How Do You Replace Active Directory?
-
@scottalanmiller said in How Do You Replace Active Directory?:
So let's start asking the questions that really matter...
Why do you @Dashrender care about AD? What value do you see in what it does?
I don't care about AD - I care about centralized authentication of all devices. I'd likely be just as happy with JumpCloud/AAD/SAMBA/etc.
Why do you care about tightly managing a device that is designed to be self sufficient? And why would you want to introduce AD which often disables critical security features (like updates.)
AD doesn't disable update any more than AD provides GPO.
Why do you care about the tight control of non-local user accounts? And how are you managing local user accounts today?
Local user accounts are disabled.
I use GPOs a lot today. Learning other options like Salt or Ansible, etc, i.e. state machines would allow me to potentially move away from GPOs.
-
@Dashrender said in How Do You Replace Active Directory?:
I don't care about AD - I care about centralized authentication of all devices.
But... why? Why is this something that you care about? It's not an end goal. It's a means. But what is the ends?
-
@Dashrender said in How Do You Replace Active Directory?:
Local user accounts are disabled.
I use GPOs a lot today. Learning other options like Salt or Ansible, etc, i.e. state machines would allow me to potentially move away from GPOs.Or you can use them to deploy GPOs.
-
I dunno. Sorry I haven't read all this, my back is giving me hell ATM.
So how do you add a new shared printer to a group of PCs? You'd never visit each PC individually and add it.
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
I can understand how you could use an MDM to manage Windows devices, but why not just use native AD?
I cannot see any corp running 1000's of Windows devices without AD. However I could see a small business not using AD.
-
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
I don't care about AD - I care about centralized authentication of all devices.
But... why? Why is this something that you care about? It's not an end goal. It's a means. But what is the ends?
Since he has users that use several workstations, I would venture that the end goal is having the same login credentials on every workstation the user uses.
-
@siringo said in How Do You Replace Active Directory?:
I cannot see any corp running 1000's of Windows devices without AD. However I could see a small business not using AD.
Scott seems to only deal in little Windows environments, hence he always questions the practical use cases of AD and central user administration.
-
@DustinB3403 said in How Do You Replace Active Directory?:
@siringo said in How Do You Replace Active Directory?:
I cannot see any corp running 1000's of Windows devices without AD. However I could see a small business not using AD.
Scott seems to only deal in little Windows environments, hence he always questions the practical use cases of AD and central user administration.
Agreed.
From this discussion - centralized user admin is not something Scott seems to ever need, I guess a person at his customers never want to utilize more than one computer.Even @jt1001001 appears to want centralized user administration because he's stated he adds the machines to AAD.
@jt1001001 said in How Do You Replace Active Directory?:
@scottalanmiller as I found in our case, AD here was adding absolutes 0% while actually creating more of an administrative headache. 99% of our applications here are "in the cloud" (unlike my old company) and all the DC was doing was print, some file shares, and 1 or 2 group policies (that weren't even working right!). So moving to Teams (see post in other discussion) will alleviate the file share; may build a linux file server for 1 or 2 use cases where Teams/Sharepoint won't work. Group policies are unnecessary and worst case we can upgrade our licenses and go Azure AD/Intune if we need to. Printing, well its printing and it sucks but we'll figure it out. Best is the CTO and President are on board without so much as a blink.
-
@siringo said in How Do You Replace Active Directory?:
So how do you add a new shared printer to a group of PCs? You'd never visit each PC individually and add it.
So many ways. And all ways that we need in Mac and Linux worlds since GPO doesn't work there. So this is a solution in search of a problem.
Add via script, Salt, Ansible, RMM, you name it. It's not a challenge in the Windows world.
-
@siringo said in How Do You Replace Active Directory?:
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
Azure AD is not AD. It's a directory service, but in no way is it AD. It's no more AD than JumpCloud or Okta is AD. They are all directory services, but that's where the similarity ends.
Intune is MDM, that is true. And MDM is a vastly better way to do system management than GPO. GPO is horrible. One of the biggest problems with GPO is the lack of an agent, which is really what is needed. So something that is MDM or MDM-like in that way is exactly what you want as an alternative to GPO.
-
@siringo said in How Do You Replace Active Directory?:
I can understand how you could use an MDM to manage Windows devices, but why not just use native AD?
Lots of reasons. And no one is saying that AD is NEVER right, not NOT OFTEN. It's not the same thing. AD has a place in extremely legacy networks where other factors have kept modernization from happening.
So why not AD?
- Fragility. AD breaks easily and presents risk. All directory services do to some degree, AD does more than most.
- Cost. AD requires more licensing and management than other solutions. Often doing the same task takes more time and effort with AD and there is large amounts of cleanup and troubleshooting time that otherwise would not exist. Sure we can use an open source AD, but the effort and complexity is still there even if the licensing is not.
- Risk. AD creates a sprawling attack surface that is easy prey for attackers. If extremely well designed, managed, and maintained AD's risks can be pretty minimal as the protocols themselves are rock solid, but the fundamental assumptions and value proposition of AD are based on decades old pre-Internet "LAN-based" network design which is the prime target for attackers because it is both wildly insecure by design and because it flags an organization as being in a legacy mode which means that their chances of a successful attack because of a lack of security posture is hundreds of times better. The real value to AD only exists when several other legacy and super high risk practices are combined with it, like mapped drives and LAN trust.
- Lack of Flexibility. AD is like land line telephones for a business - it works technically, but doesn't provide the basic functionality that is just expected today. If you use AD, you "feel" the lack of modern usability. Today we expect logins to be fast, mobile, universal, secure, etc. We expect that we can work from anywhere, anytime, without having to do something unthinkably risky like adding a VPN which isn't just risky, but slow, fragile, and cumbersome. AD is a LAN-only technology, it has no accommodations for working over a WAN even for office sites and absolutely no accommodations for mobile workers. Terrible ideas like RDS, VPNs, and VDI are based around accepting lots of inefficiency and risk to work around legacy infrastructure like AD (and often decades outdated apps too, it's rarely only AD.) The way that people expect to be able to work in a modern world, the way that businesses expect to be able to compete just isn't accommodated by AD. AD was the last hurrah of a short lived LAN-centric network authentication model whose place in the IT universe arose in the early 1990s and was approaching antique status towards the end of the decade and was all petering out in the early 2000s. There is a reason that all other, more flexible, directories like this died off and why no other platform other than Windows takes any interest in these solutions - it's not for lack of access to them, it's a lack of need.
- It encourages, but certainly doesn't require, use of cumbersome management techniques like remote GUI logins and GPOs. You can use AD and not get stuck into that mindset, but find me a shop that uses AD and avoids those entrapments.
- Platform lockin. Sure, you can join other things to AD but support and reliability isn't the best and it doesn't provide a universal tool set when doing so. When you deploy AD you essentially either commit to your directory service being a partial solution and still needing another solution anyway (which is crazy common), or to using AD only for the most basic features, or to being trapped on Windows. Which might be a good choice today, but "trapped" on any platform carries technical debt and risk that is rarely a good thing. It can be, but very rarely.
-
@siringo said in How Do You Replace Active Directory?:
I cannot see any corp running 1000's of Windows devices without AD.
And yet those with hundreds of thousands of devices do so without any issue at all. Some things to keep in mind...
- Essentially anyone running 1000s or more of Windows devices will have tons of non-Windows devices too, making AD a serious problem to deal with as its value is super low as it can't be "the" solution, just a partial solution.
- Windows isn't crippled like people think and doesn't depend on AD or other Microsoft add on products for management functionality. All those modern tools that Mac and Linux users tend to use (MDM, state machines, scripts) work on Windows too and let you use a single toolset across all devices.
- The bigger the company, the more likely that AD can't address its needs. We are a tiny company of 55 people and yes, we run Linux primarily and Mac secondarily and Windows is purely for BYOD users (always optional, we provide Linux devices) but even if we were 100% Windows, at our size, AD doesn't work in any way whatsoever. It would provide no benefit even if it worked, but doesn't work. Big companies have (generally) lots of locations to deal with (AD can do this, but it starts to get more cumbersome and costly), mobile workers (sales people for example), work from home workers, and big concerns about the security exposure of AD. The bigger you are, the harder it is to make the limitations of AD fit.
- MSPs are effectively complex companies with thousands of devices and there is a reason that we all considered using AD (open source AD can do this) across customers and no one does - because it just isn't effective. You can imagine how nice that idea sounds... imagine a single authentication source and policy management tool that spans customers turning lots of little shops into a giant "enterprise" with all that efficiency so that the IT desk acts more like an internal one. It has a lot of promise, a lot of value. But it is so cumbersome, so risky, and so complex and slow and doesn't add real value the customers. (Plus most MSPs make bank selling AD management so providing something that takes less effort isn't in their financial interests - AD is one of those core things that sounds reasonable but is a way for MSPs to generate loads of extra billable hours.) So that's a good indicator, if MSPs don't see a value to it, their entire industry is based off of assessing IT value, then likely there's a financial problem with it. So MSPs are just like any other enterprise with 1000s of Windows devices and isolated departments. In fact, as an MSP, my customers are WAY more integrated to each other than the departments inside someplace like IBM are. IBMs departments are so isolated from each other that each had its own IT department that never spoke to each other. The MSP customers have shared IT. So MSPs can be way more like the Fortune 500 than you'd think in some ways.
- Even many small shops remove AD when they evaluate it today. Sure they lack the big scale that makes us assume that AD would be necessary, but they rip it out because it creates problems without solving them. Even pretty small businesses today want the flexibility that comes with not having AD. You don't have to be big at all to run into the limitations.
-
None of this makes AD bad or useless. Just don't be surprised that it's not hard to live without it. For many, the real question, is "how could you use this on any scale" rather than "How do we live without it."
If you have a single or dual site manufacturing facility running all Windows, AD might work surprisingly well. If you run a software development firm, it's hard to imagine something more useless.
-
@scottalanmiller said in How Do You Replace Active Directory?:
@siringo said in How Do You Replace Active Directory?:
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
Azure AD is not AD. It's a directory service, but in no way is it AD. It's no more AD than JumpCloud or Okta is AD. They are all directory services, but that's where the similarity ends.
Intune is MDM, that is true. And MDM is a vastly better way to do system management than GPO. GPO is horrible. One of the biggest problems with GPO is the lack of an agent, which is really what is needed. So something that is MDM or MDM-like in that way is exactly what you want as an alternative to GPO.
Why do you dislike the lack of a client? Sure it's LAN-centric, and we should be looking for LANless options these days...
-
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@siringo said in How Do You Replace Active Directory?:
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
Azure AD is not AD. It's a directory service, but in no way is it AD. It's no more AD than JumpCloud or Okta is AD. They are all directory services, but that's where the similarity ends.
Intune is MDM, that is true. And MDM is a vastly better way to do system management than GPO. GPO is horrible. One of the biggest problems with GPO is the lack of an agent, which is really what is needed. So something that is MDM or MDM-like in that way is exactly what you want as an alternative to GPO.
Why do you dislike the lack of a client? Sure it's LAN-centric, and we should be looking for LANless options these days...
Reliability. Hoping that the operating system will successfully pull GPO without an agent is a flaky process. You can make a lot of billable hours getting paid to troubleshoot GPO failures because Windows doesn't have a good way to get the data, process the data, and report on that processing. It's the agents that do all the things that make this type of process reliable.
-
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@siringo said in How Do You Replace Active Directory?:
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
Azure AD is not AD. It's a directory service, but in no way is it AD. It's no more AD than JumpCloud or Okta is AD. They are all directory services, but that's where the similarity ends.
Intune is MDM, that is true. And MDM is a vastly better way to do system management than GPO. GPO is horrible. One of the biggest problems with GPO is the lack of an agent, which is really what is needed. So something that is MDM or MDM-like in that way is exactly what you want as an alternative to GPO.
Why do you dislike the lack of a client? Sure it's LAN-centric, and we should be looking for LANless options these days...
Reliability. Hoping that the operating system will successfully pull GPO without an agent is a flaky process. You can make a lot of billable hours getting paid to troubleshoot GPO failures because Windows doesn't have a good way to get the data, process the data, and report on that processing. It's the agents that do all the things that make this type of process reliable.
I guess I don't follow. Something in Windows Pro is what tells the PC to pull and process the GPO - there are logs for that process in Windows. of course I've had issues before - are you saying you've never had issues with something that has a third party agent before?
-
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@siringo said in How Do You Replace Active Directory?:
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
Azure AD is not AD. It's a directory service, but in no way is it AD. It's no more AD than JumpCloud or Okta is AD. They are all directory services, but that's where the similarity ends.
Intune is MDM, that is true. And MDM is a vastly better way to do system management than GPO. GPO is horrible. One of the biggest problems with GPO is the lack of an agent, which is really what is needed. So something that is MDM or MDM-like in that way is exactly what you want as an alternative to GPO.
Why do you dislike the lack of a client? Sure it's LAN-centric, and we should be looking for LANless options these days...
Reliability. Hoping that the operating system will successfully pull GPO without an agent is a flaky process. You can make a lot of billable hours getting paid to troubleshoot GPO failures because Windows doesn't have a good way to get the data, process the data, and report on that processing. It's the agents that do all the things that make this type of process reliable.
I guess I don't follow. Something in Windows Pro is what tells the PC to pull and process the GPO - there are logs for that process in Windows. of course I've had issues before - are you saying you've never had issues with something that has a third party agent before?
I'm saying that the GPO system is flaky and useless. It's pathetically complex and unreliable. Those that use it tend to either have to keep it very, very basic or do a ton of work to make it work and rarely can you find a shop that's really confident that it is working.
The very idea that you have to go onto the endpoints to look at logs shows how big the problem is. There's no warning, no alerting that something has failed. No central repository. You have to build out some kind of log monitoring solution with an AGENT and deploy it to the end points to bandaid the kind of centralized data into GPO that you'd just expect with any modern solution (or competent solution.)
Everything "has" problems. But how often they have problems, how the agent handles problems, and how you have to deal with problems are what matters. And obviously nothing you'd actually deploy should have the kinds of unreliability or difficulty in monitoring as GPO. If it even comes close, it's not something you'd trust.
You are asking "GPO is bad, so you are saying other solutions are perfect?" Do you see why that is a bad question? Nothing is perfect, why do you ask if other solutions are perfect but don't expect GPO to be?
The way that you ask these questions makes you sound crazy. Don't ask if GPO is perfect. What you should be asking is something like "Oh, so you've found that the good third party agents are reasonably more reliable than the native GPO?" It's logical, it's rational, and it doesn't imply that perfect is a requirement, because obviously it is not.
-
@Dashrender said in How Do You Replace Active Directory?:
of course I've had issues before
And did your central monitoring report that to you? This is where GPO is difficult. The first thing most people without GPO experience expect when they are told about it is that they will be able to log into a central console and see the status of what has been applied and where that application has succeeded (and where it has failed.) They expect that the central AD system will somehow have monitoring and alerting as that is what would make this process valuable.
But there isn't. With Salt, for example, or an RMM or an MDM, we'd never accept this kind of management without a central system that tells us that status of the endpoints. If an agent fails, we get a notification. We might still have to fix it manually (or maybe not, because with alerting comes the opportunity for automation) but at least we are told to fix it rather than either dedicated absurd amounts of manpower to seek out problems that we don't know are out there, or waiting for machines to not behave as desired and then try to track down the failed GPO as a cause.
-
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@siringo said in How Do You Replace Active Directory?:
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
Azure AD is not AD. It's a directory service, but in no way is it AD. It's no more AD than JumpCloud or Okta is AD. They are all directory services, but that's where the similarity ends.
Intune is MDM, that is true. And MDM is a vastly better way to do system management than GPO. GPO is horrible. One of the biggest problems with GPO is the lack of an agent, which is really what is needed. So something that is MDM or MDM-like in that way is exactly what you want as an alternative to GPO.
Why do you dislike the lack of a client? Sure it's LAN-centric, and we should be looking for LANless options these days...
Reliability. Hoping that the operating system will successfully pull GPO without an agent is a flaky process. You can make a lot of billable hours getting paid to troubleshoot GPO failures because Windows doesn't have a good way to get the data, process the data, and report on that processing. It's the agents that do all the things that make this type of process reliable.
I guess I don't follow. Something in Windows Pro is what tells the PC to pull and process the GPO - there are logs for that process in Windows. of course I've had issues before - are you saying you've never had issues with something that has a third party agent before?
I'm saying that the GPO system is flaky and useless. It's pathetically complex and unreliable. Those that use it tend to either have to keep it very, very basic or do a ton of work to make it work and rarely can you find a shop that's really confident that it is working.
The very idea that you have to go onto the endpoints to look at logs shows how big the problem is. There's no warning, no alerting that something has failed. No central repository. You have to build out some kind of log monitoring solution with an AGENT and deploy it to the end points to bandaid the kind of centralized data into GPO that you'd just expect with any modern solution (or competent solution.)
Everything "has" problems. But how often they have problems, how the agent handles problems, and how you have to deal with problems are what matters. And obviously nothing you'd actually deploy should have the kinds of unreliability or difficulty in monitoring as GPO. If it even comes close, it's not something you'd trust.
You are asking "GPO is bad, so you are saying other solutions are perfect?" Do you see why that is a bad question? Nothing is perfect, why do you ask if other solutions are perfect but don't expect GPO to be?
The way that you ask these questions makes you sound crazy. Don't ask if GPO is perfect. What you should be asking is something like "Oh, so you've found that the good third party agents are reasonably more reliable than the native GPO?" It's logical, it's rational, and it doesn't imply that perfect is a requirement, because obviously it is not.
I guess I've just had good luck. I haven't had to poor huge amounts of time into my GPOs not working.
not zero - but no RMM type solution would I expect zero issues with when setting up. -
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
of course I've had issues before
And did your central monitoring report that to you? This is where GPO is difficult. The first thing most people without GPO experience expect when they are told about it is that they will be able to log into a central console and see the status of what has been applied and where that application has succeeded (and where it has failed.) They expect that the central AD system will somehow have monitoring and alerting as that is what would make this process valuable.
But there isn't. With Salt, for example, or an RMM or an MDM, we'd never accept this kind of management without a central system that tells us that status of the endpoints. If an agent fails, we get a notification. We might still have to fix it manually (or maybe not, because with alerting comes the opportunity for automation) but at least we are told to fix it rather than either dedicated absurd amounts of manpower to seek out problems that we don't know are out there, or waiting for machines to not behave as desired and then try to track down the failed GPO as a cause.
yeah, makes sense.
-
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@Dashrender said in How Do You Replace Active Directory?:
@scottalanmiller said in How Do You Replace Active Directory?:
@siringo said in How Do You Replace Active Directory?:
I saw @jt1001001 mention they could upgrade so they can use Intune &/or Azure AD. Azure AD is AD, but Intune is an MDM.
Azure AD is not AD. It's a directory service, but in no way is it AD. It's no more AD than JumpCloud or Okta is AD. They are all directory services, but that's where the similarity ends.
Intune is MDM, that is true. And MDM is a vastly better way to do system management than GPO. GPO is horrible. One of the biggest problems with GPO is the lack of an agent, which is really what is needed. So something that is MDM or MDM-like in that way is exactly what you want as an alternative to GPO.
Why do you dislike the lack of a client? Sure it's LAN-centric, and we should be looking for LANless options these days...
Reliability. Hoping that the operating system will successfully pull GPO without an agent is a flaky process. You can make a lot of billable hours getting paid to troubleshoot GPO failures because Windows doesn't have a good way to get the data, process the data, and report on that processing. It's the agents that do all the things that make this type of process reliable.
I guess I don't follow. Something in Windows Pro is what tells the PC to pull and process the GPO - there are logs for that process in Windows. of course I've had issues before - are you saying you've never had issues with something that has a third party agent before?
I'm saying that the GPO system is flaky and useless. It's pathetically complex and unreliable. Those that use it tend to either have to keep it very, very basic or do a ton of work to make it work and rarely can you find a shop that's really confident that it is working.
The very idea that you have to go onto the endpoints to look at logs shows how big the problem is. There's no warning, no alerting that something has failed. No central repository. You have to build out some kind of log monitoring solution with an AGENT and deploy it to the end points to bandaid the kind of centralized data into GPO that you'd just expect with any modern solution (or competent solution.)
Everything "has" problems. But how often they have problems, how the agent handles problems, and how you have to deal with problems are what matters. And obviously nothing you'd actually deploy should have the kinds of unreliability or difficulty in monitoring as GPO. If it even comes close, it's not something you'd trust.
You are asking "GPO is bad, so you are saying other solutions are perfect?" Do you see why that is a bad question? Nothing is perfect, why do you ask if other solutions are perfect but don't expect GPO to be?
The way that you ask these questions makes you sound crazy. Don't ask if GPO is perfect. What you should be asking is something like "Oh, so you've found that the good third party agents are reasonably more reliable than the native GPO?" It's logical, it's rational, and it doesn't imply that perfect is a requirement, because obviously it is not.
I guess I've just had good luck. I haven't had to poor huge amounts of time into my GPOs not working.
not zero - but no RMM type solution would I expect zero issues with when setting up.No, not zero for sure. GPOs tend to be better when you have a very LAN-centric, very homogenous environment. The more variation you add, especially in terms of latency and connection, the harder it gets. GPOs start to get flaky, especially over the WAN, and you start getting a lot of time spent just trying to get them to process.
