0

We have a VM that is only a domain controller. The idea was to use Active Directory to control usernames, their privileges, and control when our other Windows VM's reboot after patch Tuesday. We have 24 VM's. Of those 13 are Windows OS's. Of those, 8 are in production and shouldn't have anyone but maybe myself or my boss logging into it on rare occasions.

So that leaves 4 VM's plus the Domain Controller, that maybe an additional 5-6 people might need to log into. I feel like having and paying for a dedicated AD VM or going through the trouble of joining our Linux boxes to AD is a cost/time suck.

While not as automated, I could simply log into each box and download/install updates on each Windows VM. I'm already on call the weekend after Patch Tuesday to ensure each VM comes back and our platform is working. Often a VM doesn't rejoin the domain controller because it was rebooted before it so I have to reboot it again.

So my questions are this.

1.) What benefit besides being able to use the same username and password on all VM's, does Active Directory add to a Linux VM?

2.) Would it not be more secure to have a login for each user, on each box they need access to, than a single username/password that if compromised, would give someone access to several machines?

3.) If not Active Directory policy, what is the best as in automated and just works, method of ensuring my Windows VM's are up to date with patches?

14
  • Just a comment - Samba4 has full domain controller support now. You could use it as your DC if you wanted an open source/low cost option.
    – Jim G.
    Nov 24, 2015 at 18:11
  • I feel like having and paying for a dedicated AD VM or going through the trouble of joining our Linux boxes to AD is a cost/time suck - If the DC is properly licensed then you've already paid for it, so that cat is out of the bag.
    – joeqwerty
    Nov 24, 2015 at 18:26
  • @Jim G Good point. That could help us save some cost by going with a Linux VM and perhaps less headache when joining are other Linux VM's to it. But I'm still undecided if a Domain is really needed for us. Nov 24, 2015 at 18:35
  • @joeqwerty Unless it's a rented VM, paid monthly. Often a VM doesn't rejoin the domain controller - What does this mean? A server doesn't "join" a domain controller. Windows also caches login credentials so you can login without a DC available for many days, and when a DC is available again, it will talk to it because group policy refreshes happen regularly. Nov 24, 2015 at 18:35
  • @joeqwerty We are paying for a Windows VM and enabling the AD roles on the local server. So we haven't invested anything but time into it. Nov 24, 2015 at 18:36

1 Answer 1

1

Every centralized authentication, authorization or management system has its own advantages and disadvantages. And it depends exclusively on each network environment and it's own needs. There is no one size fits all kind of solution out there.

In most of the cases, it requires extra expertiese and may be costs are also added. For example, some of the benefits of having windows AD are: Group Policy, Roaming Profiles, Windows Update Service (WSUS), Password policy, Office 365,Exchange Integration for Email, Managing File sharing and many more.

If you are not in need of many of these services then it can be more of an headache than a solution.

I have the following observations from your question and the discussions above (please correct me if I'm wrong):

  1. You have a mixed environment with almost half of it being Non-Windows OS.
  2. You don't need a centralized authentication and authorization management system.
  3. With your current setup you are not satisfied and it's causing unwanted problems.
  4. You want to reduce cost.
  5. You have a very small number of users.

Considering all that facts, I think one can conclude that a Windows AD DC is not an absolute necessity for your environment. But please note ,this is only my ovservation and not a descision.

2
  • You are correct with 1, 3, and 4. The only two things we use the DC for is user accounts and the AD policy to tell the rest of the Windows farm to install and reboot updates. We don't use any of the other features you mentioned. I just wanted to have this discussion to see if I was overlooking some other benefit. I feel like our ~$876 a year we spend on our existing DC would be better spent elsewhere. Nov 24, 2015 at 21:54
  • If that's just licensing, you're overpaying. As a college, I get non-profit/Education pricing, but I pay less than 1/10th that for each of our Windows servers, and that's just the servers where I want software assurance. If I don't want SA, I can spent less than 1/4th of that once for the life of that OS. Of course, there's client access as well, but that's included with our non-server Windows/Office licensing agreement. You may not get my pricing tier, but no one pays list price for this stuff.
    – Joel Coel
    Nov 24, 2015 at 22:34

Not the answer you're looking for? Browse other questions tagged .