Is OpenRSAT ready for production with Samba AD?

[SlyDerHai]

Hello,

We are currently working on reducing our dependency on Microsoft products wherever practical. As part of this strategy, we have been following the OpenRSAT project for quite some time with great interest.

The project has made impressive progress over the last releases, and we are now wondering whether it has reached a point where it can be used in production environments.

Our environment is based on Univention Corporate Server (UCS) using a Samba Active Directory Domain Controller.

Would you currently recommend OpenRSAT for production use in such an environment for user and group administration? If yes, which modules do you consider stable today?

In particular, we are interested in the maturity of:

• Active Directory Users and Groups (ADUC)
• Group Policy Management (GPO)

Would you recommend either of these modules for daily administration in a production environment today? Are there any known limitations we should be aware of?

Thank you very much for your work on this project.

[osvegn]

Hello,

Thanks for your interest in OpenRSAT.
As you may know, reducing Microsoft dependency in Active Directory environment is the primary objective of OpenRSAT.

Our environment is based on Univention Corporate Server (UCS) using a Samba Active Directory Domain Controller.

I've never heard of this linux distribution. I would say, OpenRSAT is available for any linux distribution with a desktop environment.
It works well with both Microsoft Active Directory and Samba Active Directory.

Would you currently recommend OpenRSAT for production use in such an environment for user and group administration?

This question concerns the ADUC (Users and Computers) module. Yes, this module is stable and production ready.
You can easely manage users, computers and groups with this module, without any trouble.

If yes, which modules do you consider stable today?

I will answer module by module:

• ADUC (Users and Computers) is stable and can be used in a production environment.
• ADDNS (Domain Name System) only provide a basic usage. You can view zones and records, create and delete new zones and records, but not all records are yet supported for creation. However, if you have a lot of dns entry, OpenRSAT is way faster than Microsoft DNS Console.
• ADSS (Sites and Services) only provide a basic usage. A lot of features have been recently added. So it is not yet stable and production ready, but it is on the good way.
• GPO (Group Policy Object) are not yet available in OpenRSAT. You can only enable, enforce, or disable GPO in the ADUC module, but there is no gpo editor in OpenRSAT. It is planned to add it, but it is not our priority, because it is a complex part of the project.

Would you recommend either of these modules for daily administration in a production environment today?

I would say yes, OpenRSAT is ready to be used to daily administration tasks, such as managing users, groups, computers, dns records, dns zones, sites, sites links, subnets.
Let me know if you think about other daily usage you need that I didn't talked about.

Are there any known limitations we should be aware of?

OpenRSAT is not a full replacement for every Microsoft administration console. It is focused on daily AD administration workflows.
For all other tasks, the samba-tool command line is very powerful to manage a Samba Active Directory.

If you have any question, feedback or suggestion, let me know. I hope OpenRSAT will fit your strategy.

[SlyDerHai]

Hello,

thank you very much for your detailed and very helpful answer. I really appreciate the time you took to clarify the intended usage and the current scope of OpenRSAT.

Group Policy management is a key component in our environment, but I fully understand that this is a complex area that cannot be implemented quickly or trivially. It is clear that this requires significant effort and careful design.

We are nevertheless very happy that this project exists and are following its progress with great interest. We are especially looking forward to the point where we might be able to use it in production and potentially reduce our reliance on dedicated Windows administration workstations that currently only exist for RSAT.

Thanks again for your work on this project and for the transparency in your answer.