Slashdot Mirror
Swiss Canton Abandons Linux Migration
An anonymous reader writes "The Swiss canton Solothurn has put a stop to their ongoing migration to Linux. [Original, in German.] The project started in 2001, and has been under harsh public criticism ever since. The responsible CIO resigned this summer. Solothurn plans to convert all desktop computers to Windows 7 in 2011."
but it seems like this migration was rather ill prepared...
Reading through the issues, it seems they didn't actually stage and test this before deploying it. Typically, in real IT shops, that's what you do. Development, Staging, Beta, rinse, repeat, certify it, freeze it, and then production.
It sounds like that just slapped that shit app in there and didn't look at the how it was slamming the database. You can't change the database. You have to change the application. Which is quit a big deal without programmer's.
Methinks none of those monkey's have ever done this before.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
From the article:
Delays in the implementation, immature software, eaten employees...
It's no wonder Linux never got off the ground, if employees have to fear being eaten, then there's something seriously bad about the implementation.
Although I'm hoping this is just a Google Translation error, but seeing how many billions of dollars Google has to refine its programs, I'm doubtful that this is anything but a perfect translation.
My condolences to the employees who were eaten by Linux.
Yeah, it clearly shows that OSS cannot compensate stupidity from the planners, and that it is very easy to put the blame on Linux instead.
The Tao of math: The numbers you can count are not the real numbers.
Let's not automatically assume that's because Linux really isn't ready for desktop use - or that there's corruption going on.
A major transition like this is hard. Linux doesn't have anything like Active Directory for the desktop (Anyone who suggests you use something like Puppet is living in another world. AD comes with policies ready to go, all you need to do is tick the necessary boxes and you can be reasonably sure that when you tick the box, it'll actually do what it says. Writing and debugging equivalent configuration for even a tenth of that in Puppet would cost a lot more in man-hours than all the Windows licenses you can shake a stick at). There's no realistic replacement for the combination of Outlook/Exchange. (BTW, I can't remember the username but every time I post something like this one of the authors of Citadel comes out of the woodwork and suggests I check that. Terribly sorry, but I have. No offence, but I don't believe you've used a properly administered Exchange installation if you honestly think Citadel's a viable replacement.)
I haven't even considered the possibility of custom-written software which was intended for Windows and will require re-writing. Wine doesn't cut it when your suppliers' response to any query is going to be "You're running under what?!"
Add to that the fact that a lot of people don't really know how to use their computer - they just know to click on the "button on the left" or "third one from the right". Even very subtle change will cause such people no end of trouble, and even if you're in a part of the world with at-will employment you can't sack them because otherwise you'd be sacking 20% of your workforce. I'm not even remotely surprised to learn that someone's tried a migration and messed it up.
The thing that does surprise me is that the same desktop users who will call the helpdesk every 15 minutes with a Linux desktop will almost certainly not object anywhere near so vocally when they're put onto Windows 7 and an upgraded Office suite. Part of me wonders if you'd see different results if you took Ubuntu, changed the boot and login screen to say "Microsoft Windows 8", re-branded OpenOffice as "Microsoft Office 2009" but left everything else as a normal Ubuntu install.
Comment removed based on user account deletion
"Yeah, this story is pretty self-explaining... good work FOSS!"
Yes, this story is pretty self-explaining... but I question what does indeed explains.
It's almost a meme around here that "joe sixpack" simply doesn't pay attention to computers but here it seems there has been a strong campaign in press against the migration from the very begining as if it were a sensible issue for general public.
And then, this project has been cancelled when internal polls show that only around 10% of users -and it seems "end users" are implyied, not sysadmins, were dissatisfied and 80% were satisfied with the new environment (I'd bet that's and expectable turnaround for *any* environment change).
One should ask himself if there might be some kind of pressure from "other vendors with deep pockets".
It's obvious too that has been some managerial mistakes that, as such, could be an expected source of problems no matter what the migration path were as, per instance, towards Windows 7 instead of Linux. There has been problems that tough counted on the negative side of the migration seem indeed to be more on the side of the lackings from the preceding environment (like a closed database that ends up being difficult to transition -heck, that's why you are migrating: to avoid things like that to happen... from then on).
All in all it's an enlighting example... mainly about how carefully the "soft side" of a migration towards open source should be managed. As in "be prepared to withstand attacks from the older stablishment trying to regain its lost power -and licenses" or "people will take the problems with a Windows to Windows upgrade as a non issue -it might be because the name doesn't change, even if most of the environment so does, while in a Windows to Linux migration everything and the kitchen sink will be Linux' fault no matter what so you'd better choose very carefully your stakeholders and make sure they feel involved as a driving force".
By the way, any new news about Munich?
For those who prefer a quick human translation over a state-of-the-art Google Translate result, here is what I gleaned from the article. German is not my first language; corrections and other improvements welcome.
Short summary:
- The project wasn't going well from the beginning
- The project definitely failed, but you can't entirely blame that on Linux
- Lack of organizational talent definitely played a role in the failure
- In a survey, about 80% of employees stated they were satisfied with the new environment, 10% complained about issues they thought would be resolved over time, and only 10% were really dissatisfied
- The media played a large role in the perception of the project by eagerly latching on to every bit of bad news about the project
Partial translation, paragraph by paragraph:
Nine years after the decision to migrate the computers of the Solothurn kanton to Linux, a radical reversal has come today: all desktops will be converted to Windows 7. Did Linux fail?
The project wasn't a great success from the beginning; those who followed the media must have gotten the impression that it was a sequence of failures and bad luck.
Problems during the migration, software than wasn't ready yet, angry employees who set up a homepage to vent their frustrations and who couldn't get any work done because of Linux - all of this suggests that tax money was being spent on a project doomed to fail. And it has failed now. But to blame it all on Linux would be short-sighted. When you look further, you will see that many factors were responsible for the failure.
The decision to convert to Linux came in 2001. The goal was to have completed the conversion by 2007. However, that goal was unattainable, because some invitations to bid were only sent out in 2006. The choice for the Scalix web interface wasn't a good one: even in June, the webmail interface lacked a task list and some of the comforts of native e-mail clients.
Many special applications could not easily be replaced by Linux solutions. This was compounded by problems with the Konsul database employed by the kanton of Solothurn for editing council decisions: the data file of this Windows software was not so easy to migrate. Project Ambassador was meant to allow interoperability with OpenOffice.org et al, but was postponed until end 2010 because of performance problems. As a result, none of the council members worked with Linux systems.
An internal inquiry among employees showed that about 80% of them were satisfied with the new environment. Ten percent complained about "childhood diseases" of the software, and only 10% were really unsatisfied. But that is still 100 employees, and they were a very vocal minority.
The Swiss media seized every opportunity to bring news of even the most insignificant frustrations in the kanton: a temporary printer problem that was solved quickly became "lasting printing problems". Quotes from employees who claimed to work more productively at home than at the office were gladly printed.
If there wasn't any bad news, the media simply manufactured some. When the state attorney's office held a conference for attorneys in 2009, they neglected to prepare a Windows system for displaying the PowerPoint presentations. The kanton police, who, according to the Berner Zeitung had "successfully defended itself against Linux" helped out and saved the attorney's office from embarrassment. Of course, there are many things you can blame on Linux, but lack of organizational talent of the conference organizer isn't one of those.
Please correct me if I got my facts wrong.
Let's face it: If you do not have a clue hot to do an IT strategy and how to implement it, then Windows can at least give you a semblance of success. Not that anything will run well or cost-effective, but it will run. (For now at least.)
With Linux , you actually have to know what you are doing. It is not really that hard, but some understanding is non-optional. Solothurn made a number of really bad and really obvious mistakes. I am undecided whether this was due to intentional sabotage of the effort or due to incompetence. I suspect a combination of both.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I'm sad to say that I, as a die-hard AIX/Linux/Mac fanboi have had to recommend migrating healthcare applications to Windows servers, and testing with Windows clients. This is because the healthcare organisations who will look after the applications in three years time at the end of the project, will not have the skills, enthusiasm or experience to run anything that isn't Windows.
I accept that for most people, the desktop is and will be Windows. For some, who don't need encouragement Windows will always be anathema, and all flavors of unix, be they GNU/Linux, AIX or Mac (other versions are available) will be preferable and worth any effort required to use instead. I bet I could have fixed any and all problems that these guys came up with, but when you are faced with users who are baying for a particular solution, rather than establishing what their requirements are, it is a lost cause.
Indeed. Imagine the slightly changed scenario: The organization-wide video broadcast is needed not tomorrow, but today, in five hours. Do you really want to reboot your whole network during work time (and lose valuable work time, not to mention the angry reactions of employees you'll have to expect) to enable that video?
The Tao of math: The numbers you can count are not the real numbers.
I'm always surprised of how this things are implemented. They usually _start_ with a bang and public announcements and trumpets and all. That is, before they have done anything. When you see something like that, you know they are going to have lots of problems, simply because the people that thinks that way (first let's make a big decision and a big press conference) usually cannot think in the way needed to solve the very difficult problems that arise in big migration.
IT systems have become very complex things that pervade our work and private life. They have evolved for decades to adapt themselves to peoples' needs, and people has changed too to adapt to the IT systems. Windows has been part of that mutual evolution for many years now, and Linux hasn't. That's the elephant in the room that nobody speaks about. Linux won't be able to compete with Windows till it has many many years, not of existing, but of being widely used (even in special locations like call centers and so), after it.
For doing migrations I'd recommend the following guidelines:
- Gradually is the thing. Start with localized users, preferably new people that haven't got used to the old system.
- These new users have to get a good experience. If you cannot make it happen for a couple of desktops, sure you won't be able to make everybody switch.
- Provide comparative advantages to the new users. Things like putting big screens in the Linux systems will make other people wish they had been migrated.
- Everything you use should work in both systems. If something cannot (Outlook/Exchange, custom apps, Access databases) then you have to search for an alternative or replacement. If no alternative exists that is good enough, you better forget about the whole idea.
- Even if everything works in both systems, when you set up something new (database or anything) make sure it works a bit better in the Linux than the Windows systems.
- Set no end date for the migration. You are going to keep Windows for a long time, so don't fight it. Gradually is the thing, remember.
Rome taught me patience and assiduous application to detail. Virtues which temper the boldness of great, general views.
I can't read a lick of German, but I work with people who can... So I got a rather quick verbal translation of the article...
These guys basically steamrolled the users onto Linux without doing an adequate evaluation of their environment and without following through with a solid beta program. I'm sensing this *could* have been successful if they'd been more organized about it.
I speak from experience as a guy whose been responsible for a somewhat medium sized (several departments in a large corporation) migration from windows to Linux.
The first thing you do is you go talk to your users and figure out what they're doing for a job and see if Linux actually will work in their environment! If they spend all day writing VB applications that interact with a SQLserver database... Linux probably won't be a good fit.
The next thing you do is go and recruit some beta users who are willing to be guinea pigs. Then setup a system that'll work for them. Be prepared to sit in plenty of offices and debug issues. After the kinks have been worked out and they've been happily working for a week or two... convert a few more users... rinse, latter, repeat. It might be that you'll get all the kinks worked out and you can do 20 people at a time.
A few things you need to consider even before doing this...
* Authentication... is each machine going to be an island? Most corporations really frown on this... are you going to tie them into Active Directory? Setup a NIS bridge? Things to think about..
* Home Directories... Where's their home dir going to reside? In my case, peoples home directories hang off a unix machine running NIS / Samba, so that wasn't such an issue...
* Printers, etc.
Also remember that your users will never give you the full truth... invariably you'll get a call because [insert obscure scan/printer/web cam] doesn't work.
Another thing you need to be able to do is concede defeat in some cases. In each department I've got probably ~20 people who didn't want to switch. Either they didn't want to switch or there was some compelling reason that they couldn't switch, be okay with it and move on.
So this migration had nothing do with Linux not being suitable for the desktop, this was a IT failure.
Yes Francis, the world has gone crazy.
But unfortunately, that is precisely the rhetoric that the OSS community is accused of brandishing all the time. The bottom-line is people do not care about the principles of freedom of code and other Stallmanisms when they are at work (which may come as a surprise on Slashdot). There are certain applications for Windows that just don't have a replacement on Linux yet, period. I'm sorry you can't argue with that fact.
I know the beauty of Linux/OSS is that anyone can write a replacement app - but I am a molecular biologist with a research grant. I find it easier to purchase the Windows license (which is usually in built in the cost of the computer anyway) and the 5000 Euro worth of licenses I need, than to hire a Linux coder or write the programs myself - it costs more in hours that way. And I'd rather be doing molecular biology , which is my job and expertise, than to be figuring out the innards of the Linux kernel (OSS means I can). To be honest, Windows 7 is rather well-done in my opinion and that makes the move to Linux even less lucrative.
I believe this is the case in every situation where there is a organized system already in place and the computing has to merge with the existing framework - such as the bureaucracy at a city department, or a research pipeline.
Entia non sunt multiplicanda praeter necessitatem.
Hi MR AC! While FOSSies like to brag about the "free as in beer" part, in actually the cost of windows desktop licenses is so tiny as to not show up in most budgets in even the top twenty. so no selling point there. Two, MSCEs are a dime a dozen, competent ones not much more expensive, whereas good Linux gurus are damned high, if you can even find one. Third, say what you want, but AD makes administering windows desktops so easy i could teach my 16 year old to do it via AD in less than a couple of weeks. I have yet to see anything on Linux that makes multiple desktop policy management that damned easy. Oh and nearly all mobile devices have Exchange support, which is one less headache.
I honestly think the problem with FOSS and Linux is they are going about things ass backwards. They keep talking about how its a "drop in replacement for Windows" when in reality Linux is MUCH more like a Mac than it'll ever be like Windows. here is why, just as you can't grab any old piece of hardware and make a Hackentosh, so too can you not just grab any old parts off a shelf and make a Linux box that is reasonably decent. There is just too much common hardware that is seriously iffy in Linux. So you end up needing to buy specific hardware designed for Linux, which in the desktop, again like a Mac, will cost you more for less power than a windows machine. So in the end if you are gonna buy new hardware anyway, why not just buy a Mac and have better vendor support and less headaches?
In the end after trying Linux on more pieces of hardware than I care to count I've found that Linux really works best in certain niches, like say education where you've got old hardware that won't run any newer windows and which has long been reverse engineered by Linux developers and is thus quite stable even across upgrades. But on new hardware, which this being a government I assume they are on the standard corporate 3 year upgrade cycle, there is simply too many pieces of common hardware where support is dicey if you can get it to work at all. And of course none of the big OEMs are gonna offer you Linux except on their more expensive workstations, again adding to the cost.
Certain places Linux works well, like servers where vendors actually provide decent drivers for all the hardware, or embedded where you simply build only for that hardware and are done with it. But trying to deal with it as a corporate desktop with the whole 3 year upgrade cycle? Unless you are willing to shell out for workstation class hardware for the entire place every 3 years the headaches probably wouldn't be worth it, and it is certainly cheaper just to buy the dell El Cheapo desktops with windows included, than to go through all that. That is why if a SMB asks me about Linux I recommend a "try before you buy" period, where they migrate to the Windows version of FOSS apps like Open Office and Thunderbird, to see what kind of headaches they'll be looking at first. It sounds like they went for it without a plan and got seriously bit in the butt.
ACs don't waste your time replying, your posts are never seen by me.
The number of people who have to work with the system are clearly in the minority. Most people never have any contact with the system, and believe whatever the press tells them about it.
The Tao of math: The numbers you can count are not the real numbers.
Replacing windows with Linux using centralised authentication isn't that easy. We tried it recently where I work where we run both Linux and WIndows 7. This meant it had to be AD.
Using ldap for web services was easy enough as was getting win 7 desktops joined up. The hard part was getting Ubuntu machines on the domain...
The first thing I tried was likewise-open which I had a number of problems with. We eventually settled on winbind which worked incredibly well for a samba file server joined to the domain, but for desktops it wasn't ideal. If the domain controller became inaccessible for whatever reason, the whole machine would freeze up even with cached credentials turned on. The other caveat was user's inability to change their domain passwords from Linux. Well.. it was possible but whenever they changed their password, both the new and old passwords would still work. (see http://wiki.samba.org/index.php/Samba_&_Active_Directory#password_changes) It was also impossible to force a user to change their password, it would fail constantly.
If I weren't so determined I would have likely just gone with Windows 7 for ease of use despite the extra cost. There is one more commercial product I need to try and that's centrify. Fingers crossed.
I find it easier to purchase the Windows license (which is usually in built in the cost of the computer anyway) and the 5000 Euro worth of licenses I need
I did my MS in chemical engineering focused on quantum chemistry / molecular simulation / molecular modeling / "nanotechnology". In my field the mainstays all run on clustered supercomputers running some form of Unix: Gaussian (which has a Windows version too), DL_POLY, VASP, MOPAC, Cerius2, ... Even the visualization tools often were Unix-only requiring an X11 server. Though some of the grad students wished for more Windows packages, it was pretty much a given that doing real work in quantum chemistry means learning to love Unix.
I'm curious: which Windows-only packages are hot in your field?
I did some small and medium business migrations towards FOSS software and I can attest that it's not easy.
Key factors I've encountered are: users have a bad predisposition, they always prefer windows because they (think they) know it, they have it in their home computer, notebook and phone, and they don't want to make the effort to learn another system; there are custom developed apps that not always are easy or at least economically feasible to migrate; there are software that are probably easy to migrate but you lost support if your server is not windows, and you are setting yourself in a position where you will be blamed by any problem a computer could ever have, related or not to FOSS.
In my experience trying to perform a 100% migration is not very easy not desirable: except in very restricted environments, every non trivial system will always be made up of heterogeneous OSes and apps. Because of smartphones, laptops and embedded systems, that mixture is pretty much guaranteed these days. So it's better to move early the back systems: replace mail servers, file servers, databases, printservers, backup systems, http and ftp servers, LDAP, routers, firewalls... and make sure they work and are appropriately configured.
Then deploy OOorg to _windows_ WS, perhaps with Firefox and Thunderbird (I always though that the Thunderbird developers would be looking at Pegasus Mail, sadly they weren't). That way your users will be familiar with the apps and then changing the "desktop" will be more easy. Change the users WS OS progressively, change first the WS of the more "advanced" users and try your best to show the deployment of the "new" system as a privilege; if you can, change the OS and put a new WS for it, or at least a new or bigger monitor.
Important factors in success and collaborative users is to provide them with compatibility: you're migrating, the rest of the world no. So you have to make sure your users can communicate with the external world: not only OOorg has to open xls and doc files; they _need_ to chat in the msn network, watch videos on youtube, and so on. Those are as much as important as to be able to do the work if you want your users supporting you.
Be careful choosing a X environment: the popularity of Ubuntu these days hides the fact that it can be obnoxious and overcomplicated for end users. A smaller, lighter and more orthogonal desktop environment (like XFCE) could be better.
Don't try for the new environment to mimic "look and feel" of windows: it's far more irritating to encounter subtle and minimal differences in behavior that to face a complete different approach. Most users spend 90% of they time in two or three apps (mail, office suite, some custom or enterprise app) and they simply don't care about anything else.
Your ultimate goal is to be asked to install "linux" on their home boxes or laptops. That will happen when they feel comfortable and familiar with the new system.
Seriously, the Swiss screwed up. It happens. Get over it, learn the lessons there are to be learned, and move on.
Lesson 1: Don't announce you're going to move everyone, and it's going to happen by X date. Not everyone is going to switch, and X is a variable, not a const.
Lesson 2: Some things take longer to "work with" than scrapping. The town council database app is obviously one of those.
Lesson 3: Stop with the stupidity of using a web interface for almost everything. It doesn't work. It p*sses people off (or as the article says, get them half-eaten). Get devs who can also code with qt or wxwidgets or java or tcl/tk or whatever.
Lesson 4: Sell to your users. Make it a privilege to be part of the transition. You want people b*tching and moaning about not being "upgraded" to the new linux desktop, not the other way around. Marketing 101.
Lesson 5: Provide effective feedback channels, so that people don't feel they need to set up a web site just to complain because you aren't listening.
But if you had read the article, it didn't mention a single such application which was a problem. The main problems were:
* An extremely bad choice of the free email system (it explicitly said that other systems existed which would have provided the missing functionality).
* A proprietary data base (and unfortunately they didn't even choose one of the major ones). There are definitely good free databases; moreover there are also closed source databases running on Linux.
* Mistakes which were completely unrelated to the migration being blamed on the migration.
The Tao of math: The numbers you can count are not the real numbers.
1. Vector NTI (DNA manipulation)
2. All confocal microscope drivers and analysis software
3. Origin Pro (statistics and graphic with interfacing for Matlab and Labview
4. Bitplane Imaris (3D analysis on biological samples with a patented,proprietary and the only non-heuristic deconvolution algorithm)
That said , yes , our cluster runs Linux too. We just run whatever works best for a particular application (isn't that what it should be like, rather than insisting on one kind or the other?)
Entia non sunt multiplicanda praeter necessitatem.
Yeah, it clearly shows that CSS cannont compensate stupidity from the planners, and that it is very easy to put the blame on Windows instead.
No, it doesn't show that. Maybe a future story about their problems migrating back to Windows will, though :-)
The Tao of math: The numbers you can count are not the real numbers.
To see if in the next 3 years they report a massive increase in the number of malware infections.
Yeah, it's unfortunate that these guys don't understand the concept that you can do this across thousands (tens of thousands) of desktops in Windows rather easily, and that it's a highly scalable solution, and as long as you've got a couple of domain controllers in the backend, quite a bit fault tolerant to boot.
Just to add on to what joelleo is talking about:
-Group Policy applies to OUs, Sites, Domains, and (after 2003/GPMC) allows you to do security group filtering.
-User John is in the Call Center department. He needs certain rights locked down on the machine. You create John's AD user, throw them in the call center OU, and they'll get all the policies applied.
-Later on, John is moved to the Sales department. Sales has a different set of policies, say, his machine is more open and lets him customize it a bit more, he needs certain software, he needs a different company homepage, requires different browser security zones. You simply drag his user to the new OU, reboot his machine, and he's good to go.
This sort of flexibility where you worry more about the business than the actual technical hurdles of trying to do this is something that Linux cannot provide.
We are a Windows/Solaris/Linux shop and central authentication and management is a big problem. Using an AD as the backend would probably have been easier, but our UNIX guy would not accept any situation where Windows was the core of the system. So we use LDAP. However OpenLDAP was not at all suitable for the purposes, Sun Directory Server, which is free but the servers it runs on are pricey. It is also no longer available from Oracle so we are going to have to consider what to do. That then required the use of IDsync, which wasn't free, as well as a good deal of custom programming. The current solutions works, and has an LDAP server and AD that are sync'd to each other, but are running separate and one can continue if the other fails.
It also means that management of the two kinds of systems is totally separate. Other than logins, which are of course global (the whole point of the system) and automounting storage, nothing else is shared management wise. Windows is managed through the AD, Linux through Puppet, at least when Puppet works (it is rather problematic). Solaris is more or less all central, no apps on individual systems, only central apps because of management problems. Windows is per system, of course. We have different support people who deal with different domains of the system.
At any rate it works, but it was not easy to make work. Also none of this deals with migration, this is side-by-side support. I wouldn't even want to think what it would take to try and support some of the things done on Windows on Linux instead. It would NOT just be "Oh use OpenOffice instead of MS Office," never mind that even that would be problematic (OO doesn't do everything MS Office does).
"The second saddest thing about the Swiss is that they think they combine the creativity of Italians with the organization of the Germans; the saddest is that in reality it's the other way round."
-- Oscar Wilde
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Of course it does, and I didn't say that those two items are the only components of TCO.
I was illustrating a point, where somebody basically claimed that, because of "license fees," the "TCO of Windows" was infinite, and that Linux was clearly the lower TCO. Anybody with a shred of common sense knows that license fees are a vanishingly small portion of TCO, and it's easy to see that simply the cost of labor to deploy, maintain, and manage could offset the license costs.
As far as: "How about the costs incurred by vendor lock-in?", converseley, how about the costs incurred by having to develop your own solution because no pre-existing software for Linux is available?
Let's not pretend that Windows has only negatives and Linux has only positives.
Uh, UNIX $HOME was for thousands or tens of thousands of desktops. I fail to see why "With AD you can do this to thousands of desktops" is a killer feature.
Really.
After all, if you have 10,000 desktops that are all different, you're going to have a shitstorm for either Linux or AD.
If you have 10,000 desktops and about four roles, then your 10,000 desktops becomes four. And AD doesn't make a difference.
"-Group Policy applies to OUs, Sites, Domains, and (after 2003/GPMC) allows you to do security group filtering."
And security group filtering is WHAT when it's at home?
Limited run processes? Group execute.
Web access restrictions? If you're on a properly segmented LAN, then your DHCP can give you all the locality needed.
If you need per-user restrictions, yes, that's available in writing to a ~/.mozilla file.
"-User John is in the Call Center department. He needs certain rights locked down on the machine. You create John's AD user, throw them in the call center OU, and they'll get all the policies applied."
Why didn't John in the Call Centre department not have the rights locked down? And rights for WHAT? Access to printers? Again DHCP and default kprinter profiles sort all that out.
Really, you're just using jargon that you've read in the blurb for AD and why it's so leet.
"-Later on, John is moved to the Sales department. Sales has a different set of policies, say, his machine is more open and lets him customize it a bit more, he needs certain software,"
a) if you're on a different segment, or the machine is named with a "Sales" moniker, then agan DHCP can sort all that out.
b) if the user moved jobs not place, then again, the user gets a default profile written since effectively he is a new John, this one working in Sales.
"he needs a different company homepage,"
WHY? He's moved DEPARTMENT, not EMPLOYER.
Shit, this is the problem I have with AD fluffers. Making shit up that I have NO CLUE why businesses need to do it, merely that they CAN do it, so they do.
That's if they even do.
" requires different browser security zones. You simply drag his user to the new OU, reboot his machine, and he's good to go."
And ~john has a different ~/.mozilla setting, done when he changed job. Reboot after setting it up and he's good to go.