Hacker News Reader

Serious question - what does AD do that OpenLDAP (or similar) doesn't?

LDAP is just one component of AD - which also integrates kerberos and ssl and the management gui, and years of windows-specific documentation/knowledge/etc.

The main thing is - if you are in the microsoft ecosystem enough to be seriously using AD - you use AD. Microsoft IT is its own world.

It is also doing a lot with DNS and device management via group policy and is one of the only 'it just works' high-availability services I've ever used. Making a new node is usually as easy as doing a dcpromo and logging out.

You can replicate a lot of it in *nix but I've never seen anything as cohesive as a windows domain controller.

I think the only windows services I 100% would give a thumbs down to is websites (I do not like IIS) and print management.

Keberos integration for SSO, Group Policy Objects (GPO) -- which is a big one in my opinion; you need to script or orchestrate things to replicate that -- built in DNS and DHCP, cert stuff, and a lot of domain-forest relationships

Reply on news.ycombinator.com