Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014.

Taking into account a basic Windows infrastructure:

  • domain controllers
  • Exchange 2007/2010/2013
  • Sharepoint
  • SQL
  • File Servers / Print Servers
  • AD Integrated DNS
  • AD authenticated 3rd party devices (let's say 802.1X for networking and maybe some content-filtering, etc.)
  • AD/LDAP authenticated "administrative" functions on IT apps/hardware/etc.
  • perhaps some KMS stuff
  • throw in a CA if you'd like
  • home grown apps
  • 3rd party in-house apps

Now, let's rip it all out and decide we are going to the cloud. We've contracted to move Exchange/Sharepoint/File Services to Office 365. SQL will now be hosted as well on something like Azure. We've gotten away from the need for AD-DNS and simply run everything via a simple Windows DNS server. We still need 802.1X and would like SSO if possible to our various cloud apps. Home grown and 3rd party in-house apps would likely stay, but have the ability to use internal user databases instead of AD authentication

The question is...do we really need Active Directory at all?

Or more to the point, AD on-premise or even hosted via Azure or similar (ADFS) or running ADDS on a hosted VM through Azure or similar. Could/Should we look to something else like a 3rd party SSO option such as http://www.onelogin.com/partners/app-partners/office-365/ or similar that can provide SSO functionality even if it is as simple as LastPass or similar for each user?

What kind of legitimate needs does AD fulfill if everything else in the cloud?

Could a MS-centric infrastructure get away with not having AD at all if they move everything that previously relied on AD to SaaS offerings that didn't rely on AD authentication?

share|improve this question

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

4  
Your users' workstations aren't going to "the cloud" ... and if they are, I would very much like to know how you do it! –  Michael Hampton Jan 25 at 15:59
    
Doesn't Amazon have a hosted VDI product? (Sounds like lunacy to me, but then I'll just get into a CAPEX versus OPEX battle w/ a bean counter...) –  Evan Anderson Jan 25 at 16:22
1  
Amazon has a hosted VDI in beta. There are other companies that do it, but a lot of them don't allow you to install software. If you google "run Windows on ipad" you'll probably find them all, as that seems to be the usual use case. (Typical example: nytimes.com/2012/02/23/technology/personaltech/…) –  Katherine Villyard Jan 25 at 16:32

7 Answers 7

up vote 63 down vote accepted
+50

I've managed large numbers of workstations without AD. I had power tools (Altiris Deployment Solution), but it still hurt in certain situations:

  1. Security auditor comes in and says that our default workstation password policy isn't good enough. In order to change password complexity and expiration, etc., on 5,000 machines, we had to write a (nontrivial) script and schedule that to run on all machines. (Good luck catching the laptops, by the way!)
  2. Mapping department printers. Sure, we could use the IP number. That means that if Department A and Department B get into a printer war, the remedy involves staking out the printer and then following the offender back to their workstation to remove the printer from their workstation. (I suppose you could buy print management software instead.) Also, how did that printer end up on their workstation in the first place if they're not supposed to use it, and how will you prevent it from ending up there again?
  3. There are registry keys for WSUS, so you technically don't need AD for patch management. However, if you include those registry keys in the image, you need to make sure and delete a couple of keys (SusClientID and PingID) or else they will never get updates ever. Or, to be more specific and accurate, only one of them will get updates.
  4. Software installs. You can do these with power tools (LANdesk, Altiris, etc.), but that's extra money.
  5. "Poison" printer drivers. I've seen a couple of these. The best remedy was a print queue with an updated driver.
  6. Windows 7 printing would have epic tantrums unless we set allowed forest/allowed hosts in point and print restrictions. Perhaps this wouldn't be a big deal if all printers were ip-only, as long as User1 never wants to use User2's local printer. Without AD, our techs had to either use gpedit on the workstation or on the master image.
  7. You're assuming cloud Exchange, but I'm also going to add that email migrations and other large infrastructural changes without AD are painful on the client end. I scripted the "remove software from old failed migration/add workstation to AD/migrate user's profile from local to domain/demote user from admin to power user/make changes to firewall" jobs and ran them through Altiris. (The Microsoft consultants were suggesting we hire temps with thumb drives until I showed them my kung-fu.)

Also, there are software vendors who look at you like you have three heads when you tell them you have workgroups rather than domains. Altiris runs in workgroups, but your desktop techs are never allowed to change their passwords, for example. (Okay, okay. They can change their password. But they also have to swing by your cube and type their new password into the server, or tell you what their new password is.)

What I'm getting at is: You can manage lots of workstations without AD, but you may need to buy replacement software, and even with nice software you'll run into painful things.

share|improve this answer
11  
I wish I could upvote this answer twice. It's rewarding to read an experienced description of this particular and rare trench. –  ErikE Jan 24 at 23:35
2  
Out of curiosity, what were the business reasons behind an environment of that size without AD? –  kce Jan 25 at 0:38
2  
My predecessor and I both asked for AD repeatedly. We were usually told that we were so large that it would be too hard to do this year and maybe we can do it next year, and besides, you have Altiris. One year, our ancient, dying mail server trumped us (the failed migration). The next year, a VP decided we needed Exchange, and we had to have AD to do Exchange. Numfar, do the dance of joy! –  Katherine Villyard Jan 25 at 2:23
3  
+1 - I have one small Customer who doesn't have AD and it's excruciating to work with them. My take on AD is similar to my take on DHCP-- you need it when you have more that zero client computers. –  Evan Anderson Jan 25 at 14:15
2  
I have to admire your fortitude in dealing with such a horrible environment w/o AD. I think I would have quit, or deployed a Samba domain if worse came to worse. (I also like your bit about scripting fu in that last bit. I'm sick to death of "sysadmins" who can't automate away basic operations. It's a sad state of affairs when consultants set their expectations so low, too.) –  Evan Anderson Jan 25 at 16:27

AD and GPO will still handle management of workstations. Without it, you're paying for a 3rd party application or really really really trusting your users.

If you're doing something like strictly BYOD, or distributing only stateless VMs for working, then this doesn't apply as much.

share|improve this answer

The central point of this issue depends on what you see AD as doing for you. If it's only being used as the central store for SSO credentials that are only used to authenticate to cloud apps then of course it can be replaced with another central store.

But AD can do a lot more than that:

  • Software deployment.

  • OS Deployment.

  • Printer Management.

  • User profile management (e.g. using roaming profiles or UE-V to allow users to log in anywhere and keep their local data and customisations). I think this still matters even when all your services are in the cloud, because data can still be local and client machines still break down or get replaced.

  • Scalability: I'd rather manage the provisioning and ongoing management of my thousands of user accounts via ADUC & 'local' powershell scripting, etc. than purely via Office 365.

  • Integration with non-standard applications - e.g. we have a RFID-based ID card system that integrates with AD and I really wouldn't fancy trying to make it talk to Azure-based ADFS.

Of course, not all of these things will be relevant every time - the reverse of my comment about scalability is that a small business with only a few users could certainly just buy Office 365 or Google Apps, plus whatever laptop is on sale this week at the nearest supermarket, for each new hire if they decide this is less painful for them.

share|improve this answer

The Cloud is just another ISP

While exciting, any Cloud is just another outsourcing provider - a company trying to offer flexibility for your infrastructure and operations, often at lowered cost, and (hopefully) better reliability. Sure, the Cloud is targeted at simplifying common sought out service objectives like scalability, reliability and performance - but it's still just a hosting option

You require an Identity and Access Management platform, and Active Directory fits that need on-premise or at your hosting provider already you say?

Changing the physical location of your network services doesn't change your requirements.

Active Directory is highly extensible, even with a large number of systems not directly dependent on AD DS, you can still utilize it to manage "stand-alone" infrastructure components, hosted in the Cloud or anywhere else.

If you continue to utilize the Windows platform and Microsoft middleware, the sheer level of support for Active Directory authentication in the Cloud begs for Active Directory Domain Services, even more than on-premise.

Cloud all the way

Still really keen on moving everything to the Cloud? Do it! Virtualize your Domain Controllers, it's not a show stopper. It's just another outsourcing solution :-)

I think the real question is whether you can move your MS-centric "Windows shop" to the Cloud without AD DS

share|improve this answer
    
Isn't this essentially a less precise way of iterating the original question? I have read the answer several times because I wish to see your point, but can't. Is it possible to clarify? (and isn't the 'requirements not changing' part missing the whole sourcing debacle? Both functional and non-functional requirements come under strong scrutiny and frequently see change in a sourcing project). –  ErikE Jan 25 at 12:49
    
Your last statement is exactly my point, sorry for the vague phrasing. The Cloud aspect is not different from any other sourcing project in that your business requirements does not transform significantly should you choose cloud over any other housing/hosting/virtualization solution. That being said, your right, my answer is cowardly void of any real meaningful advice in relation to sourcing –  Mathias R. Jessen Jan 25 at 14:25
    
My impression is that the notion of business requirements not changing significantly is a typical selling point of cloud vendors. Buying points do not necessarily conform with that notion. Example01: data storage and processing may need regulatory evaluation as to where (which country) it may be done. Example02: the Snowden affair reveals the cloud as an active threat regarding confidentiality and integrity. Sweden actually got an evidence based warning about foreign state industrial cloud espionage years prior: svd.se/naringsliv/myndighet-slar-larm-om-it-lackor_5909395.svd –  ErikE Jan 25 at 23:56
    
...there's a coincidence: the Swedish newspaper article just got a minor follow-up, even if it is comparatively scant on information: theguardian.com/world/2014/jan/26/… My point is simply that the business requirements evaluation criteria tend to grow when external housing/hosting/cloud vendors are alternatives under consideration. Naturally, the explicit business requirements see more or less change due to this, in some cases significantly so. –  ErikE Jan 26 at 21:54

Could you? Yes. Would you want to? I don't think so. All of the hosted solutions you mentioned support AD Federation, and since you want SSO everywhere the only universal way of accomplishing that is going to be AD.

And products like LastPass are a password vault, not SSO.

share|improve this answer
    
While true that LastPass isn't SSO, for the end user it's irrelevant. All they know is they don't have to remember multiple passwords. OneLogin is the better example here. Taken the other side of the debate for a second (I'm on your side, just debating)...maybe you don't want to deal with the licensing/overhead/etc. of having AD around once you've gone 100% cloud. Maybe a 3rd party SSO option is a viable alternative to AD? –  TheCleaner Jan 24 at 21:31
    
If it's purely about licencing cost then OpenLDAP would satisfy your needs but the cost of maintenance / time would probably outstrip the cost of licencing. –  James Snell Jan 25 at 10:00

It depends on the size of your organization and the size of your budget. Let's look at this from a logistics standpoint.

If you've got a 3 man operation in a small business environment, then you could probably get away without AD if you had a decent IT guy. Would you want to is a different story.

Think of AD as a way to simplify management rather than another technology to have in place. Even if you started replacing AD with other tools, do you really want to be in a niche environment where you'd have to hire people who have to have skills in ALL the various technologies? It's hard enough finding a competent guy with skills in just a handful of skills, but when you start tacking on application on top of application, you start to narrow your pool of available candidates. When you get ready to replace your technical staff, you'll find it very difficult to fill those open roles.

So, in short, if you have the money, do whatever you want.

share|improve this answer

You don't "need" AD, but it will make your life easier. Depending on your size make sure you have 2 Servers, 1 primary, 1 backup, otherwise if you lose your AD server (and only have 1) you'll need to rebuild a domain, unless your backups are SOLID.

share|improve this answer
3  
Sorry, but I think you've completely missed the point of the question. –  RobM Jan 31 at 13:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.