Is Samba AD on RHEL 9 a viable replacement for Microsoft Active Directory?
Asked by
VelvetHarbor27
I've been asked to investigate migrating from Microsoft Active Directory to Samba AD Domain Controllers with as little disruption as possible. Most of our clients use Windows machines, and we operate in the banking sector, so reliability, compatibility, support, and compliance are major concerns. Is Samba AD a sensible choice for this environment? Would RHEL 9 be a good platform, or should I consider Debian or another distribution? Also, how straightforward is it to introduce Samba AD alongside the existing Microsoft domain and migrate gradually?
Answers
The operating system choice should come after the directory-service requirements are clear. RHEL 9 can host Samba, and Debian is also widely used, but neither distribution removes the operational complexity. Start by listing the AD features and integrations you actually depend on, then compare Samba and the alternatives against those requirements instead of assuming the migration will be transparent.
Reply to this answer
I would be very cautious about replacing a working Microsoft AD environment in a banking organization. Samba has limitations around supported domain and schema functionality, and some Microsoft-specific features may not behave as expected. SYSVOL replication and upgrades also need careful design and testing. A staged lab migration can prove compatibility, but I would not treat this as a simple in-place replacement.
Reply to this answer
Running Samba AD alongside Microsoft AD is possible, but coexistence is not automatically a migration plan. You need to validate DNS, time synchronization, trusts, replication behavior, authentication flows, Group Policy, service accounts, applications, and recovery. Build a test domain that mirrors production, document a rollback plan, and test workstation joins and every business-critical application before moving users or retiring a Microsoft domain controller.
Reply to this answer
It can work, especially in smaller environments, and Samba AD has been stable for many organizations. Debian is a common deployment platform, but the distribution matters less than having administrators who understand Samba, DNS, Kerberos, Group Policy, replication, backups, and Windows interoperability. Before deciding, identify the actual goal—cost reduction, avoiding Windows updates, licensing, or something else. If you are not running Microsoft Exchange and have a team prepared to support Linux, it may be technically feasible.
QuietPine44: That experience is usually much more positive in small domains. A banking environment needs a much stronger review of support, auditability, recovery procedures, and regulatory requirements before making the move.
Reply to this answer
Since this is a regulated and business-critical environment, involve your RHEL vendor or an experienced partner rather than relying only on community advice. Ask for a support and compliance assessment, including patching, security updates, monitoring, backups, disaster recovery, and vendor support. Alternatives such as Univention’s Nubus platform, Zentyal, or FreeIPA may be worth evaluating, although they are not interchangeable with Microsoft AD in every use case.
Reply to this answer
Add your answer
Answers are reviewed before publication.
LunarCedar19: The domain and schema levels are important constraints. Even if the schema appears newer, features that depend on later Microsoft domain functional levels may still be unavailable or unreliable.