Active Directory and it's deep integration into all MS Products is a killer feature in my opinion. Federated Identity Management, and ADFS are tightly integrated into AD but at the same time open and make Access Management and integration with other Enterprises pretty seamless.

I think a lot of people outside the corporate world have a hard time understanding the virtues of Microsoft because they work on such a small scale or without Security, Compliance, and Regulation concerns that are requisite in Enterprise Environments.

Having worked in a very secure/compliant/regulated shop, I can understand those concerns (I was not a sysadmin, I was a developerish person).

I'm going to presume from your answer that OpenLDAP is not sufficient then? Certainly Linux systems can use LDAP.

AD looks more like the addition of puppy, a yellow pages solution, and a mail settings wizard. I'm sure there are other features too, but I don't see people using them. Linux has nothing like that. In part that's because:

- It's far from consensus that a puppy-like system is the best way to manage the settings of all your computers, including desktops. Linux has plenty of other tools for managing multiple computers, and almost nobody uses only one.

- Really, what was MS thinking when they joined email configuration with the desktop settings management? (And ntp, dhcp, and etc?) AD imposes a lot of restriction on how one must organize his services, and just a tiny minority would be content with something like that on Linux.

- There are plenty of yellow pages solutions that people like more than LDAP.

> what was MS thinking when they joined email configuration with the desktop settings management?

Selling Exchange licences, what else?

> AD imposes a lot of restriction on how one must organize his services

Preventing machine-profile creep is a big concern for me. Every different kind of machine we deploy is one more different configuration we need to manage.

> Certainly Linux systems can use LDAP.

I think the operative word here is "can." Active Directory allows you to actively reject machines from your network that are not part of the Domain and it can prevent you from extricating a machine from the Domain to circumvent restrictions imposed upon the machine, the user, the location, or any other myriad of configurable factors.

It would surprise me if there was something you couldn't do to on a nix machine that you could do with Active Directory on a Windows based PC but the time and maintenance involved are in no way proportional. The full featured and easy to use tool-chain was what made Microsoft great, and they lost that with overly complicated systems in the 2000s but they seem to be getting back on the right path with Powershell and their Core Server administration tools.

Additionally Active Directory is an LDAP provider so it's relatively easy to integrate nix machines into an AD environment.

Thanks! I appreciate your insights here.

Try this, what is the open source competitor to Active Directory from the point of view on a system admin who manages 1,000s of PCs? This is just one part of the equation, but it shows a lot about the difference between Microsoft and open source projects.

It's LDAP. I'm not looking for "points", but I'm looking for a broad understanding of why an enterprise would definitely select Microsoft. From a techie in the trenches with an eye on founding his own company, I simply can not grasp why I would use Microsoft or other proprietary technology at this point.

What LDAP implementation would you use?

http://stackoverflow.com/questions/663402/what-are-the-diffe...

OpenLDAP. But I don't want to derail into nits really - I'm looking at the broader question of "What offerings conclusively swing an enterprise away from Linux".

"...swing an enterprise away from..." implies they are already there. They are not. The question should be reversed,"What offerings conclusively swing an enterprise away from Windows?", and the answer is not much (so far).

LDAP is not a substitute for the whole of Active Directory it is a small piece.

Currently there are a broad set of tools to manage thousands of PCs from a core infrastructure, think Puppet or Chef for Windows Desktops. And you can set broad policies about software and access.

That sort of deployment, where you have say a call center with 1,500 people sitting in front of a PC to look up orders and such on their desk. You can update all of them, make sure none of them can surf outside to random web sites, etc.

It is also useful in a large technology enterprise where you have many developers. (Say a large C# shop of contract coders) because the tools help manage workstation build environments etc. When you are a mixed shop it is less useful.

Basically if all of your IT needs can be met by Microsoft products, they have a good story about how you can deploy them, manage them, and maintain them. There isn't a solid open source equivalent. Part of Google's strategy there is 'Chromebook' since if you're running a bunch of terminals that makes things easier to centrally manage.

If you were going to build something in the FOSS space here it would probably impose some strong limits on customizations in order to work. It would also need a way of disabling 'smart' employees from subverting the system (remember the kids who broke through the restrictions in their school issued ipads?) You have to think in the mindset that your employees are not your friends and may be trying to subvert the system :-) The "ideal" (and I put it in scare quotes because most employees hate it) is a workstation that can only run the tools to do your job, and only browse to sites that help you do your job.

I expect we'll get back to that and there will be a 'soft' network for personal devices which is monitored.

Hum. I guess you're right; thinking of people I hired as people I don't trust does change the mindset a lot. I would hate to work for a place like that, and would feel awful about helping build that kind of place. Probably very "hacker" of me. :)

Of course, technically, I can conceptualize that in my own company, I would set up a stock Puppet-based configuration that controlled Debian workstations, build computers, etc. Firewall rules, access rules, login rights, etc - all via puppet.

It does go a bit deeper than not trusting folks[1]. Sometimes you must make sure you comply with information sharing laws in your field (e.g. HIPA). Two, most people are not super computer literate and just want the damn thing to work. Having a standard config that you slap down with their data stored on good servers is actually a pretty helpful thing to them. They don't want control of their machine, they want stability, reliability, and recovery from mistakes. The accountant wants to do his/her job and not learn IT's job.

As much as I'm not a fan of Windows Servers, I understand that they provide a pretty easy, integrated approach. I do wish open source projects would look to that and not think what's available is good enough. People will trade up their Camry for a Lexus, but not willing trade down to a Yaris.

1) although with over 1,000 or 10,000 employees you probably should assume you've hired some damn fools or evil folks - that's just basic numbers

That's the problem your a techie and if your founding a techie company non-MS solutions will work. But if your running a business that's not techinical think insurance agency, mortgage company, etc. You would go down to "best buy" buy a couple of windows boxes run your loan officer product on windows and try not to think about technology again. Where I work we have a product that runs java on the server but requires IE as the browser. 5 prod websphere servers 700 windows boxes for the users. On the development boxes we run tomcat but if there's a production issues they want to be able to call microsoft or IBM.Also, your going to train 700 users to use linux on the desktop. Besides can you lease linuxs boxes from Dell?

1,000s of PCs... So you work in a small Enterprise shop?

... I wasn't describing my situation, although I would bet 1,000s is a bit more common than 10k and 100k but I take your point (I think).

I use FreeBSD with Samba, but I only have 500 at my current site with a mix of iPads, PCs, and OS X.