SAMIT: Do You Need Two AD Domain Controllers?
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
@dashrender said in Do You Need Two AD Domain Controllers? SAMIT Video:
You keep saying that it's likely that many don't need AD - but I see AD making these things much easier (for a cost) than not using AD.
I think that that is mostly a myth. For a normal SMB, especially a relatively small one, AD saves no effort anywhere, but generates a ton of effort in needing to build and maintain servers, needing to maintain CALs, track CALs, take server backups, etc. All things that don't need to exist without AD, in some cases.
AD takes no effort to setup or deploy. GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).
CALs are cheap ($50 as a standalone, cheaper if you buy in a pack).
I worked for a MSP and the amount of "maintenance" we did on AD was really non-existent. If you want to be fancy, you have your RMM script a backup once a day doing a LDIFDE -f backupad.ldif but beyond that, there's just not a lot to it. Any RMM worth it's salt (get it, a SALT joke) can manage 100 domain controllers with RMM tools without any real overhead, etc.
I agree that AD isn't providing as much value these days for small shops as it used to, but the overheads are smaller than ever.
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
AD takes no effort to setup or deploy.
It takes a lot of effort. You have to finance it, purchase it, figure out CALs, buy CALs, get a server, install it, configure it.
You live in a world of unlimited budgets and unlimited dedicated staff for tasks. You see purchasing as something handled by the purchasing department, as budgeting done by the CFO, as $700 being something you don't mention.
In the SMB, those things are huge. $700 isn't even remotely trivial, and setting up AD, in fact just buying AD, is generally double the effort of the alternative.
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).
GPO is unnecessarily complicated and unreliable. It's pushed as a miracle product, but takes huge amounts of effort to learn and maintain and rarely works flawlessly. And AD isn't what provides GPO, that's one of the common myths that cause people to buy AD without actually looking into their needs. GPO doesn't come with AD, you already have it.
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).
GPO is unnecessarily complicated and unreliable. It's pushed as a miracle product, but takes huge amounts of effort to learn and maintain and rarely works flawlessly. And AD isn't what provides GPO, that's one of the common myths that cause people to buy AD without actually looking into their needs. GPO doesn't come with AD, you already have it.
It does, but AD and OUT structures are the way most people use to deploy it (As well as the central policy store for deploying 3rd party). You could push it out with SALT etc, but in a SMB internal staff will not know how to use something like that.
You could have your RMM or MDM manage push outs though (and I am seeing Stuff like Airwatch positioned as a replacement). the big gap is MAM as a lot of apps had GPO's and need to have API's for management to make the transition smooth.
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
CALs are cheap ($50 as a standalone, cheaper if you buy in a pack).
CALs are either cheap or they are $50 per user, but they aren't both. For an SMB, $50 per user for no reason is expensive. What do they get from that $50?
And that's hardly the full cost... let's look at a ten person business:
- Server: $1,000
- Windows License: $700
- CALs: $500
- Windows Pro Upgrades: $1,500
- Admin Time to Set Up: 2-5 days
That's $3,700 or $370 per user just to set up, plus around half a day of effort, per user to get set up. In many SMBs, it could take a week of effort just to get that kind of spending approved!
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).
GPO is unnecessarily complicated and unreliable. It's pushed as a miracle product, but takes huge amounts of effort to learn and maintain and rarely works flawlessly. And AD isn't what provides GPO, that's one of the common myths that cause people to buy AD without actually looking into their needs. GPO doesn't come with AD, you already have it.
It does, but AD and OUT structures are the way most people use to deploy it (As well as the central policy store for deploying 3rd party). You could push it out with SALT etc, but in a SMB internal staff will not know how to use something like that.
Right, that's the point. most people do because other people tell them that it is all one thing. AD, like many things in IT, is primarily deployed in the SMB by mistake because people think that they are deploying something else.
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
Any RMM worth it's salt (get it, a SALT joke)
Hilarious!
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
I agree that AD isn't providing as much value these days for small shops as it used to, but the overheads are smaller than ever.
I'd say the opposite. As the cost of everything else comes down, and the raw cost of AD is climbing (ever so slightly, just a few percentage) both its raw cost and its relative costs are getting worse.
What's more, I get the impression that the knowledge and skill necessary to support it are waning. Look at SW, the average person would have been able to deploy AD eight years ago. Today, no way, not the average. It's way too much for the average SMB admin to know how to deploy with any reliability.
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
You could push it out with SALT etc, but in a SMB internal staff will not know how to use something like that.
Yeah, but you can outsource that stuff to qualified people for a fraction of the cost of AD.
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
CALs are cheap ($50 as a standalone, cheaper if you buy in a pack).
CALs are either cheap or they are $50 per user, but they aren't both. For an SMB, $50 per user for no reason is expensive. What do they get from that $50?
And that's hardly the full cost... let's look at a ten person business:
- Server: $1,000
- Windows License: $700
- CALs: $500
- Windows Pro Upgrades: $1,500
- Admin Time to Set Up: 2-5 days
That's $3,700 or $370 per user just to set up, plus around half a day of effort, per user to get set up. In many SMBs, it could take a week of effort just to get that kind of spending approved!
1/2 a day of effort per user? Explain....
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
. let's look at a ten person business:
Server: $1,000
Windows License: $700
CALs: $500
Windows Pro Upgrades: $1,500
Admin Time to Set Up: 2-5 daysWith 10 users you could use essentials or foundation edition. I can buy a Dell T130 with that ~$700.
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
Yeah, but you can outsource that stuff to qualified people for a fraction of the cost of AD.
Qualified people cost money
You ever see a rate sheet for Continuums outsourced India desk?
Good luck finding SALT talents that's cheap (even in Bangalore). -
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
Central authentication, while it does have value, in the SMB seems to be primarily deployed out of confusion, rather than out of solving a problem
The general issue I've seen is a lot of (idM) systems have weird quirks when working with things other than AD. Yes on paper LDAP will work with quite a few I suspect didn't get a lot of QE testing...
I do think (idM) systems and SSO brokers are breaking the final biggest tie of AD (Authentication). Setting up federated services was always a pain in the ass and turnkey SAML integrations for common web apps are a lot nicer to manage.
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
Yeah, but you can outsource that stuff to qualified people for a fraction of the cost of AD.
Qualified people cost money
Unqualified people cost way more, though.
-
Hey look, as soon as we say AD is easy, someone posts on SW that they screwed up their little AD install, again. We get these like once a week, maybe every two weeks. For SMBs, even what should be a trivially easy single server AD install is regularly a major problem. Just picking a domain name is beyond the common skill level. People don't get tripped up by advanced AD techniques, they are regularly stumped by just the most basic install process.
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
Hey look, as soon as we say AD is easy, someone posts on SW that they screwed up their little AD install, again. We get these like once a week, maybe every two weeks. For SMBs, even what should be a trivially easy single server AD install is regularly a major problem. Just picking a domain name is beyond the common skill level. People don't get tripped up by advanced AD techniques, they are regularly stumped by just the most basic install process.
If you can't figure out that you should use a domain you own, you shouldn't be setting up a cloud SSO deployment either...
-
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
Hey look, as soon as we say AD is easy, someone posts on SW that they screwed up their little AD install, again. We get these like once a week, maybe every two weeks. For SMBs, even what should be a trivially easy single server AD install is regularly a major problem. Just picking a domain name is beyond the common skill level. People don't get tripped up by advanced AD techniques, they are regularly stumped by just the most basic install process.
If you can't figure out that you should use a domain you own, you shouldn't be setting up a cloud SSO deployment either...
Agreed. Wouldn't suggest that either.
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
@storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
Hey look, as soon as we say AD is easy, someone posts on SW that they screwed up their little AD install, again. We get these like once a week, maybe every two weeks. For SMBs, even what should be a trivially easy single server AD install is regularly a major problem. Just picking a domain name is beyond the common skill level. People don't get tripped up by advanced AD techniques, they are regularly stumped by just the most basic install process.
If you can't figure out that you should use a domain you own, you shouldn't be setting up a cloud SSO deployment either...
Agreed. Wouldn't suggest that either.
KISS. If you don't need complexity, don't introduce it.
-
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
@black3dynamite said in Do You Need Two AD Domain Controllers? SAMIT Video:
All these best practices seems to be carried over from the days of physical servers.
The need for two didn't exist then, either. It's never been a best practice, always a complete misunderstanding of HA at best, a sales tactic at worst.
I haven't watched your video yet but I've heard a lot of people (non-sales) say having only one DC is a good way to get fired.
-
@dave247 said in Do You Need Two AD Domain Controllers? SAMIT Video:
@scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:
@black3dynamite said in Do You Need Two AD Domain Controllers? SAMIT Video:
All these best practices seems to be carried over from the days of physical servers.
The need for two didn't exist then, either. It's never been a best practice, always a complete misunderstanding of HA at best, a sales tactic at worst.
I haven't watched your video yet but I've heard a lot of people (non-sales) say having only one DC is a good way to get fired.
Probably if you have a boss that knows about domain controllers and best practices, you are big enough to be following Microsoft "best practices"
And besides... RDSH in the cloud or bust
