Jump to content

Alternative to Active Directory server

BistTech
 Share

Recommended Posts

BistTech

BistTech

Posted
Posted

Hey All

 

Any ideas how to secure the network and manage different user groups without setting up an AD server?! I'm struggling to secure the funds from the boss...who thinks Google is a solve-all...can it be? And still allow for robust network management? If so, how?!

 

Any advice would be great - thanks!

fiza

fiza

Posted
Posted
Hey All

 

Any ideas how to secure the network and manage different user groups without setting up an AD server?! I'm struggling to secure the funds from the boss...who thinks Google is a solve-all...can it be? And still allow for robust network management? If so, how?!

 

Any advice would be great - thanks!

How are your users logging on? Do you have a windows environment and they are all standalone machines, no domain?

rogerdnixon

rogerdnixon

Posted
Posted

Well, you could go entirely G Suite and ChromeOS - them you don't need AD - all cloud managed. We are mainly ChromeOS and management od 1000's of uses and devices is pretty easy. More and more schools are going this way, either fully or partially. However, we still have local AD for PCs and some local services - but long term the plan is to gradually retire these or convert to Cloudready. So it can be done - just needs a change of mindset by the school.

 

Another alternative would be to switch to Linux - but you are still going to have local VMs for authentication etc. ClearOS is a friendly server distro - you can setup a file server, authentication server, groups etc all in a nice web GUI or web host it all.

BistTech

BistTech

Posted
  • Author
Posted

Fantastic ideas - thank you.

 

We are currently entirely Windows based on the server and clients. I have inherited a shambles tbh... The previous Network Manager had cobbled together various kit over 5 or so years as the school grew but it was a mess. Even our Finance Manager didnt have a password on her machine... Crazy stuff... I have rebuilt the network keeping Windows Server 2012 and Windows 10 on laptops and rare desktops. Google authentication was used via PfSense... But it was causing many problems. Perhaps I could reinstate it, but reconfigured.

 

As I am also The Comp Sci teacher, I need a time saving solution for management of all clients... I've spent all summer doing the network - and trying to solve the most absurd SIMS and Solus3 issues that Capita still havent solved after 7 hours on the phone and remoting-in to our server... I need to get the new lessons planned...

 

So any time saving ideas would be fantastic. Thanks again.

Ditto

Ditto

Posted
Posted

@BistTech - welcome to Edugeek!

 

We started out GSuite and Chromebook only. We had some PC's and laptops for staff, but not many. Eventually a Windows network and server with AD et al was bought to provide login security to those Windows devices as there was none previously (there were Post-it notes with Admin passwords stuck to them!). The pressure to have MS Office was a factor. Conversion of Word and PowerPoint documents was a contributing factor for some staff. The issue was generally where a pre-existing document from say TES resources or Twink didn't convert well. We now have an 'IT lab' with Windows PCs. One year after installation, only a small percentage of pupils have a Windows user id (GCSE computing only), the lab use is minimal, we have no synchronisation between the Google user and Windows user accounts.

 

I still believe it's possible to have a largely GSuite and Chromebook environment and if you really need desktops, why not chrome boxes. What I think you need to ensure amongst many things, are:

 

i) get SLT buy-in to the move knowing there will be challenges to overcome - as @rogerdnixon says, you've got to win the mindset change first

ii) a toughness and commitment to move away from Windows/MS Office except where it is 100% essential (e.g. I think we have no alternative to the software that downloads the EDI exams data.

iii) for ii), support/train the staff to make that transition

iv) make sure your internet and Wifi are up to the task

 

You might want to consider working with a GSuite partner expert - someone like Haptic Networks but there are others. It must be nigh on impossible teaching and being the network administrator.

I can vouch from personal experience that the centralised Chromebook device management is a great way to work.

 

On the SIMS issue, I'm afraid as a progresso user, I can't help, but start another thread with the details and I reckon there is a good chance someone can help quicker than the support desk.

 

On the Google authentication and use of PfSense, I'm not sure I follow - could you explain a little more?

3s-gtech

3s-gtech

Posted
Posted
If you have a copy of Server 2012 licensed, you can use AD without any need for further funds. As for time saving - AD is pretty quick to piece together, even if fine-grained GPO tuning is not. What else is your server doing?
mavhc

mavhc

Posted
Posted

For those who don't like the MSOffice > GDocs conversions, just signup for Office365 as well as use the online Word/PP/Excel

 

But I suggest you add Active Directory to your Server 2012, and then join the windows machines to the domain, you already have everything you need. Then you can deploy software with GPO, and configure everything.

 

Then sync AD to Office365 and GSuite, 1 login, passwords synced. Add a user in AD and they automatically have a MS and Google account created

Ditto

Ditto

Posted
Posted

Unfortunately the ship has already left port and the school has bought a site license including Desktop Office. I guess when the renewals come through with a 20% price hike they may think again. For us the GSuite users are a superset so we want to sync the other way. I know it's possible, just not as easy as synching the other way. Out of interest, does the Office365 hit limitations when compared to desktop version?

However, going back to what the OP said, I think he's looking for less work and how to move away from AD and @rogerdnixons suggestion of uniquely GSuite/Chromebook achieves that.

mavhc

mavhc

Posted
Posted
Use Microsoft Intune and abandon your AD if you want to stick with MS? Why bother with onsite servers?

 

That's what MS wants you to do, but it's very expensive, why pay per device per month when you can pay once for a server?

BistTech

BistTech

Posted
  • Author
Posted

Guys - you're incredible - thanks for all the ideas - I'm concerned about the server capacity as it's old and running SIMS, so perhaps we should invest in a new server - although I was hoping to keep costs down.

 

Perhaps I should have said that I'm in Africa, with limited tech support, so I'm looking for the most simple solution which is easy for new Network Manager to oversee, once I manage to recruit!

 

Our 'net connection can be a bit dodgy, so I'm reluctant to base the network on Google even while the Head has pushed for everything to go G-suite... We do use Drive extensively and collaborate, but when the 'net connection goes, the school is in chaos!

 

Would anyone mind offering your recommended minimum spec for a new AD server to accommodate the following, including a mirrored drive? One IT lab with 30 new PCs, 60 laptops, 5 desktops, all on Windows 10.

Storage per student required:

[TABLE=width: 350]

[TR]

[TD]Year Group

[/TD]

[TD]Storage

[/TD]

[TD]2018/2019 Student Qty

[/TD]

[/TR]

[TR]

[TD]EYFS1

[/TD]

[TD]100MB

[/TD]

[TD]14

[/TD]

[/TR]

[TR]

[TD]EYFS2

[/TD]

[TD]100MB

[/TD]

[TD]26

[/TD]

[/TR]

[TR]

[TD]Y1

[/TD]

[TD]300MB

[/TD]

[TD]34

[/TD]

[/TR]

[TR]

[TD]Y2

[/TD]

[TD]500MB

[/TD]

[TD]27

[/TD]

[/TR]

[TR]

[TD]Y3

[/TD]

[TD]500MB

[/TD]

[TD]37

[/TD]

[/TR]

[TR]

[TD]Y4

[/TD]

[TD]500MB

[/TD]

[TD]28

[/TD]

[/TR]

[TR]

[TD]Y5

[/TD]

[TD]500MB

[/TD]

[TD]28

[/TD]

[/TR]

[TR]

[TD]Y6

[/TD]

[TD]500MB

[/TD]

[TD]23

[/TD]

[/TR]

[TR]

[TD]Y7

[/TD]

[TD]1GB

[/TD]

[TD]24

[/TD]

[/TR]

[TR]

[TD]Y8

[/TD]

[TD]2GB

[/TD]

[TD]16

[/TD]

[/TR]

[TR]

[TD]Y9

[/TD]

[TD]3GB

[/TD]

[TD]16

[/TD]

[/TR]

[TR]

[TD]Y10

[/TD]

[TD]5GB

[/TD]

[TD]19

[/TD]

[/TR]

[TR]

[TD]Y11

[/TD]

[TD]5GB

[/TD]

[TD]19

[/TD]

[/TR]

[TR]

[TD]Y12

[/TD]

[TD]5GB

[/TD]

[TD]19

[/TD]

[/TR]

[TR]

[TD]Y13

[/TD]

[TD]5GB

[/TD]

[TD]19

[/TD]

[/TR]

[TR]

[TD]

[/TD]

[TD]

[/TD]

[TD]349

[/TD]

[/TR]

[/TABLE]

 

Thanks again

Ditto

Ditto

Posted
Posted
Our 'net connection can be a bit dodgy, so I'm reluctant to base the network on Google even while the Head has pushed for everything to go G-suite... We do use Drive extensively and collaborate, but when the 'net connection goes, the school is in chaos!"

 

You sound like you have the perfect setup to comment on whether GSuite can be successfully used offline. I've had tentative discussions with the school that I'm a governor at to at least look at cloud solutions, but they are a bit stuck in the rut of 'Oh, but what if there's no internet! Have you ever taken a look at whether you can really work offline? I'm aware of a couple of links that talk about this, but haven't really tried to simulate internet connection loss.

 

https://support.google.com/a/answer/1642623?hl=en

https://www.cobry.co.uk/2018/04/g-suite-offline/

mavhc

mavhc

Posted
Posted

Seems easy to test, turn off wifi, see if it works.

 

As for the server the main thing you need is enough ram, cpu is rarely maxed out. After ram you want disk speed, SSDs fix that, but a bit complex on a server, could put the SIMS database on ssd with the OS and keep the files on HDD, do you have more detailed specs of your current server?

AlanD

AlanD

Posted
Posted
That's what MS wants you to do, but it's very expensive, why pay per device per month when you can pay once for a server?

 

Its something like £6 per PC per year. So a good deal less than chromebook ...and for that matter most MDMs....

 

So yes it costs money (doesn't everything)...but I wouldn't have described it as "_Very_ expensive". And if you are using your local server for storage - then presumably you are paying for some kind of backup.....whereas if you also move to using Office 365 (and One drive) you can "recover" files for some time...and don't need to backup any server.

 

So yes - if you use a cheap box, with near line Sata drives, and do backups with window sbackup to a USB drive and don't pay for support on the hardware...it can probably be done for less than the cost of InTune...especially if you have hundreds of PCs....but then you might want something with more performance....

 

We are currently using it for staff laptops only (as users get the same experience whether on or off site....and it provides us with "management rights" over the device - especially ability to remotely wipe hard drive to comply with GDPR...and can deploy MSIs and the like without getting laptops back on site) ....but are minded to roll it out for all our computers.

Ditto

Ditto

Posted
Posted
Seems easy to test, turn off wifi, see if it works.

Indeed, but far better if possible, to learn from a real world situation... and much more persuasive if I can show that a school in Africa is using GSuite successfully with intermittent internet access.

mavhc

mavhc

Posted
Posted
Its something like £6 per PC per year. So a good deal less than chromebook ...and for that matter most MDMs....

 

So yes it costs money (doesn't everything)...but I wouldn't have described it as "_Very_ expensive". And if you are using your local server for storage - then presumably you are paying for some kind of backup.....whereas if you also move to using Office 365 (and One drive) you can "recover" files for some time...and don't need to backup any server.

 

So yes - if you use a cheap box, with near line Sata drives, and do backups with window sbackup to a USB drive and don't pay for support on the hardware...it can probably be done for less than the cost of InTune...especially if you have hundreds of PCs....but then you might want something with more performance....

 

We are currently using it for staff laptops only (as users get the same experience whether on or off site....and it provides us with "management rights" over the device - especially ability to remotely wipe hard drive to comply with GDPR...and can deploy MSIs and the like without getting laptops back on site) ....but are minded to roll it out for all our computers.

 

Chromebook management is £19 for the life of the device, and manages everything

 

100 computers on InTune is £600 per year then. For replacement for remote config, how much does InTune do compared to GPO? Next how do you log in, where are your files, etc?

 

A 100W server is about £100 per year for electricity

AlanD

AlanD

Posted
Posted

Intune just gets added into your Office 365 console. No it doesn't do all that you can do with GPOs. But it might do enough... I'm not saying its the right - or the best solution....but its a solution to consider. I think you can buy life long (..well 5 year) version of Intune licencing...

 

I'd like to say and think that its a glimpse of the future....but Microsoft always seems to dither and lack real commitment when it comes to some new stuff. I wondered if it was their answer to chromebooks sweeping across the USA in schools - and indeed in some UK schools, but playing catchup is not easy unless they have a real vision.

mavhc

mavhc

Posted
Posted

Well, it's Microsoft's version of the future, but there's many other options, the main reason people just stay with MS is legacy cruft.

 

Software is write once replicate for free, paying monthly for it is daft

  • 4 months later...
ReBoot

ReBoot

Posted
Posted
Bit late to the party here. If you can handle a Linux based solution there is Samba 4.

 

https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller

 

This wont cost you any money other than the hardware to run it on (modest) and the time to set it up (depends on ability / knowledge).

 

If you want a Linux/Samba solution I highly recommend the Linux Schools Project

 

https://www.linuxschools.com/

 

I use it in a couple of primary schools and it does everything I need and is a pre-packaged solution for education. Supports zfs RAID which requires no hardware controller and is very intuitive to administer.

AlanD

AlanD

Posted
Posted

I don't think anyone has mentioned Microsoft's MDM - "Intune" which can be used to setup and manage PCs without a AD server in sight.

 

Yes...it doesn't have all the GPO controls of an AD controlled network. You might still want local storage - or install a faster internet service and take the plunge by using online storage....which obviates the need for on site backups (at least to some extent).

 

...I'm not advising this as a solution....heaven only knowns Microsoft could pull the plug on this technology next week … but its a new vision that could gain traction.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...