AzureAD and shares
-
This company 100% needs a web app with a database backend ASAP. It would alleviate the majority of their problems.
-
@brandon220 said in AzureAD and shares:
This company 100% needs a web app with a database backend ASAP. It would alleviate the majority of their problems.
Most do. It's a really common need.
-
I think my best plan of action is to scrap AzureAD as they will never have servers hosted on Azure. I can pretty much guarantee this. I realize there is a hybrid approach but that just adds more complexity. My best option IMO is to spin up 3 new VMs - 2 AD/DNS and 1 file server. I know AD doesn't make much sense with 20 employees but it seems managing users in a regular "workgroup" with local accounts would take more effort. Am I wrong?
I confirmed yesterday that they prefer to have files accessible on the LAN versus through a web client/webdav. It has to be fast and reliable. They are 100% a MS shop so I think a Linux server with samba shares may not make sense. -
@brandon220 said in AzureAD and shares:
I think my best plan of action is to scrap AzureAD as they will never have servers hosted on Azure.
Not arguing against scrapping AzureAD, but hosting servers on Azure is really in no way a decision factor there. That's neither here nor there in deciding if AzureAD is for your or not.
-
@brandon220 said in AzureAD and shares:
I know AD doesn't make much sense with 20 employees but it seems managing users in a regular "workgroup" with local accounts would take more effort. Am I wrong?
For me, managing local users is normally easier at that size. But you are into the grey area where it can go either way. But two servers, all that cost and management and maintenance and updates and licensing alone, is more time and money than managing the users without it nine times out of ten. I could manage the users of 20 devices faster than you could even discuss getting AD.
-
@brandon220 said in AzureAD and shares:
I confirmed yesterday that they prefer to have files accessible on the LAN versus through a web client/webdav.
WebDAV and LAN is the same thing to most people. Those aren't competing concepts. WebDAV and SMB shares are "the same thing." Both are "LAN mentality mapped drives." WebDAV works better over a WAN than SMB, but both are the same category of item, rather than alternatives.
-
@brandon220 said in AzureAD and shares:
They are 100% a MS shop so I think a Linux server with samba shares may not make sense.
Why? In what way would a Windows FS be superior?
By this logic, no shop would ever use NAS, SAN, or things like BSD, because they are not the OS of the desktops. Or Mac because it can't be used as a server. There can be a case, in extreme circumstances, where homogeneity itself has some value, but it's so rare that it should generally be simply discounted.
-
@brandon220 said in AzureAD and shares:
They are 100% a MS shop
I get this is only true, because it is true, if you know what I mean.
Buy one laptop, it's Windows... you are a 100% Windows shop.
Buy a second desktop, it's Windows... still 100% Windows.
Start saying "we are 100% Windows" and you automatically start making it come true. Not because it made sense, or even was a decision, you just hadn't gotten around to putting in or counting the other equipment yet. At some point, shops tend to be making these decisions based on this quote, more than on business decisions.
-
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
I confirmed yesterday that they prefer to have files accessible on the LAN versus through a web client/webdav.
WebDAV and LAN is the same thing to most people. Those aren't competing concepts. WebDAV and SMB shares are "the same thing." Both are "LAN mentality mapped drives." WebDAV works better over a WAN than SMB, but both are the same category of item, rather than alternatives.
WebDav is painfully slow for me, especially when connected to Nextcloud from a Windows 10 machine. I've tested this with multiple NC servers and different W10 clients, and at different locations. Browsing files and folders is fine. Opening, losing, and saving things take way longer than it should.
-
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
They are 100% a MS shop so I think a Linux server with samba shares may not make sense.
Why? In what way would a Windows FS be superior?
By this logic, no shop would ever use NAS, SAN, or things like BSD, because they are not the OS of the desktops. Or Mac because it can't be used as a server. There can be a case, in extreme circumstances, where homogeneity itself has some value, but it's so rare that it should generally be simply discounted.
My logic here is: If the client wants to add a share on the MS server, they can easily do this themselves. If you throw samba in the mix, I feel they would struggle to understand why they are not using a MS server first, and then struggle to actually create a usable share in a system they know nothing about.
If it were for me, it would be samba 100%. I have to "fight" people all the time who will argue to the death that they don't want a Linux server of any type, because it is "free" and "not secure". I know we talk about audits all the time here on ML. The auditors, especially in the financial sector, argue this all the time and try to penalize you for using FOSS tools.
-
@brandon220 said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
I confirmed yesterday that they prefer to have files accessible on the LAN versus through a web client/webdav.
WebDAV and LAN is the same thing to most people. Those aren't competing concepts. WebDAV and SMB shares are "the same thing." Both are "LAN mentality mapped drives." WebDAV works better over a WAN than SMB, but both are the same category of item, rather than alternatives.
WebDav is painfully slow for me, especially when connected to Nextcloud from a Windows 10 machine. I've tested this with multiple NC servers and different W10 clients, and at different locations. Browsing files and folders is fine. Opening, losing, and saving things take way longer than it should.
WebDAV is slow, but SMB is slow compared to NFS
But they are the same tech category, all of them. Some are fast, some medium, some slow, but not different kinds of things. -
@brandon220 said in AzureAD and shares:
My logic here is: If the client wants to add a share on the MS server, they can easily do this themselves. If you throw samba in the mix, I feel they would struggle to understand why they are not using a MS server first, and then struggle to actually create a usable share in a system they know nothing about.
That's good logic, but important to understand that it isn't being Windows or homogenous that makes that true, it's that Samba is a bit complex. EXCEPT, you can get Samba interfaces that are even easier than Windows, and so that same logic could dictate not using Windows.
Also, if they don't 100% understand why they are or are not spending money on an MS server, they are not in any position to ever make these decisions and/or touch any server, Windows or otherwise. In fact, this completely makes Windows the worst option because it will empower them to do all kinds of bad things like break security or functionality.
-
@brandon220 said in AzureAD and shares:
The auditors, especially in the financial sector, argue this all the time and try to penalize you for using FOSS tools.
No actual auditor, quite the opposite.
-
@brandon220 said in AzureAD and shares:
If it were for me, it would be samba 100%. I have to "fight" people all the time who will argue to the death that they don't want a Linux server of any type, because it is "free" and "not secure".
I feel like you have a really low opinion of these people, not technically, but as people. You think that they are capricious, illogical, and out to screw their business for emotional / personal reasons (e.g. willing to hurt the business without any concerns for what is good for it, just what sounds good to them personally.) I find that IT often feels this way about businesses, but once I speak to them, they were never like that. LIterally had this happen with a bank four days ago. I bet if you present the real reasons, they aren't running a bank and this crazy. It might feel that way, but I bet if presented with good logic and factors, they are probably way more sane and trying to do a good job than you think.
-
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be. -
@brandon220 said in AzureAD and shares:
The more OSS you have, the lower your score will be.
Then it's an anti-audit. I mean it's that easy. If they are specifically penalizing security, that literally makes these guys social engineers / hackers. Instantly, you have a requirement to ban them from the company. Financial regulations actually makes that criminal.
-
@brandon220 said in AzureAD and shares:
The more OSS you have, the lower your score will be.
Remember, all SEC regulated banks are 100% core on OSS. All, 100%. No exceptions. And their security is a million times the needs, audits, and requirements of small banks and little financials. In the REAL financial world, better security means better scores.
Literally, I'd consider legal action here. As the IT adviser, you have a legal requirement to let them know that they are being scammed and have a legal requirement to take action.
-
@brandon220 said in AzureAD and shares:
FFIEC Cybersecurity Assesment Tool
It is REALLY fishy that a government agency is trying to put small banks at risk and goes directly against requirements for the big institutions.
-
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
The more OSS you have, the lower your score will be.
Then it's an anti-audit. I mean it's that easy. If they are specifically penalizing security, that literally makes these guys social engineers / hackers. Instantly, you have a requirement to ban them from the company. Financial regulations actually makes that criminal.
Not to derail this thread, but I deal with this every year. These auditors come in and HAVE to find something "wrong" even though what they find are not actual problems. It just justifies the money spent for the audit. I know there are others on here who deal with these auditors. They know exactly how bad it is.
-
@brandon220 said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
The more OSS you have, the lower your score will be.
Then it's an anti-audit. I mean it's that easy. If they are specifically penalizing security, that literally makes these guys social engineers / hackers. Instantly, you have a requirement to ban them from the company. Financial regulations actually makes that criminal.
Not to derail this thread, but I deal with this every year. These auditors come in and HAVE to find something "wrong" even though what they find are not actual problems. It just justifies the money spent for the audit. I know there are others on here who deal with these auditors. They know exactly how bad it is.
Right, so you have a criminal activity going on for personal gain. The bank needs to understand that the auditors are being paid to put them at risk, because that's how they get compensated. Doesn't change that it's illegal.
