Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there anyone using AD as a general purpose directory (meaning for uses other than domain authentication / authorisation and stuff) ?

share|improve this question

closed as not constructive by Iain Feb 7 '12 at 19:34

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

@lain: Why not constructive? If you need an LDAP hierarchy for reasons other than serving your users, can you build it on AD or do you need a separate LDAP installation? – adamo Mar 3 '12 at 6:50
up vote 3 down vote accepted

I worked for a large (100k+ users) environment where the AD was used to hold a significant amount of general employee information - in addition to the usual e-mail and user\department names, we also had multiple phone numbers, physical office location (down to in building office location), organisational hierarchy (who worked for whom), employee number, photo thumbnail, normal time zone, start date and a bunch of other stuff that I can't recall now.

Admittedly we had a pretty slick in house set of controlled access API's (and some authorization process to go with approving access to them) that allowed us to control delegation of rights to update specific AD properties on a per user\per group basis so it was easy to tie updates to these AD properties safely into HR apps which is where the management of this sort of data was handled.

As a user in a large organisation I found that having this sort of info available was really useful, and being able to get this sort of data via a simple LDAP query within my own apps without having to jump through hoops to gain access to HR databases was also very useful.

share|improve this answer

If you use Exchange this can be helpful by allowing people to look up others in the global address book, particularly for large organizations. If you don't use Exchange, there's probably not a whole lot of benefit to this without some custom programming.

Having said that, as a smaller organization we used to run Exchange, still run AD, and have never put non-login information into it except full name and in a few cases department affiliation.

I should add, the biggest roadblock to this is that keeping the AD updated is a function of IT and in many organizations there's not a good process to get the kinds of information that would populate a general-purpose directory from, e.g., HR to IT -- often security or required permissions are the IT priority for new hires and updates.

share|improve this answer

We use the telephone information, organisational information (fed from our HR system) and a few extensionAttributes for misc. stuff. The organisational information is invaluable from an IT perspective, as you can quickly see who you're dealing with, or contact teams as opposed to individuals. The telephone information can be queried using a simple web front end. Users have also got used to seeing quite a bit of info via Outlook. Oh, the organisational info also gets used to dynamically populate some global groups, based on what department you're in. These groups are then used to provide department-based access. In short, AD is a good place to hold stuff like this.

share|improve this answer

I have seen it used in an environment to monitor when specific computers were being used as a sort of employee monitor system, but this doesn't make near as much sense as using its LDAP along with it.

We use it as a general purpose dir to work with exchange, however, we still use it with user auth for security reasons. If it were only for inner-office staff, this wouldn't be necessary for us.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.