ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    SAMIT: Do You Need Two AD Domain Controllers?

    IT Discussion
    samit scott alan miller active directory high availability best practices youtube ad dc domain controller
    14
    72
    8.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      Dashrender @scottalanmiller
      last edited by

      @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

      @dashrender said in Do You Need Two AD Domain Controllers? SAMIT Video:

      You keep saying that it's likely that many don't need AD - but I see AD making these things much easier (for a cost) than not using AD.

      I think that that is mostly a myth. For a normal SMB, especially a relatively small one, AD saves no effort anywhere, but generates a ton of effort in needing to build and maintain servers, needing to maintain CALs, track CALs, take server backups, etc. All things that don't need to exist without AD, in some cases.

      I'm happy to use SAMBA in it's place. The ability for users to log into any machine on the network without me having to setup a user for them is nice.

      S 2 Replies Last reply Reply Quote 0
      • S
        scottalanmiller @Dashrender
        last edited by

        @dashrender said in Do You Need Two AD Domain Controllers? SAMIT Video:

        @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

        @dashrender said in Do You Need Two AD Domain Controllers? SAMIT Video:

        You keep saying that it's likely that many don't need AD - but I see AD making these things much easier (for a cost) than not using AD.

        I think that that is mostly a myth. For a normal SMB, especially a relatively small one, AD saves no effort anywhere, but generates a ton of effort in needing to build and maintain servers, needing to maintain CALs, track CALs, take server backups, etc. All things that don't need to exist without AD, in some cases.

        I'm happy to use SAMBA in it's place. The ability for users to log into any machine on the network without me having to setup a user for them is nice.

        SAMBA is not in place of AD, Samba is AD.

        1 Reply Last reply Reply Quote 0
        • S
          scottalanmiller @Dashrender
          last edited by

          @dashrender said in Do You Need Two AD Domain Controllers? SAMIT Video:

          The ability for users to log into any machine on the network without me having to setup a user for them is nice.

          You mean another user for that. But we get this without AD (from any source) so the two are not connected. I only need make a user once, but they are available on every machine. Just a trivial script does that.

          1 Reply Last reply Reply Quote 0
          • S
            StorageNinja Vendor @scottalanmiller
            last edited by

            @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

            @dashrender said in Do You Need Two AD Domain Controllers? SAMIT Video:

            You keep saying that it's likely that many don't need AD - but I see AD making these things much easier (for a cost) than not using AD.

            I think that that is mostly a myth. For a normal SMB, especially a relatively small one, AD saves no effort anywhere, but generates a ton of effort in needing to build and maintain servers, needing to maintain CALs, track CALs, take server backups, etc. All things that don't need to exist without AD, in some cases.

            AD takes no effort to setup or deploy. GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).

            CALs are cheap ($50 as a standalone, cheaper if you buy in a pack).

            I worked for a MSP and the amount of "maintenance" we did on AD was really non-existent. If you want to be fancy, you have your RMM script a backup once a day doing a LDIFDE -f backupad.ldif but beyond that, there's just not a lot to it. Any RMM worth it's salt (get it, a SALT joke) can manage 100 domain controllers with RMM tools without any real overhead, etc.

            I agree that AD isn't providing as much value these days for small shops as it used to, but the overheads are smaller than ever.

            S J 5 Replies Last reply Reply Quote -1
            • S
              scottalanmiller @StorageNinja
              last edited by

              @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

              AD takes no effort to setup or deploy.

              It takes a lot of effort. You have to finance it, purchase it, figure out CALs, buy CALs, get a server, install it, configure it.

              You live in a world of unlimited budgets and unlimited dedicated staff for tasks. You see purchasing as something handled by the purchasing department, as budgeting done by the CFO, as $700 being something you don't mention.

              In the SMB, those things are huge. $700 isn't even remotely trivial, and setting up AD, in fact just buying AD, is generally double the effort of the alternative.

              1 Reply Last reply Reply Quote 1
              • S
                scottalanmiller @StorageNinja
                last edited by

                @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).

                GPO is unnecessarily complicated and unreliable. It's pushed as a miracle product, but takes huge amounts of effort to learn and maintain and rarely works flawlessly. And AD isn't what provides GPO, that's one of the common myths that cause people to buy AD without actually looking into their needs. GPO doesn't come with AD, you already have it.

                S 1 Reply Last reply Reply Quote 1
                • S
                  StorageNinja Vendor @scottalanmiller
                  last edited by

                  @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                  @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                  GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).

                  GPO is unnecessarily complicated and unreliable. It's pushed as a miracle product, but takes huge amounts of effort to learn and maintain and rarely works flawlessly. And AD isn't what provides GPO, that's one of the common myths that cause people to buy AD without actually looking into their needs. GPO doesn't come with AD, you already have it.

                  It does, but AD and OUT structures are the way most people use to deploy it (As well as the central policy store for deploying 3rd party). You could push it out with SALT etc, but in a SMB internal staff will not know how to use something like that.

                  You could have your RMM or MDM manage push outs though (and I am seeing Stuff like Airwatch positioned as a replacement). the big gap is MAM as a lot of apps had GPO's and need to have API's for management to make the transition smooth.

                  S 2 Replies Last reply Reply Quote -1
                  • S
                    scottalanmiller @StorageNinja
                    last edited by

                    @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                    CALs are cheap ($50 as a standalone, cheaper if you buy in a pack).

                    CALs are either cheap or they are $50 per user, but they aren't both. For an SMB, $50 per user for no reason is expensive. What do they get from that $50?

                    And that's hardly the full cost... let's look at a ten person business:

                    • Server: $1,000
                    • Windows License: $700
                    • CALs: $500
                    • Windows Pro Upgrades: $1,500
                    • Admin Time to Set Up: 2-5 days

                    That's $3,700 or $370 per user just to set up, plus around half a day of effort, per user to get set up. In many SMBs, it could take a week of effort just to get that kind of spending approved!

                    S 2 Replies Last reply Reply Quote 1
                    • S
                      scottalanmiller @StorageNinja
                      last edited by

                      @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                      @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                      @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                      GPO largely "just works" for a ton of things and core applications with tons of existing templates and easily googlable guides (and staff who know how to maintain it that are cheap as chips), it hooks into other Microsoft domain tech (Print server management).

                      GPO is unnecessarily complicated and unreliable. It's pushed as a miracle product, but takes huge amounts of effort to learn and maintain and rarely works flawlessly. And AD isn't what provides GPO, that's one of the common myths that cause people to buy AD without actually looking into their needs. GPO doesn't come with AD, you already have it.

                      It does, but AD and OUT structures are the way most people use to deploy it (As well as the central policy store for deploying 3rd party). You could push it out with SALT etc, but in a SMB internal staff will not know how to use something like that.

                      Right, that's the point. most people do because other people tell them that it is all one thing. AD, like many things in IT, is primarily deployed in the SMB by mistake because people think that they are deploying something else.

                      1 Reply Last reply Reply Quote 0
                      • J
                        jmoore @StorageNinja
                        last edited by

                        @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                        Any RMM worth it's salt (get it, a SALT joke)

                        Hilarious!

                        1 Reply Last reply Reply Quote 1
                        • S
                          scottalanmiller @StorageNinja
                          last edited by

                          @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                          I agree that AD isn't providing as much value these days for small shops as it used to, but the overheads are smaller than ever.

                          I'd say the opposite. As the cost of everything else comes down, and the raw cost of AD is climbing (ever so slightly, just a few percentage) both its raw cost and its relative costs are getting worse.

                          What's more, I get the impression that the knowledge and skill necessary to support it are waning. Look at SW, the average person would have been able to deploy AD eight years ago. Today, no way, not the average. It's way too much for the average SMB admin to know how to deploy with any reliability.

                          1 Reply Last reply Reply Quote 1
                          • S
                            scottalanmiller @StorageNinja
                            last edited by

                            @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                            You could push it out with SALT etc, but in a SMB internal staff will not know how to use something like that.

                            Yeah, but you can outsource that stuff to qualified people for a fraction of the cost of AD.

                            S 1 Reply Last reply Reply Quote 1
                            • S
                              StorageNinja Vendor @scottalanmiller
                              last edited by

                              @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                              @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                              CALs are cheap ($50 as a standalone, cheaper if you buy in a pack).

                              CALs are either cheap or they are $50 per user, but they aren't both. For an SMB, $50 per user for no reason is expensive. What do they get from that $50?

                              And that's hardly the full cost... let's look at a ten person business:

                              • Server: $1,000
                              • Windows License: $700
                              • CALs: $500
                              • Windows Pro Upgrades: $1,500
                              • Admin Time to Set Up: 2-5 days

                              That's $3,700 or $370 per user just to set up, plus around half a day of effort, per user to get set up. In many SMBs, it could take a week of effort just to get that kind of spending approved!

                              1/2 a day of effort per user? Explain....

                              1 Reply Last reply Reply Quote -1
                              • S
                                StorageNinja Vendor @scottalanmiller
                                last edited by

                                @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                . let's look at a ten person business:

                                Server: $1,000
                                Windows License: $700
                                CALs: $500
                                Windows Pro Upgrades: $1,500
                                Admin Time to Set Up: 2-5 days

                                With 10 users you could use essentials or foundation edition. I can buy a Dell T130 with that ~$700.

                                1 Reply Last reply Reply Quote -1
                                • S
                                  StorageNinja Vendor @scottalanmiller
                                  last edited by

                                  @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                  Yeah, but you can outsource that stuff to qualified people for a fraction of the cost of AD.

                                  Qualified people cost money 🙂

                                  You ever see a rate sheet for Continuums outsourced India desk?
                                  Good luck finding SALT talents that's cheap (even in Bangalore).

                                  S 1 Reply Last reply Reply Quote -1
                                  • S
                                    StorageNinja Vendor @scottalanmiller
                                    last edited by

                                    @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                    Central authentication, while it does have value, in the SMB seems to be primarily deployed out of confusion, rather than out of solving a problem

                                    The general issue I've seen is a lot of (idM) systems have weird quirks when working with things other than AD. Yes on paper LDAP will work with quite a few I suspect didn't get a lot of QE testing...

                                    I do think (idM) systems and SSO brokers are breaking the final biggest tie of AD (Authentication). Setting up federated services was always a pain in the ass and turnkey SAML integrations for common web apps are a lot nicer to manage.

                                    1 Reply Last reply Reply Quote -1
                                    • S
                                      scottalanmiller @StorageNinja
                                      last edited by

                                      @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                      @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                      Yeah, but you can outsource that stuff to qualified people for a fraction of the cost of AD.

                                      Qualified people cost money 🙂

                                      Unqualified people cost way more, though.

                                      1 Reply Last reply Reply Quote 1
                                      • S
                                        scottalanmiller
                                        last edited by

                                        Hey look, as soon as we say AD is easy, someone posts on SW that they screwed up their little AD install, again. We get these like once a week, maybe every two weeks. For SMBs, even what should be a trivially easy single server AD install is regularly a major problem. Just picking a domain name is beyond the common skill level. People don't get tripped up by advanced AD techniques, they are regularly stumped by just the most basic install process.

                                        S 1 Reply Last reply Reply Quote 3
                                        • S
                                          StorageNinja Vendor @scottalanmiller
                                          last edited by

                                          @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                          Hey look, as soon as we say AD is easy, someone posts on SW that they screwed up their little AD install, again. We get these like once a week, maybe every two weeks. For SMBs, even what should be a trivially easy single server AD install is regularly a major problem. Just picking a domain name is beyond the common skill level. People don't get tripped up by advanced AD techniques, they are regularly stumped by just the most basic install process.

                                          If you can't figure out that you should use a domain you own, you shouldn't be setting up a cloud SSO deployment either...

                                          S 1 Reply Last reply Reply Quote -1
                                          • S
                                            scottalanmiller @StorageNinja
                                            last edited by

                                            @storageninja said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                            @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

                                            Hey look, as soon as we say AD is easy, someone posts on SW that they screwed up their little AD install, again. We get these like once a week, maybe every two weeks. For SMBs, even what should be a trivially easy single server AD install is regularly a major problem. Just picking a domain name is beyond the common skill level. People don't get tripped up by advanced AD techniques, they are regularly stumped by just the most basic install process.

                                            If you can't figure out that you should use a domain you own, you shouldn't be setting up a cloud SSO deployment either...

                                            Agreed. Wouldn't suggest that either.

                                            Reid CooperR 1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 2 / 4
                                            • First post
                                              Last post