We have a VM that is only a domain controller. The idea was to use Active Directory to control usernames, their privileges, and control when our other Windows VM's reboot after patch Tuesday. We have 24 VM's. Of those 13 are Windows OS's. Of those, 8 are in production and shouldn't have anyone but maybe myself or my boss logging into it on rare occasions.
So that leaves 4 VM's plus the Domain Controller, that maybe an additional 5-6 people might need to log into. I feel like having and paying for a dedicated AD VM or going through the trouble of joining our Linux boxes to AD is a cost/time suck.
While not as automated, I could simply log into each box and download/install updates on each Windows VM. I'm already on call the weekend after Patch Tuesday to ensure each VM comes back and our platform is working. Often a VM doesn't rejoin the domain controller because it was rebooted before it so I have to reboot it again.
So my questions are this.
1.) What benefit besides being able to use the same username and password on all VM's, does Active Directory add to a Linux VM?
2.) Would it not be more secure to have a login for each user, on each box they need access to, than a single username/password that if compromised, would give someone access to several machines?
3.) If not Active Directory policy, what is the best as in automated and just works, method of ensuring my Windows VM's are up to date with patches?
I feel like having and paying for a dedicated AD VM or going through the trouble of joining our Linux boxes to AD is a cost/time suck
- If the DC is properly licensed then you've already paid for it, so that cat is out of the bag.