Is Active Directory Really Needed Today?
-
AD has not been needed for quite some time. And there is exactly this thread going on on another SW thread right this second. AD has a place and a lot of value, but everything that AD does is available in some other form, in many cases the same tools just with different names (anything GP can do, you can get without the GP name, as it is branding only that associates it with AD.)
-
Even Microsoft knows this and is moving people away, slowly, to Azure AD which is not AD at all. And that's what JumpCloud is doing as well.
-
Salt and Ansible and such can do user management in new and interesting ways. Are they a wonderful solution for that, not really. But can they? Yes. They certainly make really small shops able to do things that they could never do before.
-
If I remember correctly Microsoft is moving group policy functionality into an MDM solution. They are encouraging this move with the new Creator Update.
-
Another thing to look out for, is that there's always the potential vendor to come in and say something like "Well, we only support our product on Windows AD...". In that case, you either have to find a different vendor for that product or service, or go back to Windows AD. (if AD is needed in the first place)
-
Also, it's not always about user management. There's a ton other reasons for AD in an environment... even if you have zero file servers.
-
@coliver said in Is Active Directory Really Needed Today?:
If I remember correctly Microsoft is moving group policy functionality into an MDM solution. They are encouraging this move with the new Creator Update.
They did quite some time ago. And GP was always exposed to scripts, so anything with an agent on Windows has had access to GP functionality since the beginning.
-
@Tim_G said in Is Active Directory Really Needed Today?:
Another thing to look out for, is that there's always the potential vendor to come in and say something like "Well, we only support our product on Windows AD...". In that case, you either have to find a different vendor for that product or service, or go back to Windows AD. (if AD is needed in the first place)
Simple answer there...
-
@Tim_G said in Is Active Directory Really Needed Today?:
Also, it's not always about user management. There's a ton other reasons for AD in an environment... even if you have zero file servers.
What else is there? AD really is just a user management solution. You CAN use it for ad hoc database functionality, but that's pretty useless if you aren't using it for user management.
-
@scottalanmiller said in Is Active Directory Really Needed Today?:
@Tim_G said in Is Active Directory Really Needed Today?:
Another thing to look out for, is that there's always the potential vendor to come in and say something like "Well, we only support our product on Windows AD...". In that case, you either have to find a different vendor for that product or service, or go back to Windows AD. (if AD is needed in the first place)
Simple answer there...
Yup, best option is to find another vendor... but everyone may not feel the same.
-
@Tim_G said in Is Active Directory Really Needed Today?:
@scottalanmiller said in Is Active Directory Really Needed Today?:
@Tim_G said in Is Active Directory Really Needed Today?:
Another thing to look out for, is that there's always the potential vendor to come in and say something like "Well, we only support our product on Windows AD...". In that case, you either have to find a different vendor for that product or service, or go back to Windows AD. (if AD is needed in the first place)
Simple answer there...
Yup, best option is to find another vendor... but everyone may not feel the same.
Not everyone likes doing things well, either
-
@scottalanmiller said in Is Active Directory Really Needed Today?:
@Tim_G said in Is Active Directory Really Needed Today?:
Also, it's not always about user management. There's a ton other reasons for AD in an environment... even if you have zero file servers.
What else is there? AD really is just a user management solution. You CAN use it for ad hoc database functionality, but that's pretty useless if you aren't using it for user management.
Resource management, such centralized management of printers, servers, client computers, including group policy for devices (which can go a long way), certificates... there's a long list.
I know it can all be done with other software... and it depends on how big the company is, how many users/devices, skillset of current admins, budget, time allowed for learning, etc...
The user part of it is just one small aspect of it.
You could manage all that other stuff with AD, and control all users and passwords with a NAS device... or a CentOS file server.
-
Wouldn't AzureAD or (I feel terrible for not remembering that other provider's name) still be vulnerable to things like account lockouts and brute forcing?
I am looking at this from the stand point of the original thread this one forked from... (https://www.mangolassi.it/topic/13601/active-directory-malware-defense)
-
@dafyre said in Is Active Directory Really Needed Today?:
Wouldn't AzureAD or (I feel terrible for not remembering that other provider's name) still be vulnerable to things like account lockouts and brute forcing?
Yes, in some cases, central authentication is going to carry on a central threat.
-
@dafyre I wouldn't think so. The entire platform is hosted, and each account are not centrally connected like with classic AD.
-
In the original thread, part of the issue was tying core services to shared accounts.
-
@scottalanmiller said in Is Active Directory Really Needed Today?:
In the original thread, part of the issue was tying core services to shared accounts.
I've always been a firm believer (and have been saved by this a time or two) in each service having its own account.
-
@dafyre said in Is Active Directory Really Needed Today?:
@scottalanmiller said in Is Active Directory Really Needed Today?:
In the original thread, part of the issue was tying core services to shared accounts.
I've always been a firm believer (and have been saved by this a time or two) in each service having its own account.
@dafyre said in Is Active Directory Really Needed Today?:
@scottalanmiller said in Is Active Directory Really Needed Today?:
In the original thread, part of the issue was tying core services to shared accounts.
I've always been a firm believer (and have been saved by this a time or two) in each service having its own account.
It carries a lot of value.
-
So, I think the answer to the question is no, it's not needed. There are a lot of alternative products that will perform a similar function. Perhaps the question should be is AD desirable? Of all the alternatives, AD is arguably the best, the most comprehensive, the most mature, the most stable, but it's probably also the most expensive. So perhaps the question should be is AD worth the cost?
-
@Carnival-Boy said in Is Active Directory Really Needed Today?:
Of all the alternatives, AD is arguably the best, the most comprehensive, the most mature, the most stable, but it's probably also the most expensive.
I'd argue some of these points.
- Best. Not even close in my opinion. That doesn't meant it is bad, just that the model is poor and very limiting. It requires LAN extension in most use cases making it rather sad for what it is. It was great - in another era. It's far from the best mainstream option today. Better than NT4 SAM, but that's about it.
- Most Mature. If you mean oldest, okay.
Kidding aside, yes, it is extremely mature. - Most stable. It's stable, but not sure I agree with "most". I've never heard of anyone having competitors just corrupt, but I've heard of several people losing their AD just this week because even restoring a simple backup of it will lead to your AD dying.
- Most expensive. I actually don't agree there, AD is actually pretty affordable Not compared to Salt, but compared to JumpCloud or even AzureAD (unless you already have Office 365 otherwise.)
