22

For a (very) small company would using Windows server with AD be overkill - why not just use it as a file/ print server, administration server from which to access all machines on the network via remote desktop for administration purposes? Also for saving disk images of all PCs on the network...

This small company has three main office employees, some clerical staff (a dozen) with maybe a dozen computers strewn around. The three main staff run the business and could use a good shared filing system with authorizations (read-only, etc.). There is a second layer of maybe four staff who use a couple of web services and do some research on the web. The rest are using only specific websites (access restricted with K9).

Some applications run off a dedicated Windows XP machine, which runs an application (one client at time) to control security (doors, etc.)

They work fairly well now with a simple workgroup, and one Windows 7 workstation serving as a baby file server.

1
  • 9
    I, and a number of other people here, actually use it at home. As in, I have an AD forest with 1 user and 6 computers. Feb 19, 2014 at 20:39

6 Answers 6

38

I don't see having Active Directory (AD) as adding complexity. Rather, I see it as making administration easier. I see the functionality that it enables in the client OS as being a major tool to allow for smooth future growth and replacement of computers.

From a cost perspective, there are very low cost versions of Windows Server (2012 R2 Essentials currently fills this niche) that bring a lot of nice tools to bear on small networks for not a lot of money. For small environments you don't have to mess around w/ CALs, too.

Speaking about this in a "bigger picture" view, where Active Directory is just part of a feature set that a dedicated server computer and server OS can provide, I see a lot of advantages.

  • Active Directory gets you single-sign-on, Group Policy, and the ability to create authorization schemes using Security Groups that will easily transcend employee turnover. In small businesses, in particular, a good permission strategy revolving around AD groups assigned to employee roles has enabled me to easily handle "Bob now does John's job" type situations (which seem to crop up more frequently in small businesses than large, in my experience) very easily.

  • Having WSUS is great. Oh, boy, I like having WSUS.

  • Did I mention Group Policy? Folder Redirection? Roaming user profiles? Oh, how I love stateless (or nearly so) client computers and the ease with which I can factory-reload a failed PC or replace a computer. Having users able to logon to any client PC and have basic functionality (client-side apps non-withstanding) turns "drop everything" emergencies into mundane service calls.

  • I like having a "real" server to handle infrastructure protocols like DHCP and DNS (versus some wonky toy "servers" built into a consumer-grade Wi-Fi router, etc).

  • Security auditing is much, much easier in an environment where centralized authentication and authorization are present.

  • I'm a bit partial to the PC backup functionality in Windows Server 2012 Essentials for very small Customers where otherwise getting them to spring for a couple spare PCs to be used in a "hot desk" capacity in the event of PC failure is too much for them to spend. It's kinda hokey, and I would prefer not to backup anything on client computers at all, but the time savings in small shops where client computer standardization is nonexistent is hard to argue.

  • The business might get value out of other bundled applications that the server could host like, say, SharePoint.

  • Offering users remote access through Routing and Remote Acess Services or Remote Desktop Gateway.

I like having an on-premise Windows Server with Active Directory in environments where there are Windows client computers. It makes my life easier and ends up costing my Customer less money, in the long run, than trying to "herd cats" by managing a fleet of non-domain-joined PCs.

3
  • 1
    Dang! To fast...
    – user62491
    Feb 19, 2014 at 17:29
  • 3
    @kce - I've been told that here before. >smile< Feb 19, 2014 at 17:35
  • 1
    In addition to the above, it's good to have your IT infrastructure on a solid footing for if/when your company grows bigger. Oct 11, 2016 at 22:41
8

It makes sense if you have a business case for it. Think about what Active Directory gets you:

  • Centralized user and machine account management
  • Centralized access control using Active Directory security groups
  • Centralized configuration management with Group Policy Objects
  • Centralized DNS for your office

Can you get by without this? Yes and many small offices (and even some larger ones) do just fine without Active Directory but if you start finding that more and more of your time is taken up doing things like reseting someone's local account on all dozen computers you should think seriously about Active Directory. Microsoft makes Small Business versions of their Windows Server operating systems that bring Active Directory and many other services to that environment at a reasonable cost.

4
  • Unfortunately the Small Business Server offering was discontinued a few years ago. SBS 2011 is still available on the market from retail sources presumably selling off old stock, but it is going to become increasingly difficult to come by a license for this platform, especially via Volume Licensing channels. Windows Server Essentials and greater cloud integration (Office 365) for mail and other services were touted as its replacements. Feb 19, 2014 at 21:16
  • 2
    @tigermatt - The discontinuation of the Windows Small Business Server product doesn't change the fact that having an on-premise Windows Server machine can be of a lot of utility. I'm frustrated that an on-premise small business Exchange option was discontinued but "renting" everything on a monthly basis is all the rage in our industry again. Give it a few years and the pendulum will swing the other way. Feb 19, 2014 at 21:36
  • @EvanAnderson The pendulum swings again :-) I have been in the business for nearly 30 years now. Seems we go back and forth every 5-10 years. Technology changes (like terminal/mainframe - (thin)client/server - apps/cloud) but the basic concepts remain the same. Sometimes even the technology doesn't change, just the usage: E.g. Usenet with pay-servers are all the rage for the heavy downloaders, but usenet has been around since the early 80's.
    – Tonny
    Feb 19, 2014 at 23:21
  • @EvanAnderson Indeed, I don't disagree at all, and was merely intending to point out the unfortunate demise of SBS. I completely agree with the premise of an on-site box, and in some respects, find it much easier to contend with than going out to rented services. The cloud has its place and some services work well there, but current attitudes of moving to cloud with no more justification than "it's what all the cool kids are doing" doesn't seem prudent to me. Feb 20, 2014 at 23:21
3

If the Windows Server license is too much, but you have the hardware lying around, you could also look at using Samba 4 on something like CentOS. The setup is more linuxy, but the day to day is Windows RSAT so you'd do it from your Windows desktop, same as with Windows Server, just no license costs. Samba is also a fileserver that doesn't have the concurrent connection limit client Windows systems have.

Are you familiar with either Windows Server or Linux + Samba? One possibility is if you're not familiar with Linux is you can take this as a potential professional growth / learning experience beyond MS only.

Starting from scratch with either isn't actually hard.

1

It really depends. Do you want centralized management of users, IT assets (printers, scanners, etc.), easy updates, the ability to enforce group policies, etc? Is the information sensitive at all?

The landscape has changed a lot. The entry price point has dropped, but more options are available as in offloading them to cloud. I find having a local AD instance with a hosted Office365 Pro Plus a really good environment to be in.

Perhaps you can even rent out some of your office work in Azure (assuming you have redundant and good internet with an idea of how much data flows through your pipes). Their SLA will probably be higher than your own internal unless you pay for a staffer or contractor.

0

I think jmp242's suggestion is all-around the best way to at-least obtain an overview of the options you have. Instead of determining whether Windows' Active Directory and/or Domain Controller services is the solution set that will meet your needs, I suggest looking into what the actual services them-selves can offer you.

I, myself am more Linux-savvy, therefore- I'm currently researching into using Samba to setup Directory Services (currently, I'm leaning towards OpenLDAP).

The size of the company I work for is currently only 8 personnel, which I think would fit into the category of a "small group". Setting up the centralized management system, is a sure-fire way to ensure that no matter how large the company grows, you'll always have an easy way to manage authentication, privileges, physical resources, and reporting.

0

A Windows domain is the easiest way to manage Windows computers. To save money on hardware and CALs and in order to gain the ability to change our server resources, we house all of our customer's domains on AWS Windows server, then we use TrueStack Direct Connect to connect and manage the computers. This way we don't have to maintain servers in a datacenter, site-to-site VPNs or on-premise servers.

I wouldn't purchase a new domain controller for on-prem anymore. Too expensive and too difficult to maintain, but i still like AD and group policies. it's much easier to house it at AWS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .