Slashdot Mirror
Dealing with Directory Dilemmas?
Bardaris asks: "In my work environment, I maintain a large number of Novell, and Windows servers. Although Novell is the dominant OS, vendor applications are increasingly making the change from Novell based apps, to single NT4/Win 2k servers. This has put a strain on my PDC. Currently the MS boxes are outnumbering my Novell 30 to 22, with more Win 2k servers in the coming months, as each application vendor has found it cheaper to dictate a sole Win server for their app, rather than sharing nicely on Novell.
Now I've been tasked with assessing what to do with the Windows environment. My preference leans to eDirectory and dirXML to contain and maintain the Microsoft proliferation, but what of my NT4 PDC. Should I upgrade to Active Directory (if so, how)? Leave it as is until the last possible moment, whatever that may be? Is there a better way? I highly doubt I can sell a Linux/Samba solution, given the current state of the server environment and political climate here in my company, so that's not one of my options. I'm wondering if other Slashdot readers have ran across similar problems and how they tackled this issue."
It is not that big a deal, buy a book. Get on it.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
Clearly stay on eDirectory. You will eventually have Linux servers in the house, and that's a great way to integrate everything you are running.
You probably want to upgrade your NT boxes, if for no other reason then updates/security issues. If you can't bring them to NetWare or Linux, I'd consolidate as many as possible on Windows 2003 and plan your migration to other platforms.
I would also recommend calling your local Novell office for a personalized look at your situation and some better price offerings.
Good luck! Should be fun, if nothing else...!
-m
http://www.invisik.com
Dump Novell, consolidate to Active Directory and W2K/2K3, and get on with your life. Running multiple NOSes is a waste of time and effort on your part.
Power Corrupts,Absolute Power Corrupts Absolutely, leaving one person(group)in charge is absolutely corrupt.
I highly doubt I can sell a Linux/Samba solution, given the current state of the server environment and political climate here in my company, so that's not one of my options.
You can't sell it because you don't believe in it. It has nothing to do with the server environment and the political climate at your company. The best sells men sell things they strongly believe in. If you really want to be able to sell what you suspect is the best solution, sell yourself first.
This isn't the sig you are looking for... Carry on...
eDirectory and dirXML are definitely the way to go unless you plan to eliminate Novell form your network. As for the upgrade path to Active Directory? Microsoft's Active Directory has already decided that for you.
If you plan to continue using the same NT domains then you must upgrade your PDC to AD first. You will then be on Active Directory but, your BDCs will still work. You can then upgrade you BDCs at your leisure but, you shouldn't plan on taking a year to upgrade them either. There are issues that will arise over time that would be more easily handled if your BDCs were Active Directory DCs.
Luckily for you, Novell has seen the Linux light even if your employer or software vendors have not. I would recommend that you press your vendors for Linux versions of their applications and make lots of noise about switching to a vendor that does support Linux, even if it is only a bluff. Over time they too will start offering support for the Linux platform too. Novell, eDirectory and Linux. Now that's a nice network.
You've got One NT4 domain, 52 servers, and out of those, 22 of them are Novell, but most of those are going away, right?
Since you've already got an NT4 domain, your easiest bet is to upgrade to Win2k/2k3 AD. If you've got s single domain, and no trusts, this is simple. if you upgrade your NT4 PDC to Win2k/2k3, it will automatically promote it to an AD DC. Now, it's important to learn something about AD, and you really should have multiple DCs for fault tolerance and load balancing, but this is all pretty easy. Microsoft even has free guides to help you out.
Stay with Novell.... basically because Active Driectory is a one-platform one-trick pony.
Active Driectory is like having a diesel car when everybody else has regular cars - you're stuck buying your diesel from the truck stop, where everybody else can fuel up where they'd like.
Plus AD sucks - it's getting better, in the same way Windows XP is beter than Windows 98 - it just sucks a little bit less.
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
Novell eDirectory and the DirXML ADS driver will facilitate integration with the x.500 standards compliant (for once) ADS 2k3/MS-LDAP.
If you need an interim solution, talk to Interix. They can make ADS talk to anything.
is of course to march into your manager's office when he's not there, get your swingline stapler back, and burn the place to the ground.
hmmmm?
but there's got to be an element of truth in there. It sounds like a bad dream the way it's setup now, and heading off to a nightmare.
They should take a good inventory, not only of what they have and how it all interlocks, but what they need.
From how he describes it, there isn't much room left for shooting from the hip. It's time for a little less network artistry and a little more engineering.
And it seems likely that at least some simplification could go on here.
still running on Novell? I thought that was gone a long time ago. I think the last time I touched a Novell server was in 1994.
Cyberbite Networks - Web Hosting, Dedicated Servers & Colocati
having just setup kerberos as my authentication gateway, and ldap running on top of that, yes, i agree.
it took about a month of on and off fiddling to get ldap and kerberos up, then get ldap running on top of kerberos.
and then i realized i couldnt do a simple bind. and i spent another month getting saslauthd working (and patching fixing and modifying everything i'd done before to make it right).
ldap + kerberos is a very in depth detail. but its the right way to go. i was suprised microsoft actually followed the right path and spun AD from ldap + kerberos, even if AD has a ton of custom cruft duct taped and hot glued on the end.
kerberos is moderately interoperable. its just the AD extentions which are extra-double-plus proprietary. i cant see samba jumping on the ldap + kerberos bandwidth.
specifically, i'd check monster.com - so i could get a new job. and in my exit interview, i'd state that my primary reason for leaving was because people were choosing technology based on uninformed politics instead of a decent understanding of technology.
US Citizen living abroad? Register to vote!
each application vendor has found it cheaper to dictate a sole Win server for their app
How nice. I recall a rather elderly Sun SPARCserver 2000 that handled multiple NFS mounts for a whole network using software and hardware RAID (including serving user home directories), was a web server, a license server, an Oracle development server, ran sshd, and some other stuff I can't remember. It had six 60MHz SuperSPARC CPUs. Granted, it wasn't like riding greased lightning, but it got the job done. Oh, and there was that Ultra 1 workstation that scanned and routed every e-mail entering and leaving the network.
30 Windows servers? I'm glad I'm not the guy's supervisor responsible for signing off on so many superfluous purchase orders (boy, he must be dense).
Vote in November. You won't regret it.
The upcoming Microsoft Virtual Server might ease some of your machine multiplication woes...
r tu alserver/evaluation/vmnews.mspx
http://www.microsoft.com/windowsserversystem/vi
So long as companies like yours accept it when venders each demand to run on their own windows server, using all the resources instead of tight code, venders will deliver. Put some squeeze on venders, when evaluating versions make sure you count how much hardware you will need, and how compatable they are with what you have. They will get the message if you put pressure on them.
Don't say your not big enough, because nobody is big enough alone. Start doing it yourself, and get everyone else you know to do the same.
I priced it out for the small business I was consulting for. A single "new" Win2K3 server (just over $12K) and OS (over $15K) with a 2TB Raid ($12K) came in at $39000,
A Clustered pair of Xserver Dual CPU G5s ($4K eack X 2) with a 2TB Xraid ($8.5K) WITH THE OS was arround $19K. The OS was the huge money factor, 150 user ver of WIN 2K3 Enterprise server was like $15K All by itself, where the UNLIMITED (yes without limits on users) version of Mac OSX Panther Server was $1K with an Additional $1K Upgrade service guarentee for 3 years (Any new os is free for 3 years).
MacOSX, because making *NIX better is a lot better than waiting for Micro$loth to fix Windows
I agree that that is an unhealthy situation, but blindly recommending Linux for whatever problem someone poses is not the solution to that problem. The same counts for any other-than-Microsoft solution. Understand that sometimes a Microsoft solution is not a bad choice!
Now to the problem. The first thing you should do is investigate support options for Windows NT, and the possibility of a migration towards Windows Server 2003. While doing so, interoperability with Novell should be high on your priority list.
Also understand that there is a profound difference between NT4 domains, a Windows 2000 AD domain and a Windows Server 2003 AD domain. Where Microsoft pitched Windows 2000 AD as an enerprise directory, they have now seen their mistakes in doing so, implemented major improvements to the AD and no0w they are selling it as a systems management directory. In other words, if you want an enterprise directory, stick with Novell. If you don't want or need that, go with Windows. Take into account the fact that once you go the full Windows AD route, you are running one or more Kerberos realms, with all the associated problems. Also understand that a proper DNS infrastructure is mandatory for a healthy AD domain. The third point: AD replication. Before implementing anything, make detailed calculations about the amount of directory replication traffic if you run multiple domains (hint: you don't want to, but might need to). This last point doubles in importance when replicating to remote sites over slow wan links.