3.5. Summary

The default Active Directory plug-in should work to provide centralized authentication services for most, but not all. In addition to centralized authentication, an enterprise needs its directory service to provide policies. Extending an Active Directory schema is an option for most environments looking to provide policies for Mac OS X clients. For those where extending the schema will not be possible, a Dual Directory environment should be your first thought, and, provided you fully test the environment, you should also consider augmented records.

Why? Purely due to total cost of ownership. You will not be able to justify the platform if you have to bolt too many pay-for features on. The more third-party solutions that are introduced also dilutes ownership for troubleshooting and lateral support options. Overall, your life will be easier on a lot of different levels if you will be able to minimize the third-party solutions.

If you do bring in a third-party solution, then it should have its own total cost of ownership justification. For example, if you estimate that the cost of managing and maintaining a secondary directory service (including training, equipment, setup) for a Dual Directory is more than licensing Centrify for 10,000 users, especially considering that an Active Directory administrator who knows little to nothing about a Mac can manage it, then you have a clear decision in front of you at the tail end of year one, if not sooner.

Overall, the most cost effective method of producing managed preferences is going to be extending your Active Directory schema. But there are still a number of cases where third-party solutions will need to be leveraged—try to use these as ways to drive down the total cost of ownership by leveraging advanced features of each solution to enable more automation for your environment. Make sure that the business cost here is known by all, especially those responsible for making these types of budgeting decisions.