• OS2Warp@lemmy.zip
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    2
    ·
    3 days ago

    Great; what OS has the equivalent of Group Policy and Active Directory besides windows?

    • toddestan@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      1
      ·
      3 days ago

      The funny thing is, the people who care about Group Policy and Active Directory are the same people who aren’t happy about their network potentially being compromised because someone hooked up their work laptop up to a monitor at their home.

    • enumerator4829@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      edit-2
      3 days ago

      This is the one thing holding open source back, and the thing Linux users keep pissing on without understanding it.

      The CTOs inept nephew can manage your fleet of windows machines and you get all the checkbox security you need for compliance (and some real security):

      • Centrally managed
      • Logs that are fairly hard to manipulate
      • SecureBoot + Bitlocker

      That same feature set on Linux will cost you a ton of money in skilled staff if you want to check the same compliance checkboxes. (As for real security, who cares, no one is doing that anyway)

      Kind regards: someone who has managed Linux fleets.

      • OS2Warp@lemmy.zip
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 days ago

        THANK YOU!

        So many people just don’t get it; happy to see someone rational who does.

        I WISH Linux had something like this, but it’s like NT 4.0; it doesn’t have it.

        • enumerator4829@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          1
          ·
          13 hours ago

          It’s getting there, slowly.

          • Clevis can do network and TPM pinned disk decryption.
          • With Linux UKIs you can do self signed secure boot, we still need the mechanisms for central signing. This would actually be better that windows, you control your own PKI and Microsoft can’t sign garbage your machines boot.
          • Logs is a somewhat bogus argument - log falsification on Windows has been done too. But linux is rather unprotected in comparison.

          But the biggest issue is the mentality of ”I own my computer”. Sure, you own your private machine, but your company owns the computer you use for work and the data on it and has an interest in protecting that data from you. That particular threat model is hard to communicate, as Linux users normally don’t think of themselves as a threat vector.