MangoCon 2019

Dashrender

@eddiejennings said in MangoCon 2019:

@dashrender said in MangoCon 2019:

@eddiejennings said in MangoCon 2019:

Something that might be of use is using PowerShell to manage a small environment that doesn't use AD.

How do you deal with permissions in a non AD setup? keep a list of logons to refer to for the script?

I suppose. That's something I wonder myself. I suppose one solution can be to configure an administrator account on all machines with the same password and use that.

I've only heard of such management happening in a non-AD environment. If someone actually does it and makes it work, I'd be curious to see how.

That large'ish shop I used to work for had 1500+ SCO boxes, and they had a shared password file that was sent out to all boxes. No centralized authentication. This was 18 years ago, no clue how they are handling it today.

I would think a LDAP type solution would be best - but perhaps not.

@scottalanmiller ?

scottalanmiller

@eddiejennings said in MangoCon 2019:

@dashrender said in MangoCon 2019:

@eddiejennings said in MangoCon 2019:

Something that might be of use is using PowerShell to manage a small environment that doesn't use AD.

How do you deal with permissions in a non AD setup? keep a list of logons to refer to for the script?

I suppose. That's something I wonder myself. I suppose one solution can be to configure an administrator account on all machines with the same password and use that.

I've only heard of such management happening in a non-AD environment. If someone actually does it and makes it work, I'd be curious to see how.

Or to stop using passwords

scottalanmiller

@dashrender said in MangoCon 2019:

That large'ish shop I used to work for had 1500+ SCO boxes, and they had a shared password file that was sent out to all boxes. No centralized authentication.

That actually is central authentication. Different than how AD does it, but not all that different. That's still just a form of caching, and AD does that too. It's just proactive caching versus AD's reactive caching. Same difference, though.

Dashrender

@scottalanmiller said in MangoCon 2019:

@eddiejennings said in MangoCon 2019:

@dashrender said in MangoCon 2019:

@eddiejennings said in MangoCon 2019:

Something that might be of use is using PowerShell to manage a small environment that doesn't use AD.

How do you deal with permissions in a non AD setup? keep a list of logons to refer to for the script?

I suppose. That's something I wonder myself. I suppose one solution can be to configure an administrator account on all machines with the same password and use that.

I've only heard of such management happening in a non-AD environment. If someone actually does it and makes it work, I'd be curious to see how.

Or to stop using passwords

OK - how do you push the hashes around?

Dashrender

@scottalanmiller said in MangoCon 2019:

@dashrender said in MangoCon 2019:

That large'ish shop I used to work for had 1500+ SCO boxes, and they had a shared password file that was sent out to all boxes. No centralized authentication.

That actually is central authentication. Different than how AD does it, but not all that different. That's still just a form of caching, and AD does that too. It's just proactive caching versus AD's reactive caching. Same difference, though.

OK I'll give you that.

scottalanmiller

@dashrender said in MangoCon 2019:

@scottalanmiller said in MangoCon 2019:

@eddiejennings said in MangoCon 2019:

@dashrender said in MangoCon 2019:

@eddiejennings said in MangoCon 2019:

Something that might be of use is using PowerShell to manage a small environment that doesn't use AD.

How do you deal with permissions in a non AD setup? keep a list of logons to refer to for the script?

I suppose. That's something I wonder myself. I suppose one solution can be to configure an administrator account on all machines with the same password and use that.

I've only heard of such management happening in a non-AD environment. If someone actually does it and makes it work, I'd be curious to see how.

Or to stop using passwords

OK - how do you push the hashes around?

You CAN do that using state management. But with state management, you don't' need hashes, either. The theory of full state management is no logins, at all. Dramatically more secure than any kind of login management.

Doesn't work for END users, but works for admin users.