What is Active Directory?
Microsoft’s Active Directory (AD), not to be confused with AD CS, is a server-based technology used to manage computers and other devices on a network. It used to be essential for controlling large numbers of Windows machines on a LAN, and it’s still a primary feature of Windows Server (an operating system that runs both local and remote/cloud servers.) AD provides a means to control object-based policies for managing network hardware, resources and virtual resources, user permissions, and more.
One of the most important functions of AD is setting user permissions. Active Directory allows admins and IT professionals to create and manage domains, users, and objects within a large network. This can play an important role in security (particularly the principle of least privilege), as an admin can create a group of users and limit their access privileges strictly to what’s required for completing their work.
Active Directory is often looked at when a network grows and large numbers of users must be organized into groups and subgroups, with access control set at each level.
Learn how to easily manage Active Directory users and servers
History of Active Directory
Originally, Active Directory was a network operating system built on top of Windows 2000. Its design was heavily influenced by the emerging Lightweight Directory Access Protocol (LDAP), an open standard for NOS functions that came into the spotlight in the 1990s.
AD came about after Microsoft’s “LAN Manager,” which is where the domain concept was first introduced into Windows server management. Windows NT was based on LAN Manager architecture, which carried with it certain scalability and group management limitations that Microsoft was later able to eliminate with Active Directory.
How to use Group Policy for remote AD management
Group Policy is an easy way to configure computer and user settings on computers that are part of the domain. To use AD for setting such policies, there must be at least one server with the Active Directory Domain Services installed. Group Policy is used by system administrators to centralize the management of computers on their network without having to physically configure each computer one by one. Historically, management of a large Windows-only network would be almost impossible without using Group Policy.
How to manage Active Directory remotely
Active Directory can be managed remotely using Microsoft’s Remote Server Administration Tools (RSAT). With RSAT installed, IT administrators can remotely manage roles and features in Windows Server from any up-to-date PC running Professional or Enterprise editions of Windows.
Is there a Web interface for Active Directory?
Windows Server 2008 R2 and later includes Active Directory Web Services (ADWS). This Windows service provides a Web service interface to Active Directory domains, Active Directory Lightweight Directory Services (AD LDS), and Active Directory Database Mounting Tool instances that are running on the same server as ADWS.
Cloud-hosted Active Directory
Azure Active Directory (Azure AD) is Microsoft’s cloud-based version of the original AD. Azure AD has all of the expected features, including identity and access management services. This is the most important feature for most admins because it allows them to control employee sign-in and govern their access to internal resources and directories.
There are some potential performance benefits to running Azure’s cloud-hosted Active Directory. Traditional AD is often demanding on network hardware, and cloud-based Azure AD puts less hardware demand on domain controllers. Azure AD vs Active Directory goes into more detail about the differences between these active directory solutions.
With so much attention shifting from hardware to the cloud, Azure AD is Microsoft’s attempt at bringing their workhorse networking management technology up to speed. We will discuss Microsoft’s decision to leave behind its outdated lock-in strategies in a moment.
Azure Active Directory user management
Transitioning a business to the cloud is more involved than just moving servers, applications, websites, and data from one place to another. IT professionals must think about how to secure those valuable resources, manage and organize authorized Active Directory users, and ensure that privileges are properly restricted. Security is always complex, even in a cloud environment.
Access must be controlled centrally, and admins must provide a definitive identity for each user that they use for every service. Controls must be in place to ensure employees and vendors have enough access to complete their jobs — and no more. When an employee leaves the organization, the admins must make sure that their access is removed entirely.
Azure Active Directory is meant to help with all of these tasks. As an identity and access management service, it offers features like single sign-on and multi-factor authentication, which Microsoft notes can help protect organizations against 99.9% of cybersecurity attacks.
Learn how to easily manage Active Directory users and servers
Can we move Active Directory to the cloud?
This question comes up quite a bit lately due to the increase in remote workers and a long-term (and still unpredictable) shift to a “new normal” where many employees may continue to work from home on a regular basis. The technology trend is to move everything possible to the cloud — which includes moving the capability to manage technology to the cloud, as well.
That said, it’s just not that easy to move AD to the cloud. It’s certainly not a few migratory button clicks, especially if you expect it to function properly (which you do).
Microsoft Active Directory is stuck on-premise because the opportunity for using AD as a lock-in strategy was too good to pass up (this is pretty much driving the push for Azure AD, as well).
When AD first hit the scene, the computing world was already 90%+ Microsoft Windows. Office and Exchange made the near-monopoly even stronger, and then Active Directory put the final touch on their lock-in strategy. What better way to keep customers than to make it nearly impossible to leave?
Though Microsoft is taking a similar route with Azure, they also seem to understand that IT organizations want to avoid being locked into anything. That doesn’t mean that IT professionals don’t see the value in Microsoft solutions (see Office 365), it just means that admins recognize a need to be flexible and agile. They want to be able to choose what works best for their needs, even if that means not Active Directory.
Active Directory: Buy vs. build
For most IT professionals and network admins, this isn’t much of a question. It really boils down to this: Are you going to purchase, build-out, and maintain your own system of domain controllers… or would you prefer to simply invest in Azure?
It goes without saying that the full functionality of Azure Active Directory would be costly to reproduce — though simple account management functions would be simple enough for many IT teams to put together in-house. Still, that route leaves a lot of features unaccounted for.
Connect to Active Directory Remotely using NinjaOne
If you are using AD in your network environment, you will be glad to know that you can use NinjaOne’s remote access capabilities to manage it remotely from a web-based interface.
Doing so is simple: Just use NinjaOne to remotely access your Active Directory domain server, then fire up the Active Directory management tool as you would normally.
That said, it’s important to note that Active Directory is no longer floating in a blue ocean. There are quite a few alternative solutions to accomplishing what AD sets out to do — many of them with more flexibility and more features.
For example, NinjaOne itself offers more functionality for some of the things you would use AD for. First and foremost, you’ll find that managing large numbers of machines that are not Windows-based is infinitely easier Even Azure AD doesn’t play nicely with Linux or Apple.
NinjaOne is also easier to use for patching critical updates. With AD, you can set a group policy for Windows updates, but not other important software on the network. NinjaOne allows you to set, schedule, and execute updates for more than 135 popular third-party applications.
AD is also better suited for LANs rather than distributed networks (that’s what it was originally built for). NinjaOne has no such limitations. There are also performance improvements to consider, as NinjaOne doesn’t carry the resource overhead or domain controller requirements of Active Directory.
Looking beyond Active Directory to modern management alternatives
It’s incredible to think that Microsoft introduced AD more than 20 years ago. IT management needs have obviously evolved radically since then, yet many IT teams still rely on it. Despite helping their organizations and clients navigate digital transformation, it’s a bit of a case of “the cobbler’s kids have no shoes.”
Recently, we hosted our Adapt IT virtual summit as a chance for MSPs and IT pros to discuss the challenges and opportunities for moving beyond legacy solutions and embracing more modern approaches to IT management, security, and support. The session below focused on exploring modern “domainless” alternatives to AD and LDAP, specifically.
You can get access to the rest of the Adapt IT sessions on-demand here.
