Mostly windows admin moving work computer to Linux?
Posted by TheSarcastonaut455@reddit | linuxadmin | View on Reddit | 27 comments
Hey guys!
I’m an admin for most windows server environments with maybe 10-15% Linux VMs and 300+ windows servers for clients. Has any of you moved your work computer over to Linux?
Do any of you have experience managing windows environments on Linux? Biggest pain points? I’m getting board/annoyed with windows 11. But don’t want to make the shift if there’s some really big inconveniences that will affect me.
Thanks!
Hynch@reddit
When I was still in the sysadmin world I preferred a Mac. It’s Unix based so I was comfortable with CLI and it has plenty of application support. For any Windows only tasks I had a Windows jump box I hit via RDP.
academictryhard69@reddit
all roads leads to macos for a sysadmin
HerpaderPoE@reddit
Gr8 r8b8 m8 i r8 8/8
hadrabap@reddit
I do not admin Windows, but am forced to use it.
All the Windows suffering is much better from Linux or Mac. Especially on a Mac you can easily disable all the annoying keyboard shortcuts (window placement, screen rotation…) by remapping them to something useful (cursor navigation).
I hope one day I will have a job where I can use an actual development environment, not this nonsense Tamagochi BS.
NL_Gray-Fox@reddit
I've never been a windows admin (always Linux, Unix, NetWare) but I have managed some.
I would say go for it, but setup a windows management "server" and RDP into it, this also helps you work remotely safer and in my experience faster.
Ssh into a server and RDP from there to the management server. Why this worked faster for me than local is because it's very easy to disable all the fluf that the normal desktop comes with just in the RDP client, and you never have to wait for a VM to boot.
Skyshaper@reddit
Back when I did this stuff, my workstation ran KDE-Neon and ran a Windows VM in KVM/QEMU. Those were the good ol' days.
Now I'm stuck on a corporate laptop running Windows only...
kestrel808@reddit
You can install powershell on Linux and there are RDP clients. You’re only going to have an issue around things like installing domain admin tools or mssql admin tools locally if that’s in your workflow.
doubletwist@reddit
Unfortunately there's a problem where some powershell modules don't work in Linux, like the official MS Active Directory stuff, so if I were OP, I'd either stick with Windows, or at the very least have a Windows VM running to ensure access to the tools that need it.
Stevenger@reddit
Remote execution against the domain controller
blue30@reddit
This - I also have a windows VM I can boot up as a matter of last resort - I go months without needing it though
heheuwurawrx3@reddit
I did it. Desktop and windows admin for 10 Years. 3 years into Linux now with my rhcsa. It took a lot of lab work at home and youtube university but overall very glad I did it.
TheSarcastonaut455@reddit (OP)
How has it been?
redundant78@reddit
the pattern most people land on is Linux daily driver + a Windows VM or jump box for the stuff that absolutely requires native tools (RSAT, SSMS, etc). PowerShell on Linux is solid these days and RDP clients like Remmina work great, so 90% of your workflow won't change much. the remaining 10% you just RDP into a Windows box and do it there.
Zedboy19752019@reddit
I actually use Linux managing a Windows domain. If there comes anything that I cannot do directly from Linux I RDP into a server and do ever from there
OCGHand@reddit
What services do you manage?
NeverMindToday@reddit
I used to do this 10-20 yrs back. It helped a lot that I was the IT dept in a small company and not at the mercy of enterprise IT policies.
Most of this will be out of date by now though.
Originally I managed to hook up a Debian machine to Active Directory with direct kerberos and ldap. But that was flaky as hell and required quite some Active Directory wrangling.
Later once Samba 4 finally came out (seemed to take forever), I switched to a combination of installing MS SFU (Services for Unix) which extended AD with some posix attributes, and using winbind from Samba. I was using Ubuntu by then and even got all the developers switching as well.
This allowed everyone in the company to be assigned a fixed posix uid (and groups getting a gid), that would let them log into any Linux machine with their AD password and it would create a local user account for them and allow group permissions to apply etc. It would also allow for ssh to auth with kerberos to get anywhere else too. I even had AD SSO working for Firefox on Linux talking to an Apache hosted app on Linux. Nifty.
Getting GNOME Evolution to act like Outlook against Exchange Server was an on again off again effort that would usually kinda work, but was a little flaky - and the integration methods changed a few times.
RDP clients worked on Linux pretty well.
The main issue is that winbind was a bit prone to breaking with updates or samba upgrades - it was always a sort of 2 steps forward 1 step back thing. You'd gain features or get bugfixes only to have something else break occasionally.
I gather these days sssd is preferred over winbind, and I have no idea how the new EntraID world would work now everything is internet rather than LAN based.
both-shoes-off@reddit
Most of my IaC tools and even jump boxes or Bastian hosts are running on Linux. You can always remote into a Windows server for certain tasks that don't have a script or UI equivalent (which are few TBH). You should embrace tools like Ansible or Terraform and automate some tasks using bash or Powershell. Windows has been lifting ideas like package management, Sudo, and other tooling for some time. Once you try and automate Hyper-V versus VMware or Proxmox, or Windows Server versus a Linux host, you'll start appreciating Linux a lot more.
picastar@reddit
Linux sysadmin here, work for a MSP. Everything from the Company side is windows, so work from windows laptop. Most of the ms stuff I can do via webbrowser or web app, however there are a few select apps that needs windows. And the laptop kept up to date via azure intune etc. I want to change, but no way, company rules. We are not even admins on our own laptops go figure, we will install software😇 that compromise the company. Using ssh to clients Linux servers. So yes if you are allowed, do so and be true to yourself.
tuxsmouf@reddit
I'm a linux user at work. I use remmina to manage my widows rdp connections.
we no have to use a yubikey with a dedicated windows laptop with no internet access to get to a windows server with domain admin rights.I still don't know if I can use it on linux.
AusomeOllie10@reddit
I’ve gone from fully windows to 50/50.
Linux causes me a ton less headaches, however the headaches it does cause are usually complicated ones 😂
TheSarcastonaut455@reddit (OP)
Ya that’s what I’m worried about
chock-a-block@reddit
There are countless SSH clients.
If, for some crazy reason you need a GUI, mobaxterm probably the least pain free solution.
dracu4s@reddit
I also use Linux as my main machine. We use an PAW (Priviledged Access Workstation) from where i have access to all machines where i connect via RDP. We use O365 and i use the inofficial Teams for Linux App for messaging and the browser for Outlook and so on. It works very well. I have made an Webapp from every O365 App i need .
silasmoeckel@reddit
Where I work sysadmins don't have any special privileges on their day to day login/machine. Anything requiring them is via an RDP session, so really no change in workflow. Little different than a unix admin that would SSH in.
serverhorror@reddit
I wouldn't, I have to deal with Windows as part of my work. I have a VM which I use to manage these machines.
Inevitable-Reading-1@reddit
Moved to Linux, never looked back. I have windows VM accessible for the I need a windows only feature.
If you are smart enough, and not restricted by your company, you can do almost everything from Linux.
Inevitable_Use3885@reddit
I recommend using a local Windows VM for things like RSA tools or SQL management. Honestly, in many cases, depending on your environment, you should be using a "jump box" that's either a VM or a physical machine in a secured location with network access controls to make sure only your machine and username can access it.
That let's you prevent direct management access from a VPN while still allowing you to manage remotely. For example, a VLAN that your account can access via PPPOE connection (when you're working on-site) and that NAC drops you into when you're working remotely.
Make sure you you 2FA (MFA). You can domain join your Linux machine easily enough. The last time I checked, the NTLM authentication due PowerShell remoting was borked and there was no Kerberos option. Don't use NTLM anyway. It is CONSIDERED HARMFUL. You CAN allow SSH on your servers for PowerShell remoting, but you'll have to evaluate that risk based on your own environment.
For me, the experience was only very mildly painful, consisting of a brief learning curve and then the usual customization and shakedown of a new workflow. Overall, I recommend it. It's very much the best of both worlds.