When do you need AD?
-
@scottalanmiller said:
@JaredBusch said:
@Carnival-Boy said:
Don't you use AD to control access to your cloud applications? Or if you don't, how to do you control and secure multiple cloud applications other than having to have a different user account and password for every application you use?
Very little in the SMB space authenticates to AD. Not even Office365.
Office 365 does.
Office365 can integrate with AD, I never said that it did not. I said SMB did not. That said, I just checked again and the recently added Medium business plan under the SMB section of Office 365 does offer AD integration.
But my point still stands that it is a complete waste of money. You have to use DirSync and that means a minimum of two servers. One server to be the DC and a second server to run DirSync. Which means, no, you should not have AD in the SMB that is completely hosted.
-
@JaredBusch said:
@Carnival-Boy said:
Don't you use AD to control access to your cloud applications? Or if you don't, how to do you control and secure multiple cloud applications other than having to have a different user account and password for every application you use?
Very little in the SMB space authenticates to AD. Not even Office365.
Some do use AD to authenticate to Office 365 using DirSync. It makes it a bit simpler for the users to have only one password for both their computer and their email.
It really comes down to a couple points. The first is topology. If it's a distributed environment with hosted resources, AD makes less sense, as it would require VPN (DirectAccess or otherwise) to manage the computers properly. The second point is the tech prowess of the user base. If they're good at taking care of their endpoints, AD's less of an issue. If they need help with passwords frequently and otherwise neglect their endpoints, AD's the way to go.
Edit: Jared gave more detail before I could post this. Friends don't let friends use O365 SMB tenants.
-
@JaredBusch said:
@scottalanmiller said:
@JaredBusch said:
@Carnival-Boy said:
Don't you use AD to control access to your cloud applications? Or if you don't, how to do you control and secure multiple cloud applications other than having to have a different user account and password for every application you use?
Very little in the SMB space authenticates to AD. Not even Office365.
Office 365 does.
Office365 can integrate with AD, I never said that it did not. I said SMB did not. That said, I just checked again and the recently added Medium business plan under the SMB section of Office 365 does offer AD integration.
But my point still stands that it is a complete waste of money. You have to use DirSync and that means a minimum of two servers. One server to be the DC and a second server to run DirSync. Which means, no, you should not have AD in the SMB that is completely hosted.
One Windows license gives you two VMs though. So that works out.
-
@scottalanmiller said:
One Windows license gives you two VMs though. So that works out.
I agree with that statement, but the point of the original question was whether or not to keep AD when there was no other use for an on site server. Thus my answer of no, do not keep AD as it is a waste of money. The offset to that is how much time (and thus money) do you think having AD can save by giving you GPO and such.
-
You're right. If everything is cloud based, there is little point in having AD. However, I've never come across an SMB that is in the position of having nothing on premise. Maybe in a micro-business, but any company with 30+ users I would expect to continue to need AD for some years. If a company was in that fortunate position, I would definitely go with Google Apps rather than O365.
I actually posed the same question on Spiceworks a couple of years ago, when I wrote "I'm starting to imagine what life would be like without Active Directory. I'm not there yet, but I can imagine it happening sooner rather than later." Two years on and I'm not really any closer.
I was more thrown by your statement "Very little in the SMB space authenticates to AD. Not even Office365". I can't imagine having to support two user databases, one in AD and one in O365. That sounds like a nightmare to me.
-
NTG's actually a good example of a company that doesn't need AD. Everything's handled via Office 365, and the end users are more than capable of caring for their devices.
-
Along the same lines of this discussion - and I'll create a new one if needed - What do you do about shared files?
I looked into what it takes use OneDrive for Business as a sole shared 'network' location for files - man it didn't go well. I have a requirement of still using locally installed Office apps, not web apps.
-
Interesting. What problems did you have?
-
@Carnival-Boy said:
I was more thrown by your statement "Very little in the SMB space authenticates to AD. Not even Office365". I can't imagine having to support two user databases, one in AD and one in O365. That sounds like a nightmare to me.
Why is this hard to imagine? In my experience, very few applications used by an SMB tie in to AD. Generally, the biggest thing an SMB uses AD for is file share permissions followed by their email (Exchange). Generally these SMB have/had a SBS server. The next biggest thing I see AD used for is the accounting package, if it is beyond just QuickBooks.
From the IT side of the house, yes, there are many more uses of AD. But IT is an money black hole to most SMB owners (wrongly I might add, but still their opinion). So it becomes the job of the IT person to prove the cost effectiveness of having things like WSUS, GPO, etc.
-
Jared, what would you replace WSUS and GPOs with?
-
@Carnival-Boy said:
Interesting. What problems did you have?
I couldn't figure out how to save a newly created file directly back to Onedrive for Business, nor did I see how to share the files easily like my current local server based S: drive.
Granted I only spent about 20 mins working on it with a customer looking over my shoulder.
-
@Dashrender said:
I couldn't figure out how to save a newly created file directly back to Onedrive for Business, nor did I see how to share the files easily like my current local server based S: drive.
Granted I only spent about 20 mins working on it with a customer looking over my shoulder.
When you hit save as, you just pick the OneDrive location. If you don't have Office 2013, then you can find the OneDrive in the Favorites in windows 7 unless it was manually removed. If it was then it is in %HOMEPATH%
-
@Dashrender said:
Jared, what would you replace WSUS and GPOs with?
That comes down to the size of the business and what other things you have on the machines. Something like GFIMax will help with some of it. I personally would prefer to keep AD, but when it means you are buying a server and Windows Server license and setting up 2 VM's jsut for AD so you can have WSUS and GPO the cost/expense numbers get skewed.
-
@JaredBusch
You're saying two VM's because of the sync for O365, right? Otherwise you'd only need one.And in a situation where all of your other services are cloud based - the desktop model servers from HP are extremely inexpensive, so the cost is really not that bad.
-
I couldn't get a save as option like yours.. but again i haven't worked very hard on it yet.
We're on windows 8.1 for the testing I was doing if that make any difference, with Office 2013.
-
@Carnival-Boy said:
You're right. If everything is cloud based, there is little point in having AD. However, I've never come across an SMB that is in the position of having nothing on premise. Maybe in a micro-business, but any company with 30+ users I would expect to continue to need AD for some years. If a company was in that fortunate position, I would definitely go with Google Apps rather than O365.
I actually posed the same question on Spiceworks a couple of years ago, when I wrote "I'm starting to imagine what life would be like without Active Directory. I'm not there yet, but I can imagine it happening sooner rather than later." Two years on and I'm not really any closer.
I was more thrown by your statement "Very little in the SMB space authenticates to AD. Not even Office365". I can't imagine having to support two user databases, one in AD and one in O365. That sounds like a nightmare to me.
Most businesses, even the Fortune 100, have multiple user databases. Often many. SMBs are not well prepared for SSO. I'm not sure that I've ever worked anywhere with a single user database. And obviously anyone using Spiceworks has to have two or more.
-
Is SSO even something that is truly real?
I use Lastpass - for webpage it simulates SSO, but it's obviously not really SSO - it simply helps me with username/password management.
Am I correct in thinking SSO solutions do the same, when they work?
-
@Dashrender said:
Is SSO even something that is truly real?
SSO's real. In its purest sense, it's connecting systems together for authentication without further user interaction. An example would be using ADFS to facilitate a seamless login into a partner's extranet or binding Samba to LDAP. A step down is like DirSync where it synchronizes the second system's credentials with the first, allowing users to use the same user and password, even though each system is its own login.
The kicker is that some compliance needs prevent use of SSO for fear of a single username/password allowing for an attacker to be able to access nearly any system.
*Edited for spelling
-
@Dashrender said:
Is SSO even something that is truly real?
Very real and quite common. All larger firms I've worked with use them.
-
I suppose another form of SSO is Facebook/google/microsoft live (or whatever they are calling it today) logons... a single logon that allows a user to bounce from system to system.
Clearly I'm working in the wrong environments as I've never seen this outside of the above mentioned items.
