# Active Directory without Windows Server.

Source: https://vetosec.at/en/solutions/active-directory-linux/

A Windows Server just for user sign-in costs licences per server and per user. We provide the same domain on Linux. Sign-in, group policies and network drives work as before.

- **Windows sign-in** as usual
- **No** server or CAL licences
- **Redundant** from 2 servers

## What changes for you

- **Familiar PC sign-in**: PC sign-in, network drives, printers and group policies work as before.
- **Licence costs drop**: No Windows Server licences and no per-user access licences for the domain. The money goes into security and operations instead of licences.
- **Smaller attack surface**: A lean Linux server gives attackers fewer entry points than a full Windows Server.
- **Resilient**: Two domain controllers that sync with each other. If one fails, your team still signs in.

## What runs behind it

- **Compatible with Windows**: Speaks the same protocols as a Windows domain controller: Kerberos, LDAP, DNS and group policies.
- [**Hardened and automated**](https://vetosec.at/en/how-we-build/): Every server set up to a recognised security baseline, updates rolled out under control.
- [**Connected to single sign-on**](https://vetosec.at/en/solutions/single-sign-on/): Domain accounts also work for file cloud, VPN and web apps.
- **Windows Server where needed**: If business software strictly requires Windows Server, we run it. Just not where it adds nothing.

[How we build in general](https://vetosec.at/en/how-we-build/)

## Service or project

**We run it for you, or your team takes over.**

As a managed service for a fixed monthly price, with updates, backup and monitoring. Or as a project with handover of network plan, runbook and all credentials.

## For IT leads

Technical details: Samba AD · Debian · Kerberos · Ansible

- **Domain controller**: Samba as Active Directory domain controller on Debian.
- **Protocols**: Kerberos, LDAP, DNS and group policies, managed with the Microsoft tools (RSAT).
- **Redundancy**: At least two domain controllers with replication.
- **Hardening**: To a recognised baseline, set up with Ansible.
- **Single sign-on**: Domain accounts via LDAP also for file cloud, VPN and web apps.
- **Limits**: On-prem Exchange and some business software need Windows Server. We check upfront.

## Further reading

More on the topic

- [**Samba Active Directory**](https://vetosec.at/en/it-security/samba-active-directory/): Yes.
- [**Permission model and least privilege**](https://vetosec.at/en/it-security/berechtigungskonzept/): A permission model defines who may access which data.
- [**Berechtigungskonzept für KMU: Eine einfache Struktur, die funktioniert**](https://vetosec.at/en/articles/it-wissen/berechtigungskonzept-kmu-vorlage/): A simple, workable access-control model for SMEs.
- [**Linux-Server härten: Eine praxistaugliche Checkliste**](https://vetosec.at/en/articles/cybersecurity/linux-server-haerten-checkliste/): A practical Linux server hardening checklist.

## Frequently asked questions

### Does this work with Windows PCs?

Yes. Samba provides an Active Directory domain that Windows PCs join like a Windows Server. You manage group policies with the usual Microsoft tools.

### Are there limits?

Some Microsoft products such as on-prem Exchange require Windows Server. We clarify that upfront with an assessment.

### Which technology do you use?

Samba as Active Directory domain controller on Debian, redundant with at least two servers, hardened and set up automatically.

### Who do you offer this to?

For regulated companies, professions bound by confidentiality and anyone processing sensitive data, and for companies of about 30+ staff with critical systems.

## Related

- [Solutions](https://vetosec.at/en/solutions/): Nextcloud, SSO, backup, clusters
- [Managed services](https://vetosec.at/en/services/managed-services/): fixed price per service
- [How we build](https://vetosec.at/en/how-we-build/): security and backup standards

## Samba Active Directory on Debian as a Windows Server alternative

vetosec runs Active Directory domains with Samba on Debian for businesses in Austria, without Windows Server or CAL licences.

Updated: October 19, 2026

Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/