There are other annoyances though. My current ones are:

- Apple Kerberos does not support MS-KKDCP and multiple factor auth. Services that require Authentication Indicator are simply not available from macOS. Their Ticket Viewer is even more simplistic than in 10.6 timeframe.

- Their IPSec implementation is weird and haven't managed to make it work with Strongswan yet.

> Oh yeah, and you don't have to be afraid an OS update will make your laptop unbootable. Has happened to me under Ubuntu twice.

Just wait, sometimes it happens there too. There's a reason for that recovery partition.