Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a number of Windows servers running in AWS.

As the number of servers grows, managing Windows logins across all the servers has become a headache. I need some sort of password synchronizer that would allow me to centrally manage logins and passwords.

Is there a product (or OSS project) that synchronizes Windows logins across multiple stand-alone servers, without using Active Directory?

[An executive made a decision that we will never use Active Directory in the cloud. So I'm looking to work around that decision.]

share|improve this question
Ah executives making technical decisions. How about using a configuration Management Tool? Maybe finding out what the pros/cons and actual reasons why not Active Directory would be a good start. – Drew Khoury Apr 27 '14 at 4:03
up vote 8 down vote accepted

[An executive made a decision that we will never use Active Directory in the cloud. So I'm looking to work around that decision.]

Then I'm afraid you're going to have a bad time. What you're asking for isn't going to be as easy as AD. Because an executive made a poor decision, you're not unable to use the correct, first-party, purpose-built tool for the job.

One solution that comes to mind is using PowerShell DSC and integrate it with an existing CM platform that you might already be using in the cloud (Chef, Puppet, Ansible, etc).

share|improve this answer
Thanks @MDMarra . I did take a look at PowerShell DSC. That looks pretty interesting. We are using Chef on the Linux side of the business. I'll see if those guys can get me up to speed. – user3384842 May 5 '14 at 0:30

Create a VPN between your cloud network and your on-premise network, and then use your on-premise AD

share|improve this answer
Thank you @MichelZ. I would do something similar to this, if I were allowed to use an AD domain, but with an AD server in each availability zone. However, the boss doesn't want any cloud operations to fail if AD fails. So even though AD isn't in the cloud, the cloud would still depend on it. – user3384842 May 5 '14 at 0:17

Novell Identity Manager is also an option, though AD really is better suited for the task. Novell's solution requires an eDirectory Vault and the Novell Client on each system. Check this link if you're curious IDM Implementing Password Synchronization. IDM allows you to build drivers which synchronize passwords between eDirectory and Active Directory. If you propose this solution, you're exec will likely acquiesce to using AD as Novell has increased cost and headaches.

share|improve this answer

If he's worried about security in the cloud (and your forest/domain functional levels are 2003 or higher) you could always deploy a RODC in the cloud.

MDMarra's answer is also good (in fact it's what we do). I couldn't up-vote him because I lack reputation..

share|improve this answer
I didn't know that RODC existed. It's an interesting idea. Thanks for the suggestion. – user3384842 May 5 '14 at 0:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.