{"id":1881,"date":"2014-04-17T07:00:12","date_gmt":"2014-04-17T13:00:12","guid":{"rendered":"http:\/\/www.jumpcloud.com\/?p=1881"},"modified":"2019-11-05T20:01:32","modified_gmt":"2019-11-05T20:01:32","slug":"four-options-managing-windows-server-admin-access-cloud","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/four-options-managing-windows-server-admin-access-cloud","title":{"rendered":"Cloud Options for Managing Windows Server Access"},"content":{"rendered":"\n
Another key scenario that we have heard when talking with customers is how to manage user access to a Windows server in the cloud. In <\/span>talking with a number of hosting and cloud providers<\/span><\/a>, we have heard Windows cloud server uptake anywhere from 25% to 50%. So it\u2019s clear that organizations are shifting their Windows servers to the cloud. The interesting problem is that managing administrator access to those Windows cloud servers is not so easy! Waving your hand and saying AD will handle it belies some of the key challenges that having Windows in the cloud presents.<\/span><\/p>\n\n\n\n Organizations that are leveraging Windows servers internally often use Active Directory to manage user accounts. Decent-sized Windows shops can use the power of AD and all that it brings \u2013 GPOs, groups, etc. Of course, the challenge with AD is that it is a heavy application that requires dedicated management. It isn\u2019t easy to set up, configure, operate, and maintain. However, it provides great control over a domain for larger organizations. As soon as organizations start to spin-up Windows servers in the cloud, it introduces a new paradigm that AD wasn\u2019t really built for.<\/span><\/p>\n\n\n\n To manage privileged user access for Windows cloud servers, organizations have a few options. We\u2019ll review the options and then go through some of the pros and cons. If you have AD internally, you can try to leverage your existing implementation for your cloud servers. Another option is to set up AD in the cloud and have that exclusively for your cloud servers. A third option is to purchase an on-premise piece of software that will connect your internal AD implementation with your cloud servers. The fourth option is to manually manage those accounts. We\u2019ll discuss the fifth option here shortly, but those have generally been the options that IT pros have been left with to manage Windows admin accounts.<\/span><\/p>\n\n\n\n You already have AD setup and running, your users are already in one central user database, and your admins are already managing it. That\u2019s a great start. The downside to this option is really simple: security. In order to make this one work, you need to expose your AD server to the Internet. For most companies, that\u2019s a bright line that they won\u2019t cross.<\/span><\/p>\n\n\n\n This allows you to manage your Windows servers \u201cnatively\u201d through Microsoft. But the challenge is that your admins now have two AD systems to manage. They won\u2019t synch theoretically because you are unwilling to expose your initial AD implementation to the Internet. This option may be a possibility for those that don\u2019t have an AD server internally. Then again, if you don\u2019t have one internally, why would you have one for your cloud servers?<\/span><\/p>\n\n\n\n There are identity and access control solutions that marry cross-platform and multiple locations together. These are legacy pieces of software mainly focused on enterprise authentication, authorization, and auditing. They were built to solve the whitespace of Linux and Windows co-existing and now multiple locations for your servers. The positives are you can centrally manage everything, but the cost is extreme. You have yet another identity management system \u2013 a heavy-duty one at that \u2013 to manage and maintain. These systems are also expensive and follow the old-school enterprise software license model. No pay as you go here!<\/span><\/p>\n\n\n\n This is not a bad option if you have a few servers and few admins. If things are relatively stable too, then you may just do it the old fashioned way and <\/span>manually manage it<\/span><\/a>. As soon as you hit any size or scale, this becomes unwieldy. Then, you are back to thinking about the first three options.<\/span><\/p>\n\n\n\n If like many DevOps and IT pros out there, none of these options seem that great to you, we agree! Managing Windows administrator access in the cloud should be simple and easy. That\u2019s one of the problems that we have focused on solving. There is no doubt that AD can be a fantastic solution inside an organization. However, when you mix in the cloud, you need a cloud-based solution<\/a> to solve the problem of managing users. You will avoid creating security risks, wrestling with heavy enterprise software, and spending more time managing solutions that weren\u2019t meant for the cloud. The goal of JumpCloud\u2019s Directory-as-a-Service system is to enable DevOps and IT admins to quickly and easily manage and control Windows (and Linux, Mac\u2026see below*) server access.<\/span><\/p>\n\n\n\n After <\/span>registering for an account at JumpCloud<\/span><\/a>\u00ae, we install a lightweight agent on your servers. From there, your admins log in normally with whatever username and password they have already set up. It is a seamless integration into your user management flow, except it is centralized across everything. On top of that, you can easily manage groups of servers and users. It’s simple, central Windows user management for cloud servers. This SaaS-based solution is pay as you go<\/a> and consistent with the cloud model. There’s no heavy-duty software to install and manage. You just get to accomplish the task at hand \u2013 managing your accounts.<\/span><\/p>\n\n\n\nThe positives and negatives of each approach are:<\/h4>\n\n\n\n
Extend your existing AD solution:<\/h5>\n\n\n\n
Secondary AD system:<\/h5>\n\n\n\n
Third-party software:<\/h5>\n\n\n\n
Manually manage user accounts:<\/h5>\n\n\n\n
JumpCloud’s Directory-as-a-Service\u00ae platform for windows servers:<\/h5>\n\n\n\n