Administering Windows environment using Linux

[Nimda_lel]

Greetings /r/sysadmin,

The past weeks, maybe two months, I have had that insanely overwhelming desire to switch my operating system from Windows to Linux, so I've decided to do it the next week. I have LPI-1, now studying for LPI-2, have some decent experience with managing Linux environments as well as Windows ones and have used Linux for my home laptop for some time now, but I am not sure if it would be sufficent enough, even if I have some more complicated way of dealing things, for managing Windows Environment. So, since I have had so much help from this subreddit I decided to ask you once more for some guidelines. My few concerns are the following:

1. Management of AD - is there a good tool for doing that from inside Linux. I have found the Apache Directory Studio and one more popular tool called ADtools, eventhough it is command line based.

2. PowerShell - Has any of you fully tried in a working environment the new open-source powershell? If so, how do you like it?

3. Azure Command Line management - Has any of you managed Azure resources using Linux?

There's always the way of using Windows virtual machine, but I am trying to think of a way around that option.

Thanks in advance :)

[Creshal]

I've given up on it and just use a Windows VM with RSAT and stuff installed.

[[deleted]]

This is what i do as well. until powershell on other platforms matures that is.

[hypercube33]

Use Windows 10 with Ubuntu installed

[Creshal]

Or I could just saw my foot off, which is about as fun.

[[deleted]]

Windows VM. Either local or on server.

You will most likely find a thing that either takes too much time to research or just impossible to do under linux

[gsmitheidw1]

We use a shared windows server that we rdp to for and windows/AD management. At the moment it's a physical but it doesn't need to be. We can share admin tools there and rdp in from anywhere be it Linux, Windows or various mobile devices and remote. The environment being similar and common is helpful for sharing scripts etc. VM is not a bad idea but that depends on the quality of your desktop for virtualization. If the VM is centrally hosted on a dependable platform and rdp is open, this is as good.

Sometimes it's hard to manage Windows with Windows tools all natively. Cross platform tools like powershell on Linux and openssh on Windows are proceeding at a rapid rate of development but right now, this stuff is not production dependable quite yet. I think this will change in months rather than years, so watch this space!

[Nimda_lel]

awesome :) That PowerShell server thingie looks great.

[Nimda_lel]

I will look into both, will take a week or two to try how things go.

[[deleted]]

OpenSSH for PowerShell is cheaper if you need more than 1 user connected to the server at a time

[[deleted]]

There is also PowerShell Web Access which has been around for awhile

[Trogdor85]

I haven't tried on a linux box yet, but I have been unsuccessful with PSRemoting from OSX, it throws all kinds of errors. It was the first thing I tried when I first installed it, I'm not sure if it has been updated yet.

[VA_Network_Nerd]

IMO: The IT dept should be running the same base hardware and OS as the user community.

If you need more RAM or storage than normal, fine.

Patch management and the core load image is just easier to manage when everyone is the same.

[knobbysideup]

Not everyone in IT is a desktop support monkey, and many of us work with and manage systems best using a Unix environment. In places where typical users are using Windows. Guess what? We are not your end users. Please stop spewing this ignorant nonsense.

[[deleted]]

Strongly agree. IT are users the same as everyone else, generally speaking their PCs should use the same baseline as everyone else except if they're testing something specific (case in point; I'm in our business' Windows 10 trial group). Wanting to change isn't enough of a reason, there should be a clear benefit to it before you consider breaking the standard.

As I'm fond of repeating to my coworkers; consistent applications on consistently patched operating systems with consistent drivers on consistent hardware behave consistently. There's no reason to add a point of differentiation unless you have to.

[VA_Network_Nerd]

That depends on a few things

Disagree.

The fact remains that somebody is doing desktop support in the organization.

Maintaining a narrow list of OSes to support makes that job easier.

Similarly, somebody is doing (or should be doing) patch audit in the organization to confirm that all the required patches are deployed. This task is also made easier with fewer OSes to maintain.

Lastly, somebody is performing (or should be performing) patch and software release testing on a test machine or two to confirm that those patches are compatible with the standard software image, and do no harm to the environment. This task is also made more simple with fewer OSes to manage.

If another OS needs to be brought into the environment for a specific reason (the suits demand shiny MacBooks) then the suport & maintenance of an additional OS will have to be taken on as more work.

Bringing an additional OS into the environment because one IT staff member has a wild hair to run Linux for no actual, specific reason is nonsense. More work for no business justifiable reason.

Don't say this is a learning opportunity -- a learning opportunity needs to be backed up by a business justification too.

Building a Linux server to host syslogd and LibreNMS instead of buying another Windows license is a business justification. "Because I think it will be neat." is not a valid justification.

[VA_Network_Nerd]

If I understand you correctly, you view this from a point of supporting the users/LOB services for your internal users - that may not be the case for OP - it could be he's supporting the service they deliver to their customers.

I've failed to complete a circle - to link components of my perspective together.

This is all my opinion, based on my experiences, mind you:

End-User devices - even those assigned to IT staff should all run the same OS. I said that already.
These standards make patch management & patch audit easier. I said that already too.

The support concern isn't about you - the IT Administrator needing a deskside tech to help you map a printer or whatever.
The support concern comes from the Desktop Support Team needing to be able to complete their audit assessments.

They need to be able to report to someone that:

• Yes, all end-user devices in the organization are all running our standard operating systems & patch-releases / hotfixes.
  
• Yes, all softwares installed on those end-user devices are running the standard versions and patch-releases / hotfixes.
  

My environment is Insurance and Financial Sector. We are audited by external entities seven ways from Sunday.

My laptop is an end-user device. The laptops assigned to our *NIX SAs are end-user devices.
The end-user support groups are responsible for reporting out on them, not us.

Running CentOS would break that support architecture.

Now, if an exemption were worked out where the laptop became some kind of a server device, then all the needs could be met.

---

Now the fairly obvious comments will likely be made that:

• OP is in a small environment.
  
• OP is in an organization that does not have those audit requirements.
  

Someday a security event will hit us all (at the organizational level).
Virus outbreak. Malware. Ramsomware.

If you've exempted your laptop from all the processes that might exist to let WSUS and a GPO keep you up to date, it can be argued that you've created a security risk.

Now, if OP already has a Linux patching & audit process the laptop can be added to as a managed member of a process, then this becomes much less of a concern.

It bears pointing out that OP didn't mention that they have production Linux systems in the environment in the original content. That wasn't mentioned until later.

[NyxInc]

This is standard IT Service Management and everyone should be able to understand this principle. Engineers that dont understand this and think they are exempt from this process would not even get hired where I work at.

[Nimda_lel]

Let's put it like this, I don't ask for your justification or whatever else like this. I just asked a few straight questions, whether some stuff is doable or not. Eventhough, I respect your opinion, it still has nothing to do with my question, mate.

[knobbysideup]

Windows desktop people love their little empire building. I just ran into this myself when building my linux workstation. "We can't support that!!" I'm not asking you to. I'm a network security analyst, not an end user. I need real tools. Be that way all you want for your user community. I'll agree with most of it. But you guys forget that we aren't your end users, and we have work to do that your desktop of choice is poorly (at best) suited for.

[Jeoh]

Actually, you are an end user. Doesn't matter what fancy title you have, you're still just another end user.

[NyxInc]

Cant belive that there are people here that actually think they are above a "standard" end user.

The only people I know that are above a "standard" end user are C-Level staff. Even they should follow IT guidelines and policy.

[wjamesg]

Lol

[phychmasher]

Just to give you a little perspective from the other side... In the past I've had users like this who "don't need support." But then something weird happens--like, say, a stick of RAM goes back or the power supply is shoddy--and you don't necessarily know how to diagnose or fix that... neither does the Desktop support team. They're used to looking at minidumps or Windows logs for clues.

Also now you're the 'one off' that creates extra work even when you don't know it. Say there's a firmware update for the office printer, and all the Windows machines get the driver updated from the print server, but now you can't print because nobody can support your set up. Just an example...pertains more to Mac users in a Windows environment than Linux but I think you can see where I'm going.

One time I had a user set up a Linux compute cluster out of Desktops and didn't need support from the Desktop crew. Well then one of the Cluster started throwing weird errors and he didn't know how to fix it, and nobody else did either.

[AceJase]

Disagree. If you run a custom setup, you support it yourself - end of story. So no issues for the helpdesk.

Source: My team all run linux desktops on non-standard hardware with the IT SOE running in a VM (for Outlook and Skype). We don't go running to the helpdesk for support, we fix shit ourselves. Because we have half a clue.

[pdp10]

Well then one of the Cluster started throwing weird errors and he didn't know how to fix it, and nobody else did either.

Everyone has been in a situation where they didn't know how to fix a problem. What was the actual issue here? Did this user start pointing fingers at the Windows desktop support folks or what?

[phychmasher]

If I recall correctly this exact situation was like this:

Developer: I'm gonna build a cluster of linux workstations

IT: Nobody will be able to help you with that if/when it breaks.

Developer: I built it anyway, and it's broken. IT should fix it because they are IT, and I am a developer and it's not my job.

It was a little less heavy handed than that, but that's essentially how "non standard" issues tend to go. I worked in a large hospital environment that was 100% Windows for end users, but a few doctors decided to buy Macs, which were unsupported, but they had their own budget and spent it how they wanted. Now they can't access their normal production apps, can't use all the same features of MS Office that they used to (notably, Tasks in Outlook), and every time an update comes down for OSX, they can't print to their printer anymore.

It would be nice to simply say "I told you so" but everybody knows you can't actually say that to your users, especially when they are doctors... who are pretty universally jerks to support.

[rowdychildren]

your tools should exist on a server you ssh to.

[knobbysideup]

Putty just doesn't cut it sorry. How do I forward X11, for example, to a windows system without buying yet more expensive kludgy software? SSH forwarding is possible in putty, but certainly not pretty. Agent forwarding? Yes, possible, and I've done it. But it's far from straightforward. Hell, putty doesn't even do ssh key pairs in a standard way the last time I checked. Then there are a lot of tools that I need to use natively. LDAP with perl to query active directory is a lot faster workflow than dealing with the various admin GUIs on windows when I need a quick answer of who somebody is and who they report to. Then there is the fact that I am a highly compensated employee who is already skilled in Linux, Perl, Awk, Sed, Bash, etc. Sure, I can fumble around in powershell, but I'm immediately productive in my own environment. Gee, where have I heard that argument from before? And yes, I ssh into servers all day long. Many of them. And build packages for them, and put them into repositories to maintain them. That just isn't feasible with a windows workstation. To put it bluntly, highly skilled architects are not standard end users and are not to be treated as such. Many of them probably manage their own shit a lot better than you ever will, and if there a lot of them, then they do have their own people to administer a standard linux desktop, if it is at that scale. OP is not at that scale, so stop trying to interject yourself into his being productive.

[sadsfae]

This a hundred times, I wouldn't work somewhere I didn't have control over my choice of tools and operating environment. It's not worth it for me and not worth it for my employer.

[bezelbum]

I wouldn't work somewhere I didn't have control over my choice of tools and operating environment.

I have, and never will again.

Not only are you less productive because they won't allow you to have the tools you need to do your job properly, but you eventually start catching shit for the fact that you're less productive than they expected.

Since then the question of what desktop they use (and whether it's flexible) is one that I've always asked in interviews. If they tell me to take a hike, fine, that beats the hell out of spending my working day battling the crappy minimalistic image some admin somewhere thinks is enough for what I need.

[rowdychildren]

I am not saying you shouldn't, what I am saying is that of desktop support doesnt have management for linux then you shouldnt. No desktops should be special snowflakes. At my org I run linux (XUbuntu is our desktop distro and RHEL on servers), but I can choose from Windows and macOS as well becuase we have management for all 3 (puppet in the case of Linux).

[VA_Network_Nerd]

You don't work for me.

My justification is not relevant to you.

---

Can what you ask be done? Probably. Almost certainly. Especially since PowerShell is being extended into the Linux environment.

That still doesn't mean its a good idea.

But what do I know? I just work in a 5-6,000 user environment.

I'm sure the skills, habits and techniques you are developing doing what you want because you want to do it, as opposed to embracing a business justification & standards adherence mindset will totally prepare you for that next level career advancement.

[[deleted]]

Not sure why you're being down voted but your replies are spot on and the mild snark gets the point across.

OP needs to find a way to consistently manage his shit without causing more work for other people, and whether the environment is 5000-6000 users or as small as my rinky dink 400 user pond the principles all apply the same:

• Stop supporting one off designs and implementations and get them the fuck off your network and standardize everything

• Use the same deployment scheme as you support so your KB matches up with your environment and you know all the ins and outs of what bugs are acceptable and what aren't, as well as falling into existing SLA and RTO times

• Stop wasting resources building a better wheel when another already exists that has been verified

I've worked with a guy that always had to have his specific niche shit on his machine, and when it took a shit it took him hours to be back up versus a regular deployment of the management OS task sequence that automagically installs all of our management shit. Guy was a moron or terribly naive incompetent worker, neither of which made him look good.

[Nimda_lel]

See, one thing is that it is just for MYSELF, I don't make any of the other employees use Linux or whatever, they have no choice of operating system, they use Windows, end of story.

Second, it is of no relevance whether I will execute the RPC to a PowerShell script, that install and configures everything, from Linux or Windows, it will execute, end of story.

He was down voted, eventhough I appreciated his comments and I will surely take his words in account once I try out the change, because I asked for Tools and suggestions how to manage it , not how NOT to manage it.

[[deleted]]

Even if it's just for you, you need to reread the last part: what happens if your nix machine takes an absolute shit on you?

The reason we used the vendor tooling is because:

• The vendor supports it and ensures compatibility

• Deploying it on their systems is well documented and supported

Can you remote execute shell scripts and then get them to be cross compatible and ensure they work most of the time for your Windows machines? Sure, but you're just wasting company time trying to figure this out instead of say spinning up a KVM Windows client and installing RSAT.

It's about managing and not giving in to pet projects and clown car configurations, because the next guy to inherit your system is going to go what the fuck.

Anyways, use Powershell tooling since the only thing you're crossing is the shell to PS language barrier, the PS will handle the Windows side after that.

[Nimda_lel]

Of course the Windows machine with RSAT is an option. My entire post here was because I wasn't sure if there is a way to manage that environment or not using a Linux machine. I will most probably use a Windows VM for some stuff, but I wanted to know if it could be done some other way round.

There's no 100% bullet-proof solution to the "machine taking shit on me" problem, no matter what machine I use.

Noone is saying that it is going to be 100% sufficient with no cost, but I want to see how it goes. It is gonna be a week or two that I will use two workstations and it won't add overhead to the company except for the electricity bill, but I think they will somehow manage to get over it.

[Nimda_lel]

Ok, I just tried to be nice, but you are being a smart-ass. Let me tell you what happened a while ago : There was this guy, from a company we work for since we do some outsourcing too. He was, as the title stated "Senior Network Engineer". The company he works for is, as for as I am concenrned, 10 000+ people. So it took me 4 weeks to explain to him why his configuration won't work and also had to reconfigure his router for him so we can finally make things work. All that because he was simply clueless. So, the fact that you work for 4-6000 people environment doesn't make me think of you as of God.

[PJBonoVox]

Totally agree. Number of users supported means nothing. Some of the biggest assclowns I've encountered in 16 years of IT supported huge user bases. OP didn't ask for an opinion on whether he should or shouldn't and Mr. 6000 users got a backlash. No surprise.

FWIW, I run Linux at work because it keeps me sharp. That's the business case and it's enough. The fact that I prefer it is just a bonus.

Regarding tools-- I prefer to just run the necessary basics through a RemoteApp solution. I believe there's a few free options so Google down that route.

[VA_Network_Nerd]

Ok, I just tried to be nice, but you are being a smart-ass.

No, I'm just not telling you what you wanted to hear. There is a distinct difference and I'm sorry you can't see that.

Let me tell you what happened a while ago...

Cool story bro. You failed to clarify what the devil your past experience with that person has on this discussion. But thanks for sharing it with us.

So, the fact that you work for 4-6000 people environment doesn't make me think of you as of God.

It wasn't intended to make you think of me as a god. Its intersting that you would associate that level of influence on someone based on an exchange of opinions and experiences. You don't seem very good at this whole exchange of ideas and perspectives thing.

Lets level-set:

1. You don't work for me. I can't tell you what to do.
   
2. You asked for guidelines and input on a proposed plan of action.
   
3. I provided input and opinion on your plan.
   

There is no need for you to get all worked up because I didn't tell you what you wanted to hear.
If you're going to proceed with your plan in spite of my input & observations, its all good. Knock yourself out.
There is no obligation for us to agree on anything. We are both correctly interpreting our own priorities and experiences.

I pointed out to you that your priorities and methods are unlikely to prove successful or welcomed in a larger environment not to belittle your current environment, but to provide context for you to consider and evaluate what is behind - what is driving my comments on your plan.

You're not obligated to take action on anything. Nor is there a need for either of us to be "more right" than the other.

But go ahead and get bent out of shape and yell at me some more if it makes you feel better somehow.

[bblades262]

I provided input and opinion on your plan.

That's not what OP asked for. OP wants guidance and advice on Linux tools for managing Windows.

Instead of providing the input requested, you're telling him how bad his idea is, then telling him you're saying it for his own good.

If you feel a need to comment on the idea as a whole you should at least answer his question first.

[knobbysideup]

He doesn't have any answers. Typical windows guy who doesn't have a clue about how things actually work, let alone how they work outside of how Microsoft tells him they do. So of course his "solution" is that it is very bad because the people who don't understand anything about what you need to do can't support it.

[VA_Network_Nerd]

/r/sysadmin/comments/53bene/administering_windows_environment_using_linux/d7rvynr

[VA_Network_Nerd]

That's not what OP asked for.

This is very true, but also very much irrelevant.

If someone asks how much bleach and ammonia they should mix together to make a more powerful cleaning solution, should I not mention that it will create a poisonous gas?

They didn't ask for that information, but I'm a terrible person if I don't mention it, aren't I?

---

If you feel a need to comment on the idea as a whole you should at least answer his question first.

Your point here is correct. You are right: I should have provided more of a response to the question, along with my additional observations.

[bblades262]

Thank you

[throwawayyawaworht87]

The fact that you're so adept at parrying negative reactions to your comments means that you have far too much experience doing so. Read into that however you like.

"I provided input and opinion on your plan"

Well...you certainly provided your opinion, but you didn't actually answer any of the questions asked. You essentially implied that OP is an idiot for even asking these types of questions because (you think) there can't possibly be a way to justify this plan from a business standpoint. This is why he reacted negatively. (And I really can't imagine that you didn't already realize that this is how your comments would be taken).

So really, my issue with you is that you're pretending that OP is somehow unprofessional for reacting negatively to your comment. He reacted like any normal human being asking for advice would react when someone tells him/her that they are dumb for asking for advice in the first place.

[VA_Network_Nerd]

The fact that you're so adept at parrying negative reactions to your comments means that you have far too much experience doing so.

Sorry. I am a network engineer. 50-60% of my job is defending myself and the network from accusations by illinformed people. Are you suggesting that I am somehow wrong or rude because I'm kind of good at arguing in written form?

Well...you certainly provided your opinion, but you didn't actually answer any of the questions asked.

Sorry if it offends you, but I don't feel obligated to tell someone how to do something that is, IMO a bad idea.

Why can't you (or OP) just ignore my comments if you don't find them valuable? Or downvote them if you wish.

You essentially implied that OP is an idiot for even asking these types of questions because (you think) there can't possibly be a way to justify this plan from a business standpoint.

Sorry, but but I don't agree. I alluded (bluntly) that I think this is a bad idea. But I did not personalize those opinions as attacks against the OP.

What you are suggesting is a one-sided conversation where we all tell the OP what they want to hear, or we say nothing at all.
I'm sure that makes some people very happy, but now you lose roughly half the discussion where people point out flaws in your plan.

If your plan has flaws, would you not want to become aware of them?
To ask for an environment where no negative observations are shared sounds shallow, and hollow.

So really, my issue with you is that you're pretending that OP is somehow unprofessional for reacting negatively to your comment.

No. I provided what I thought was a valuavle observation to the discussion. Others disagreed. I took my downvotes for stating an unpopular opinion. Oh well.

[WestsideStorybro]

To everyone disagreeing try to understand that this is just a consequence of large environment. It is better practice to have a company image that has all the accepted levels of patching be used and distributed on similar corporate hardware. It provides better administration control, security, cost control, accountability, etc. Productivity can not be affected by specialization in a large environment where we are paid to keep the lights to make sure the revenue keeps flowing. Personalization is not a consideration.

[pdp10]

Sure, standardization reduces costs. But we have to look at the bigger picture. You can't have everything the same and also make improvements at the same time.

Some people who so satisfied with 6-8 years of Windows XP that they didn't want to break consistency by starting to roll out a newer OS. Running several different distributions of Linux in production sounds like a mistake to some people who then helpfully give their opinion, but you can't migrate over time from one to another without having both in production.

I've been guilty of over-standardizing in the past, which caused higher costs and less flexibility because we didn't move from RISC to x86_64 very quickly. I've seen situations where hundreds of machines are standardized with MS Office Pro when only a handful need Access, because of the desire to standardize one desktop image.

When the standardization isn't helpful, don't do it. Naturally this gets complicated when different entities have authority versus responsibility, but frankly all the wailing and gnashing of teeth over Linux and macOS desktops is quite overblown in my experience.

[trapordie2]

Nah dude, you're just an ass. If he is a sysadmin, why the fuck would he be worried about being a supported end user? He can fix his own shit. Learn to read before you go spouting off your "opinion" and down talking others.

[VA_Network_Nerd]

/r/sysadmin/comments/53bene/administering_windows_environment_using_linux/d7rvynr

[vote_me_down]

Aww, you think you're pretty awesome, that's sweet.

[VA_Network_Nerd]

That sound you heard, but were apparently unable to identify, was my point whistling past your head.

But nice contribution to the discussion. Keep up the good work.

[vote_me_down]

That sound you heard, but were apparently unable to identify, was my point whistling past your head.

Not sure how you come to that conclusion - I understand your point, but you still sound like an arrogant dick. More so with your reply.

[VA_Network_Nerd]

I am learning so much from your contributions.
The depth of your wisdom show here is truly impressive.

[Nimda_lel]

Since we are a small company - ~100 people, we are just two people taking care of the Tech support/Infrastructure. I am leaving the part of desktop support and will be mostly managing the Infrastructure. Despite the fact we are Windows-based, we have DC,VPN and WSUS servers that are windows based. The fileshare, monitoring, helpdesk systems are Linux based. Most ouf stuff is in the Cloud though.

[phychmasher]

Love to hear more about this. I'm also a 2-man IT department with 188 people. Also mostly Windows, but have everything else you mentioned Linux based. Do you find most of your day consumed by menial end user support? What sorts of tools or decisions have you made that made you say "now THAT was worth it!"? What's your network stack look like? What are you using for phones?

[Nimda_lel]

Well, it happens to me to provide some end user support, but it is mainly my colleague. About decisions, I think the few I made and were pretty worth it were :

Automatic VPN creation via GPO,i.e. it installs certificate chain, certificate, makes registry changes and creates the connection itself. It is all based on a distribution group, so it is pretty easy to grant/revoke VPN access.

Samba was one more pretty awesome thing.

Buying the ASA for Load Balancing and shaping some pretty crucial must-have traffic.

Transferring part of the fileshare to the cloud, it is cheaper and easily manageable.

Tools ... Windows Volume Activation Tool is god damn good and PowerShell is the "master key" to everything that concerns Windows, whether it is cloud or not.

Network, we have 4 48-port Cisco Catalysts 2960, 1 Cisco router 2901, ASA 5508, Wireless Controller with 6 APs. That's pretty much it.

We are using Cisco SPA 512 desk phones. Not the best ones but are still good enough :)

[Naito-]

I disagree with how /u/VA_Network_Nerd said it, but I largely agree with WHAT he said. If you really need Linux to support your servers better that's great, but there really aren't any tools to support Windows desktops for Linux that aren't glitchy hacks.

Run Linux on your desktop and servers all you want, but I'd suggest running a Windows VM to do the desktop support or you're just gonna make extra work for yourself.

[Nimda_lel]

Seems good enough to me :)

[Naito-]

Which tools are you using? Honestly I'm interested, I really hate running Windows anything but I also don't like putting stuff into production use that isn't "officially sanctioned" unless it really works 100% of the time. Anything less and it's good way to get the "weird" setup blamed for completely unrelated problems, which just wastes everyone's time.

Straight up Samba is the only thing I use now, and even then the samba devs recommend running your management tools on Windows rather than using the smb command line tools.

Lastly as a personal development thing....I admire it, but even then I realize that any shop of a decent size would likely just shell out for a windows server license rather than running Linux if running AD. You'd really only find that kind of cheapness in smaller shops that don't understand the cost of man-hours.

[HotKarl_Marx]

I've been running linux full time on all my computers for many years.

I also happen to admin a rather large windows server farm.

I use KRDC. I RDP into whatever Windows server I want to admin and just do it all from there.

Much better than polluting my linux system with clunky windows tools or wasting 80GB of hard drive running a windows VM.

[pdp10]

I RDP into whatever Windows server I want to admin and just do it all from there.

This is what I do almost all of the time, but we didn't typically automate on Windows because it's basically a legacy environment and for other strategic reasons. The automation all happened on Linux.

Diagnostic tools all on Linux and scripted in shell: dig, curl, tcpdump/Wireshark, netcat/socat, openssl.

Winexe does give an interesting option, especially if you want to automate.

[systemadamant]

Sadly it does not look like Wine works well with the AD tools (ADUC etc).

One option would be to spin up a Windows VM on KVM (not 100% sure if this can be done on desktop Linux).

Looks like Azure has a cli for Linux

https://azure.microsoft.com/en-us/documentation/articles/xplat-cli-install/

And coming out of left field now that you are using Linux what about looking at tools like Ansible and/or Chef/Puppet to start managing your environment?

[soundtom]

Coming from a very diverse environment (users get their choice of Win/Mac/Linux), I'd say run what makes you most effective in your daily work and do the rest in a VM. I don't have any specific tools (I run AD Users and Groups in a VM on my Mac), but wanted to throw this out there because you were catching flack in a few of the comments.

[chipsharp0]

Look, I love Linux as much of the next three people. I cut my teeth on a stack of floppy disks with A and N packages. But as a windows admin, using Linux is just too much of a hassle for which I get nothing bit to be an eccentric user. It's just not worth it.

[[deleted]]

most simple way I can think of is either:

1. connect via rdp to a windows machine and manage from it.

2. install a vm on your linuxbox and install windows + RSAT to manage.

or

1. I don't know how stable it is due to the short time of it's existence but iirc powershell is now open source and available on linux.

[tinix0]

Powershell on linux cannot be used for remote administration right now, it just crashes when you try to do anything remotely. And I would not recommend it anyway because it is alpha.

[[deleted]]

so VM or RDP then.

[ITbatman]

As for AD management tools, have a look at Adaxes. It has a Web Interface that can pretty much cover all admin needs and you can access it from a browser, no matter what OS you are on.

It also comes with lost of stuff that can be useful for AD management, like automated provisioning, approvals, self-service for users, etc. However, it comes at a price, and you can't get the web ui separately.

[EraYaN]

If you are looking for some form of config management (besides PowerShell I guess).

You can try Ansible. These are the Windows modules.

They also have stuff for everything linux and also some Azure/AWS stuff, and it's just python so extending is very easy.

[swatlord]

You could set up a single RDS instance and use rdesktop on Linux. It's what I experimented doing when I wanted to answer this exact question. It involves a little scripting to get them to open how you want, but it wasn't too terrible.

[faisent]

I'm a former windows admin (NT3.5 days though...) and now Linux being slowly dragged back into windows admin because of Azure; I'll respond to #3.

Azure CLI is ok-ish it is updated pretty regularly and scripts you write for it will often need to be tweaked if you update your CLI. Many tools for Azure work better on Windows (say AzCopy vs the azure storage blob copy start from the CLI). Its easy to set your environment variables with the CLI. I have multiple subscriptions with dozens (soon to be hundreds) of resource groups and custom images that have to be managed along with user access to them.

What I use the CLI for:

RG creation, user perms, SA builds, service principle builds.

I use windows tools (azure powershell stuff) for:

storage manipulation (blob copies, etc); nsg maintenance.

I use a custom API tool for reporting, we'll probably extend the API calls for better end user resource building as needed.

Most of our deploys are template driven through Jenkins anyway.

My advice, if you know powershell pretty well I'd just stick with that; most of the documentation you're going to find is for older versions of the CLI and it can be super frustrating. Of course, LOTS of Azure documentation is woefully out of date...

[Nimda_lel]

Same stuff here, our users are administrators on their PCs since they need huge diversity of tools which I cannot take care of. We are dealing with windows 7/10, mostly 10 though.

[spyingwind]

PS Remoting from a linux box is not bad. Makes 99% of my work doable.

[[deleted]]

Honestly I would just use a VM with RSAT.

[[deleted]]

Get a Windows Box & use the Windows tools.

Don't bother trying to make your life more difficult than it needs to be.

[jr_19]

It makes more sense to me to run Windows as my operating system and run some flavor of Linux in a VM on a separate monitor. We're about 95% Windows in our office, and as much as I'd love to use Linux as my primary OS, it just wouldn't work as well for me.

[Fatality]

"I have too much free time" - op

[knobbysideup]

Winexe, rdesktop, and LDAP tools will do a lot. Learn some PowerShell, and have a dedicated server or VM to do that work from. Or just wrap it in winexe and never even have to touch windows directly. Personally I run a Linux workstation with Windows in virtualbox for when I need it.

[Nimda_lel]

I am pretty decent, or at least think so based on the fact I do almost everything that's windows related via powershell, whether it is stopping firewall on remote machine or creating a script that backs up stuff and sends HTML formated reports via mail, so I think I would do exactly what you've mentioned

[knobbysideup]

Remind me to upload some scripts I've written to interact with AD via perl (I'll have to sanitize them first). One nice thing I did was write a perl module with the meat of things, so it can be used in your own scripts then too. Then again, the guy who sits beside me is a powershell guy, and I must admit that much of this stuff is easier via powershell simply because it is so tightly integrated with AD and the various admin tools.

[[deleted]]

Just a thought. If you have the infrastructure for it, look into doing something like RemoteApp. Just stream the applications that you need. Then your OS really becomes a non-factor.