@Psymon
> Lets imagine (just drawing from my own experiences) you have a very IT illiterate accountant
> in Sweden only a year or so away from retirement, who becomes almost incapable of using his
> system if the start menu is changed from classic view to XP, let alone if the entire desktop is
> changed, along with all his office apps. It's made very clear to you re-training is not an option,
> and you are under severe pressure from his MD that his workflow can NOT be interrupted.
You can theme any desktop to look just like what he's used to.
You probably won't find that work already completed, because most users don't want it. But it's possible - and you are given all the tools and rights to do it if you think it's worht the effort.
> Active Directory is an incredibly powerful and flexible implementation of LDAP, and from what
> I’ve read, has in recent years become significantly more advanced than its’ Linux alternatives.
No, I wouldn't agree with that. What AD does best is to lock out competitors; from a directory perspective, there are several equally good alternatives.
> Before I get shouted out, let me explain. Security groups within Active Directory aren’t just
> limited to the file system. They play an integral role throughout. My reason for suspecting the
> advantage is in the MS court is down to their implementation of Kerberos.
Kerberos exists in many situations - MS didn't invent it. Their implementation is somewhat difficult to use outside Windows because of their PAC getup - but Samba now uses that happily.
What you don't really get yet is the ability to use Linux as an AD controller - that requires Samba 4, which is only in technology preview so far. But it's looking stable, and it's very nearly feature-complete (actually, it's some weeks since I last downloaded it; I'll have to see what's been added lately).
> Kerberos is an extensible protocol, yet only MS have extended the tickets to include security
> group information.
If you can do it in Windows, you can do it in Linux - with the temporary exception of being the DC I mentioned above.
> This allows security groups to define permissions universally throughout all the server/client
> features.
Yes. Linux has been doing that for years.
> I’m not going to go into further details just yet, as I’d like to hear about the Linux equivalents
> first before drawing comparisons.
If you're doing a greenfield rollout, you've got choices like RHDS. If you're already in an AD environment, you'll probably want AD.
> I’m sure we’ve all issues with this within our infrastructures, but I can’t help come to the
> conclusion that these issues are greatly amplified on non-windows environments.
I rarely see real problems with that - I see people who *demand* Outlook, and insist on doing the "I told you nothing else would do" thing when they finally get it (after I've given them Evolution)/ I see people who *demand* Photoshop, as nothing else will do - until they see the bill, and then realise that Gimp does actually do everything they need and more.
I hear *thousands* of stories about how Linux doesn't have sufficient driver support, yet Windows "just works" - this from people who need their Windows boxes sorting out because it doesn't "just work" unless you get a professional to hide all the work first. And hardware support - I've had better support on Linux than on Windows for quite some time now.
> As admins we know that we don’t always get a choice in the software that gets used on the
> client desktops, and the larger the infrastructure, the less likely our choice will count.
If you really are forced to use a particular piece of software, and that piece of software really does force a particular platform, then the choice is moot. But in practice, I find people ask for the software they've been conditioned to ask for - not the one they need.
> Any success/horror stories?
Plenty of success stories. The only real problem I had was with a Freecom USB DVB-T stick, where they changed the chipset without changing the part number. One quick email to the chipset manufacturer, and I had a GPLed driver sent to me.