wp-content/uploads/2021/06/enable.png https://www.windows-active-directory.com/wp-content/uploads/... [6] https://activedirectorypro.com/wp-content/uploads/2022/09/gpmc-overview.webp https://activedirectorypro.com/wp-content/uploads/2022/09/gp... [7] https://www.varonis.com/hs-fs/hubfs/blog%20posts/Group%20Policy%20Best%20Practices/gpo_linking.png https://www.varonis.com/hs-fs/hubfs/blog%20posts/Group%20Pol... [8] https://redmondmag.com/articles/2016/01/12/~/media/ecg/redmondmag/images/2016/01/grouppolicy_fig2.ashx https://redmondmag.com/articles/2016/01/12/~/media/ecg/redmo...

pjc50 6mo ago

> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. Isn't it about time someone developed one? The foundations are there; you can imagine an organization deploying laptops with, say, Ansible, and not giving users root on them. LDAP sort of matches the old capabilities of AD, but not completely. There's even a "SAMBA as fake domain controller" mode. Ironically what it needs is a product or service which organizations can pay to take the problem off their hands. But then people get stuck in never paying for anything in the open source world.

xorcist 6mo ago
> Isn't it about time someone developed one? Honest question: Why? If you want a Windows-like environment, run Windows. I get this all the time when people ask about a Linux equivalent for something, and aren't really satistied when it doesn't work or look the same. Linux isn't a clone of Windows. Linux comes from an older heritage, and has a unique culture. You are in for a hard time if you want to use Linux like you would use Windows. That's a suboptimal experience, at best. That said, of course Linux should be easy to manage. But Windows is from a single corporate entity, of course their management tools will be different. It used to be unix admins that laughed about people using Windows as servers. The culture around Linux is one of scriptabiliy where even the user interface, the basic shell, is one where every command is inherently a script. That's why management on Linux looks like Ansible and OpenSSH, not like Remote Desktop and Group Policies. You could write something like Group Policies for Linux of course, but it wouldn't be a complete solution so people would just continue using Ansible, OpenSSH, and the respective package managers.
- ethbr1 6mo ago
  What's the Linux version of AD and group policies? (honestly curious; linux sysadmin at scale not my day job)
  - xorcist 6mo ago
    I don't know. What's the Windows equivalent of dpkg (from 1993) and ssh (from 1995)? Still nothing, three decades later. Not because Microsoft engineers couldn't do it, of course, but becasue they didn't want to. It doesn't fit the Windows model. They did recently adopt SSH, but that was because they want to use Windows in cloud-like environments, where expectations are set by Linux-style tools. By the time Windows got to the point where it even could be centrally managed in any reasonable fashion, Linux environments was routinely run an order of magnitude larger still. There is a reason why the whole cloud runs Linux. Anything else is a rounding error. That's because Linux is inherently so much less work to manage at scale. If something like Group Policies would somehow be accepted by the Linux community, that could only be a step backwards. A well run Ansible or Puppet or similar environment works on a completely different scale.

Levitating 6mo ago

> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. I am sure that's something the Gnome Foundation could figure out if they had a grant to do so.

tremon 6mo ago
Putting it in the hands on the GNOME foundation will just result in a lot of new soon-to-be-mandatory APIs and numerous configuration variables with only one allowed value.

kgwxd 6mo ago

Even the old companies have moved away from that nonsense. Huge waste of resources.

Bayart 6mo ago

The primitives are there and they're solid, beyond that it's "just" architecture and integration work. Hopefully the French government will be rational with this (I believe the time and financial constraints will for it to be, we're broke and we lack time) and they won't fall into the trap of trying to internalize every bit of the platform. A good example of that would be what happened with Docker. Off the top of my head cgroups, namespaces, seccomp, overlays and capabilities had been around for a while before it got rolled up in a nice utility in 2013 and opensourced in 2015. Hence the containerization movement. Solaris zones and FreeBSD jails were nice but they always were let's say a bit too bearded.

ninjagoo 6mo ago

> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. Enterprise environments use a number of tools like Powerbroker, UCS, Centrify/Delinea etc to bind linux machines to active directory and manage identity and access through active directory. This is for mixed environments with both Windows and Linux machines. For pure linux environments, there are a number of tools like FreeIPA/IdM, Samba AD/DC (for A/D like management), and OpenText's eDirectory for the current version of Novell's eDirectory counterpart to A/D. They all provide centralized user/host/policy/access management. Since Entra+Intune are the recent MS products, cloud-based equivalents are Jumpcloud+Fleet, Okta PAM, FreeIPA/IdM.

fenykep 6mo ago
I don't know any of these tools but I believe your comment answers most questions in this thread. I really hope some of these answers are ergonomic enough for windows sysadmins to accomodate this transition.

Zigurd 6mo ago

Personal computers were used in office environments long before the technologies to make them administer-able as if they were a mainframe. Before blindly jumping in and reproducing those technologies, better to ask why they emerged in the first place. Most workplaces don't have strict bans on personal mobile devices, and some of the ones that do, don't have the kind of physical perimeter defense that can detect people getting lazy about whether or not they carry their personal mobile devices into the workplace. That makes perimeter defense into security theater anyway. We need a rethink about what we are guarding against and how we're doing it.

ethbr1 6mo ago
> Most workplaces don't have strict bans on personal mobile devices If you're talking about select work apps on your mobile device, sure, but that's limited attack surface. If you're talking about employers who let unmanaged mobile devices hop on their internal network... I've never seen that. Maybe at a hypothetically perfect zero-trust shop?
- Zigurd 6mo ago
  I've seen a lot of un-seriousness about security. One that's easy to spot is old unpatched IP phones that aren't segregated on the network. I've given demos at companies that are serious, where a device I accidentally left behind caused an urgent search of every room I had been in. Security didn't have to be told which rooms those were.
  - ethbr1 6mo ago
    You likely know better than I, but I've always had a weird intuition that enterprise IT security is bifurcated into "Leaders who understand compliance+details" and "Leaders who confuse compliance for details" with very different results. And I get it's extra work, but I've seen some weird "But if you'd just built this a bit differently, you would have gotten all these free security bonuses to your posture" gaps. Imho, a huge part of the problem is invisibility. I'm firmly of the belief the US government should be running scans on entities in regulated industries (defense, healthcare, utility, telecom) with regulated redress of any findings. Trusting private industry isn't working.

oneplane 6mo ago

It does, it's called FreeIPA (or RedHat IdM). The only GPO parts it doesn't do are those that are not related to policy in the IAM sense (i.e. configuring some application related thing). There's other systems for that, just like on Windows you practically never run GPO without anything else. On top of that, you can pay RedHat or Canonical to host it all for you on any cloud or non-cloud.

Lihh27 6mo ago

that's the catch with gp/ad. for a lot of orgs the hard part is intune/entra now. swapping the desktop is easy. replacing identity and device management is the real migration

ethbr1 6mo ago
Doesn't the Azure team own Intune/Entra now? Read: less inclined to give a fuck about artificially protecting Windows desktop. I've no idea what current internal Microsoft org divisions are.

XorNot 6mo ago

Honestly as wide spread as it is, managing group policy sanely is still a challenge I've found - it's very resistant to configuration as code. Linux has a lot of the pieces but is principally lacking a solid distribution system - in particular a big missing component is the network-based SELinux policy distribution system which you can see some hooks in for the concept of a "policy server" which never eventuated. SELinux would be a lot more viable if it had a solid way to federate and distribute policy and has some nice features in that regard (i.e. the notion that networked systems can exchange policy tags to preserve tagging across network connections).

ethbr1 6mo ago
> managing group policy sanely is still a challenge I've found - it's very resistant to configuration as code Imho, this was historically (and continues to be) Microsoft's Achilles heel. Large parts of the company reflexively wrote features / tooling as manual-first, code-second (or never). In hindsight, what was missing was a Gates-level memo circa 2000 similar to Amazon's API one: all teams are required to build their configurators to be programmatically exposed. Unfortunately, I don't think Ballmer was enough of a technologist (and was likely too distracted) to intuit that path not taken.

otikik 6mo ago

Must be the only nice and cohesive parts left. Perhaps they have not figured out how to put ads on AI on it because it doesn't have many users.

Spooky23 6mo ago

This is actually a good time to disrupt that, as Microsoft’s attention is not on windows and Active Directory is slowly moving to Entra, although big enterprises are mostly hybrid. Some places are using Okta for many of those functions too. Trump’s instinctive parasitic slumlord behavior may be enough for the sleepy Europeans to get their shit together.

kakacik 6mo ago

No non-US government should host anything on azure, or any other US-owned cloud. Thats security and sovereignity 101, or more like 100. Reality with hostile US being as it is. What you list are no showstoppers, and since its a well known topic I cant imagine why some EU-funded effort in say 2 billions over next 3-5 years shouldnt reaolve it once and for all, for entire world. Well invested money.

guenthert 6mo ago

> Linux still doesn't have anywhere near as nice and cohesive as Group Policy, Active Directory etc. I take your word for it (I know of Kerberos and LDAP and Netscape and Sun trying to make such palatable, but clearly haven't followed that in the last quarter-century). That assumes however the server to be currently MS Windows. For government agencies, I'd rather expect some Mainframe to be (and remain) in place. Surely IBM (or here rather Groupe Bull) has user authentication/authorization figured out (more than half a century ago, methinks).

franktankbank 6mo ago

I'm sorry, but how hard is that? Seriously.

radiator 6mo ago

But isn't that the whole point, that foreign governments perhaps do not want Microsoft to host all their data, users, groups, software on Azure, because then the CIA also might obtain access?