Hacker News Reader

Comment by jmj42 | Hacker News Reader

I've worked in IT for more than 15 years. More often than not, Microsoft's enterprise products do "just work." In fact, due do volume pricing (making server 2008/2012 licenses very cheap), around here I recommend Server 2012 w/ standalone LDAP role when people need an LDAP server. Why? Because it just works.

An a related note, I, too, am in the process of building a new video management system based on windows (why anyone would want to sit and stare at solar PV panels all day is beyond me). Install and set up has been a breeze.

Don't get me wrong, I'm more likely to use linux for things. Most of my development is done on linux, our video wall display management, AMI emulation platform, any many other tools and utilities, but MS does have its place, and where it fits, it usually beats everything else in set up configuration and management.

View on HN

Have you ever had Active Directory go sideways? I mean, really badly? In a large (100+ employee) setting? If not, please don't say "it just works", especially when you're calling to get "enterprise support" from Microsoft and not even the engineer you're on the phone with can explain why your configuration is failing.

Microsoft might have had its place. On the desktop. 5-10 years ago. But for environments where you need uptime? No. No. No.

EDIT: With regards to your video management system, does it have to be broadcast grade? Mine does. The FCC doesn't let you explain away fines for not being on the air "because the Windows box crashed".

100+ Employees? Well, my current environment is about 500,000 users across 3 campuses, and 4 domains. Throw in federated authentication (shibboleth), custom apps, *nix auth, etc.

With that in mind: It just works!

With any large deployment (100 users isn't large) there are bound to be difficulties. That isn't the exclusive realm of Microsoft. As mentioned elsewhere, have you ever done a large deployment of kerberos? I have. I'll take AD on the infrastructure side any day. "Sideways" AD is a whole lot easier to manage than a sideways MIT Kerberos5 KDC.

Microsoft does have its place. In the enterprise, in the server room, today.

Agree'd.

Anyone who doesn't agree, hasn't tried to setup the Kerboros LDAP crap on Linux.

Kerberos and LDAP are two different things. You are aware Active Directory is just LDAP with extensions, correct?

Not really. AD is krb5 mutual auth backed by an LDAP datastore. LDAP is also used for storing various bits of other metadata. You can (with much pain and sadness) implement a AD-like system using MIT Kerberos5 and OpenLDAP (I've done it)

In fact, even saying that the LDAP portion is extended is a bit misleading. In fact, AD implements a fully compliant LDAP interface. It does lack the more common LDAP Schemas (though they can be installed if you wish), and relies on a schema that MS developed, but the LDAP server is not, itself, extended.

Reply on news.ycombinator.com