AD is really powerful, but as someone who accidentially slided into Windows administration in his job, I find the windows Admin tools lacking the most elementary features I assumed they would have:

* Quickly get a shell on a remote machine, like I'm sitting in front of it? Powershell is nice but it's remoting model is different. You can't easily manage Windows updates for example over Powershell, it just behaves differently. * I assumed there would be something like Win98 "network neighbourhood" on steroids. Give me a list of all computers in my domain, or all computers in a group, or all computers certain users are on. AD only tells you which ones are joined, you cannot browse which ones are actually running. * Some GUI where you can ping a computer, find out which user is logged in, which software is installed, and which updates are missing.

You can find nice third party tools for all of this, or spend a lot of time writing scripts, but the basics are lacking. And the offerings from MS (WSUS, SCCM, ...) are powerful, but so far would cost us more time than they save, so I'm not really happy with the Windows ecosystem...

I've recently come across a situation where somebody couldn't log in with their AD credentials, turned out the account had been renamed... and nobody knew who (or what) did and why.

I don't know if AD comes without audit logging, or it was just disabled in that installation, but that seems to be a pretty big no-no for a central part of your authentication infrastructure.

(Granted, it's an anecdote, but too many WTF anecdotes make me not like a thing as well).

I might be missing something, but what makes Active Directory so much better than any other LDAP implementation?

My limited understanding is that it has better tooling and defaults, and that it's more than just an LDAP implementation, but is it really that much better if you aren't in the Microsoft ecosystem?

I think AD is probably the best (if not the single) reason to use MS boxes. It's quite a beast and you have to know its little tricks but hey, the same goes for any other solution of similar scale.

Samba is pretty decent

Thats like saying tires are a decent replacement for Uber.

How? Samba supports AD, and can work as a replacement for Windows AD (or together with Windows DCs)

Samba is SMB/CIFS, a file sharing implementation. How does that relate to Active Directory, other than file permissions?

Samba is also an Active Directory Domain Controller[0]. While its not a perfect implementation of the system, it's sufficient for many usecases.

[0]: https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Acti...

You don't need Windows to use Active Directory.

Active Directory is a Microsoft product, which, last I knew, only runs on Windows.

Active Directory implements LDAP, and there are serveral other LDAP implementations. Other OSes can use Active Directory as an LDAP server, sure.

Oh? Please elaborate. I always assumed Active Directory = Windows.

Decently common to have a cloud AD instance for your internal “users table” even if all the use cases are web/Mac/Linux.

Doesn't AWS have it as a service? Possibly also an OSS project?