Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to implement a domain into a business with ~200 user accounts. Being a unix guy, samba seemed the first choice.

However, after a few discussions related to ease of management (which will be delegated to support staff) and ease of implementation, Windows 2003 Server became another option.

I would like your opinions on PDC Samba+ldap (to which I wish to authenticate postfix too) versus a Windows 2003 Server Domain Controller.

share|improve this question
    
There's no such thing as a "PDC", you just have domain controllers these days. –  Mark Henderson Mar 7 '11 at 4:11

6 Answers 6

up vote 5 down vote accepted

It comes down to whether you want to spend time implementing Samba or spend money implementing Windows Server. We use Samba, but there's a few niggles, but it's significantly cheaper than Windows Server. In particular, Samba doesn't seem to be noticing changes to group memberships until you restart it. It does give us a bit more flexibility than Windows would allow. We use LDAP for our authentication and it seems to work reasonably well.

share|improve this answer
    
what gui for user management do you use ? are there any important features missing from m$ domain ? I want this setup only for auth users and shared documents security (groups and stuff) –  petre Sep 25 '09 at 11:35
1  
We use smbldap tools. They're command line tools. When we want to edit the LDAP tree manually we'll use something like gq. –  David Pashley Sep 26 '09 at 9:54

These ~200 folks are completly new to windows domains? How do they operate at the moment? I am asking because of the migration you will have to do.

One of the most important questions is about E-Mail, are they possibly thinking about using Outlook/Exchange in the future? Then you're lost to the Windows Server solution, if you're not able to circumvent this with a deployment of Zimbra or another mailserver which is capable of speaking MAPI if your client sticks to Outlook..

share|improve this answer
    
mail will never be transferred to eXchange - domain is to be used only for authenticating user at their workstations and nothing more than this –  petre Sep 25 '09 at 11:33

Seems like you're making life alot harder for yourself for no good reason.

Windows Server 2008 (you shouldn't be rolling out 2003 now) costs a few hundred bucks. You're going to waste far more $$ on your own time fixing glitches, writing scripts for the admin users setting up accounts, etc.

share|improve this answer
2  
Client access licenses are at least $20.00 / ea, retail. I'd say that he's talking at least $750.00 for the server OS license and probably another $3500 to $4500 in CALs. –  Evan Anderson Sep 25 '09 at 12:37

I've used both, but with that many computers / users to support I'd lean toward Windows Server to get both Group Policy and Windows Server Update Services. Both of them are going to make your life easier and decrease the amount of support labor related to client computer maintenance. If you haven't read up on what Group Policy can do, have a quick look at: http://serverfault.com/questions/66049/what-group-policies-have-you-applied

A lot of people focus on the "locking down the computer" uses of Group Policy, but for me it's about automating administration tasks and making new PC / user provisioning consistent and as near to automatic as possible.

Will it be worth the added expense to go w/ Windows Server versus Samba? That depends. I think the TCO savings would be worth it, but those certainly aren't "hard numbers".

It will be easier for the organization to find somebody to maintain a Windows Server installation when / if you decide to move on. (That's not to say that maintaining Samba is particularly difficult, or that the average Windows Server admin off the street really knows what they're doing, though, either.)

To be fair, you can use scripting to do anything that Group Policy can do. It may not be as easy, but it's certainly possible.

share|improve this answer
    
I would definitely lean towards Windows, even though I picked Samba for my small network. This was partly due to having an existing LDAP infrastructure and a mixed Windows/Linux userbase. Windows would be a lot easier if we were just windows desktops. –  David Pashley Sep 26 '09 at 9:57

I would choose Windows for Group Policy alone. Managing 200 users/workstations wil be waaay easier using Group Policy.

share|improve this answer
    
Even as a *nix guy, I would normally suggest Windows if you need to manage a large number of Windows boxes simply because, most of the time, MS stuff works better with MS stuff. However, I've seen entirely too many issues with group policy, both in practice and as a method, to say that I'd rely entirely on group policy. An example would be the dozen workstations (out of 120-ish), that suddenly stopped working when I applied ACLs to their VLAN blocking access beyond our local network, even though the AD guys had assured me that everyone was using the proxy because it was pushed by GP. –  Greeblesnort Sep 25 '09 at 12:52
4  
Sounds like the "AD guys" didn't know how their software worked, eh? Group Policy has been very reliable and useful in my work. I see a lot of Windows admins who don't understand how client computers apply policies (in what order, "precedence" issues, security issues), and the asynchronous processing functionality that got defaulted "on" in Windows XP can make GPO processing non-deterministic (which can be "fixed" by turning that dumb "feature" off). I chalk up problems that people have with Group Policy to admins who don't know what they're doing. –  Evan Anderson Sep 25 '09 at 13:01

You might take a look at these projects/solutions:

http://www.clearcenter.com/

http://www.univention.de/en/products/ucs/

I'm already researching these. For basic domain/profile management with Windows clients they look very promising. And I've already created domains with ClearOS. The e-mail/domain/proxy integration they've done so far is excellent. Will be trying a full temo of Univention which in some ways is more advanced in development although its seems geared to larger businesses. As for e-mail, integrating outlook, not sure I would go that route. There are better, more customizable clients out there that run on M$ Windows, Thunderbird is a great choice. You may consider look at OpenXchange as well for e-mail client integraiton or web based.. For general Exchange "simulation' its not bad.

I have no affiliation with either of these groups. FYI

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.