Does it make sense to use Windows Active Directory in a small group of say less than six users/ computers

active-directorywindows-server-2008

For a (very) small company would using Windows server with AD be overkill – why not just use it as a file/ print server, administration server from which to access all machines on the network via remote desktop for administration purposes?
Also for saving disk images of all PCs on the network…

This small company has three main office employees, some clerical staff (a dozen) with maybe a dozen computers strewn around. The three main staff run the business and could use a good shared filing system with authorizations (read-only, etc.). There is a second layer of maybe four staff who use a couple of web services and do some research on the web. The rest are using only specific websites (access restricted with K9).

Some applications run off a dedicated Windows XP machine, which runs an application (one client at time) to control security (doors, etc.)

They work fairly well now with a simple workgroup, and one Windows 7 workstation serving as a baby file server.

Best Answer

I don't see having Active Directory (AD) as adding complexity. Rather, I see it as making administration easier. I see the functionality that it enables in the client OS as being a major tool to allow for smooth future growth and replacement of computers.

From a cost perspective, there are very low cost versions of Windows Server (2012 R2 Essentials currently fills this niche) that bring a lot of nice tools to bear on small networks for not a lot of money. For small environments you don't have to mess around w/ CALs, too.

Speaking about this in a "bigger picture" view, where Active Directory is just part of a feature set that a dedicated server computer and server OS can provide, I see a lot of advantages.

  • Active Directory gets you single-sign-on, Group Policy, and the ability to create authorization schemes using Security Groups that will easily transcend employee turnover. In small businesses, in particular, a good permission strategy revolving around AD groups assigned to employee roles has enabled me to easily handle "Bob now does John's job" type situations (which seem to crop up more frequently in small businesses than large, in my experience) very easily.

  • Having WSUS is great. Oh, boy, I like having WSUS.

  • Did I mention Group Policy? Folder Redirection? Roaming user profiles? Oh, how I love stateless (or nearly so) client computers and the ease with which I can factory-reload a failed PC or replace a computer. Having users able to logon to any client PC and have basic functionality (client-side apps non-withstanding) turns "drop everything" emergencies into mundane service calls.

  • I like having a "real" server to handle infrastructure protocols like DHCP and DNS (versus some wonky toy "servers" built into a consumer-grade Wi-Fi router, etc).

  • Security auditing is much, much easier in an environment where centralized authentication and authorization are present.

  • I'm a bit partial to the PC backup functionality in Windows Server 2012 Essentials for very small Customers where otherwise getting them to spring for a couple spare PCs to be used in a "hot desk" capacity in the event of PC failure is too much for them to spend. It's kinda hokey, and I would prefer not to backup anything on client computers at all, but the time savings in small shops where client computer standardization is nonexistent is hard to argue.

  • The business might get value out of other bundled applications that the server could host like, say, SharePoint.

  • Offering users remote access through Routing and Remote Acess Services or Remote Desktop Gateway.

I like having an on-premise Windows Server with Active Directory in environments where there are Windows client computers. It makes my life easier and ends up costing my Customer less money, in the long run, than trying to "herd cats" by managing a fleet of non-domain-joined PCs.