Can domain user profile on PC be logged into indefinitely after losing connection to SBS?

If a workstation is away from the Domain, it will used Cached Domain credentials. I think a workstation can live this way for some weeks perhaps a month this way.

If a server actually is going to be decommissioned, disjoin from Domain first or you may not be able to disjoin later. Then if something goes wrong you have an issue.

In pretty sure I've had a machine that worked for years like that.

Might have been Server 2003 domain - hard to remember now, and possible things have changed.

Alan

Thanks everyone!

So I need users to be able to change passwords, so sounds like just letting it roll forever will not be an option for me... though I guess it does mean I can slowly migrate user profiles with forensit instead of all at once.

To confirm disjoining the domain, just makes the user profile not available right?  I have to use forensit tool to actually migrate domain user profile to local user profile - right?

Lastly - how does forensit work?  does it "move" the profile or "copy" it?  (I ask because I think some users have large files, and low free disk space, so they might not have the free disk space to have 2 copies of user profile on the machine at once.

Hi Xetroximyn,

I would seriously consider moving to Windows Server 2016.  The costs of administering a domain of twenty users would likely be lower than doing it without Windows Server.


Alan.

Forensit can move a Profile but it keeps a backup so far as I know

User Profile Wizard does not leave a backup. it modifies ACLs and makes necessary registry changes to re-assign the profile folder to a different SID.

if you migrate your existing domain to a new Server 2016 Essentials system it will preserve SIDs and there will be no need to migrate profiles.

understand if you remove the domain entirely you lose centralized user management. that's one of the key features of domains. by implementing an essentials system you get additional capabilities you can implement such as workstation backup.

I would suggest you experiment and learn the user profile wizard. as I said it's free so create a test account and try it to understand how it works.

You can also backup the profile separately and should do that in case you need to be repeat the process

Windows SBS has been nothing but trouble for me... it got screwed up to the point that Dell took weeks to fix it with no explanation or understanding of what was wrong -they just went through every wizard in the world. (The problem was the server just stopped talking on the network AT ALL sporadically a few times week, until it was rebooted...

I just got done dealing with a case of a user account constantly getting locked out and unable to access network folders because the account was locking out within seconds... i rebooted the PC, I checked the saved credentials for the user... eventually I had to just create a new domain user for this user to use (they are on a non-domain PC BTW - but I had the same thing happen to a domain user once - and since they were a domain user I couldn't just change their network credentials and be done with it - I spend days/weeks with people on EE that could not solve the problem or help me figure out why the account was getting locked out.... it's seems like madness to me... fragile madness).

Our main production is on linux servers which run like rocks, and dealing with domains and all the things that have to work in unison to make them work on the fragile domain, just seems not worth it to me.  I feel I'd be better off using google drive for files (we already pay for google apps for email), and using something like CW Automate to centrally manage PC's, users, passwords, and patching, etc.  (keep in mind we have 200+ Ubuntu PC's and maybe 40-50 windows PC's...).  

In any case - QUESTION - I have a 2008 R2 server that is part of the domain - it's used as a very large file server for recordings (we are a call center)... it is NOT going EOL for another year or so.   I just want to confirm - if I do get rid of the domain, I can remove this server from the domain?  Hmmmm... but wait... what about CAL's?  I wonder if those are tied to our domain... so that removing it from the domain would disconnect the CAL's?  ugh... maybe I should just make that a linux server...

Speaking of CAL's - I've been asking my guy at CDW and can't get a clear answer on if CAL's are needed for WSE... also what happens if we wind up outgrowing WSE?  Sounds like we have to buy whole new windows standard license and CAL's...

Hi Xetroximyn,

From your post above, it sounds like you (and / or your team) are very competent with Linux.

If so, then why not just migrate everything over to Linux, and remove the Windows machines entirely?  It would make for a much simpler environment to manage, compared to having a mixture.

You will still want the centralised user management, single sign-on, and all that, but I guess you could do that more easily on Linux given the expertise you have available on that platform.

You can also move all your desktops over to Linux (I prefer Ubuntu for end-users but whatever you prefer), which means you can ditch the profiles that prompted your question in the first place.


Alan.

Windows SBS has been nothing but trouble for me... it got screwed up to the point that Dell took weeks to fix it with no explanation or understanding of what was wrong -they just went through every wizard in the world. (The problem was the server just stopped talking on the network AT ALL sporadically a few times week, until it was rebooted...

That's your first problem - you asked Dell to fix it.  SBS works GREAT.  IT's incredibly stable and provided many things that standard server didn't at a price point most SMBs found acceptable.  The problem is, when you treat it as a bundling of Exchange and Windows Server or decide to NOT implement components that were MEANT to be used, you break it.  It was a TIGHTLY integrated set of products and features that worked great so long as you understood how it was meant to work.  If you didn't use the wizards for everything, or tried to adjust things to fit your ideas, you could break things.

I just got done dealing with a case of a user account constantly getting locked out and unable to access network folders because the account was locking out within seconds... i rebooted the PC, I checked the saved credentials for the user... eventually I had to just create a new domain user for this user to use (they are on a non-domain PC BTW - but I had the same thing happen to a domain user once - and since they were a domain user I couldn't just change their network credentials and be done with it - I spend days/weeks with people on EE that could not solve the problem or help me figure out why the account was getting locked out.... it's seems like madness to me... fragile madness).

This doesn't happen for no reason.  Your user likely set something up that used his or her credentials for authentication.  Then forgot about it, changed their password, meanwhile this service keeps trying to log in so the account gets locked.

Our main production is on linux servers which run like rocks, and dealing with domains and all the things that have to work in unison to make them work on the fragile domain, just seems not worth it to me.  I feel I'd be better off using google drive for files (we already pay for google apps for email), and using something like CW Automate to centrally manage PC's, users, passwords, and patching, etc.  (keep in mind we have 200+ Ubuntu PC's and maybe 40-50 windows PC's...).  

If you understand Linux, you can use it.  I have a client where the CIO doesn't understand windows, put in a linux back end, and doesn't maintain it nor does he show up for more than 40 hours PER YEAR (I'm not exaggerating).  He does do a LITTLE from home when you pester him multiple times, but in the end, we're putting in a highly stable Windows system so that support options are greater and their not tied to this guy who does nothing but irritate people by not responding to problems. But I digress.  I have a client using Gmail (before I got them) and a non-profit I work with that also uses it and it's a nightmare.  I don't recommend them.  But if they work for you...

The fact that you have 200+ Ubuntu systems suggests that SBS was the wrong thing for you to begin with.  While licensing is NOT by the device (usually), SBS had a 75 user limit.  Further, if you understand licensing (or were advised properly), you were probably in a license violation state since ANYONE that uses SBS for anything needs a license - that means the guy who connects his phone to the Wifi and gets a DHCP address issued by the server, the person who uses the DNS to connect to www.google.com needs a license, etc.

In any case - QUESTION - I have a 2008 R2 server that is part of the domain - it's used as a very large file server for recordings (we are a call center)... it is NOT going EOL for another year or so.   I just want to confirm - if I do get rid of the domain, I can remove this server from the domain?  Hmmmm... but wait... what about CAL's?  I wonder if those are tied to our domain... so that removing it from the domain would disconnect the CAL's?  ugh... maybe I should just make that a linux server...

Your SBS CALs do not convert (unless you had Software assurance and maintained it through the release of Server 2012).  If you keep the SBS Server running the SBS CALs cover your identified users (or devices) for access to other servers.  The minute SBS goes away, you need new CALs.  Now the CALs will cover ALL servers for the edition that the CALs are for (or less) (meaning, buy 2016 CALs and 2016, 2012, 2008 servers are all covered - ALL the servers, but future servers like Server 2020 (if that's what they end up calling it), will NOT be covered by the CALs.

Speaking of CAL's - I've been asking my guy at CDW and can't get a clear answer on if CAL's are needed for WSE... also what happens if we wind up outgrowing WSE?  Sounds like we have to buy whole new windows standard license and CAL's...

My suggestion for using WSE was based on the idea that you had 20 users.  If you have far more than that (or really any more than that) and I would say WSE is NOT appropriate.  If WSE is your ONLY server (and you are within it's licensing limitations), you do not need CALs for it (up to 25 users/50 devices).  The minute you add another Windows Server, you need CALs because that server is NOT covered by any CALs with WSE (WSE doesn't come with any; it doesn't require them!)

Licensing Disclaimer
License information provided here is "best efforts".  The comments of the respondents are based on interpretation of the license agreements and their knowledge of the particular laws and regulations in their geographic location.  Laws in your location may invalidate certain aspects of the license and/or licenses can change.  "They told me on Experts-Exchange" will not be a valid excuse in an audit.  You need to contact the license granting authority to confirm any advice offered here.

Thanks for the feedback!

To be clear the SBS only provides DHCP for about 5 machines.  And the 200+ Ubuntu machines use firewall DNS.  

Even though Ubuntu is not using windows services, I think WSE will not fit for us becase of the 25 user limit.  (if we could have 40 users/40 machines, it might fit - but 25 users/50 machines I think will not).  Which leave us with Windows standard if we went that way.

I'm trying to get my CDW guy to get me . TCO for that including 35 CAL's (I assume WIndows standard 2016 with 35 cals would cover access to that other 2008R2 server as well)

All that said - I think my main goal will beto show the TCO of Windows will not be worth it for us when I compare that to using 3rd party tool like CW Automate, and Google Drive for file storage.

Not to get too far off Topic but @lee you have me very curious - what was the nightmare you encounter with gmail/google apps?  I have been using the service for years now, and have had very few issues, and the few I did support was great and fast to assist with.  Because I consider using them on larger scale (i.e. to store and share 1TB of files) I'm curious what nightmares you ran into, if you don't mind elaborating.

TCO depends on how long you keep it.  

Windows Server 2016 is licensed by Cores.  Assuming you server has 16 or fewer cores, the cost is $880 (though I usually discount that for my clients).  The CALs are, if memory serves, $37 per user.  These are NON-RECURRING costs.  From a licensing standpoint, total cost would be $2175. Spread that over 8 years (a not unreasonable, in my opinion, lifespan) and that's about $272 per year, or under $8 per user per year.

Biggest nightmare with Google is email.  We have a list serve on a linux machine that they refuse to stop categorizing as spam.  Second biggest headache is the file sharing... if we don't explicitly invite people to access the file in question, they don't see it.  My Girlfriend's school also uses it (she teaches Kindergarter) and I hear nothing but complaints about saving things to it and especially editing documents.  We once tried to copy an excel sheet that used the checkbox in the Wingdings font - it didn't translate.  To me, google is a mess... if you can work how THEY want you to, I'm sure it's fine. But if you like to have any control over things, forget it.

Regarding getting flagged as spam sounds like your linux server needs proper mx/dns records set up... if you have that google will accept email just fine.  If you dont, IMO then all email providers should flag you as spam.  I think there are tools online to make sure you have proper DNS records set up.  

File sharing is simple and flexible as can be in google apps. It's hard to imagine that would be a pain point.  (particularly compared to windows) Sure you can share with people (login required) but you seem to think you HAVE to invite them or they can't see it.  

Check out the options on the share panel... you can share via link (anyone in our org can view) OR you can share via link and ANYONE with the link can view (and if you want edit). no login required at all.  sharing a file does not get any more simple than that :-)

As far as MS Office compatibility, I am personally impressed with how well google handles MS Office files.  

If you had to pick a company that forces you to work how THEY want you to work, I'd have to say Microsoft takes the cake.  I mean... does MS Office attempt to open gdoc files.. how about save to gdoc format?  Atleast google tries to make it so that you can still use MS Office formats if you want.  Apparently not perfectly... but atleast they put effort into allowing people to use MS Office if they want.

In any case enough deraling the thread lol.. (my fault I know!)

You mention $8/user/year as a TCO... that is not including support contracts and cost of infrastructure/backups/etc to run the server...

With google for instance, redundandy/infrastructure/support is all built into the cost.

So when I am looking for TCO of windows I am looking for total cost of ownership - to include support, backup software, infrastructure to run the server, infrastructure to provide backups for the server both locally and remotely/cloud... all that adds up to WAY more than $8/yr/user... right?

Im trying to get my CDW guy to get me the "true" TCO for windows - but I would be curious if you want to take another stab at it and include the TOTAL cost of ownership, not just the cost of licensing spread over 8 years. :-)

Regarding getting flagged as spam sounds like your linux server needs proper mx/dns records set up... if you have that google will accept email just fine.  If you dont, IMO then all email providers should flag you as spam.  I think there are tools online to make sure you have proper DNS records set up.  

I haven't been involved with the technical side directly for years, but I know we have the appropriate DMARC/SPF records setup.  

File sharing is simple and flexible as can be in google apps. It's hard to imagine that would be a pain point.  (particularly compared to windows) Sure you can share with people (login required) but you seem to think you HAVE to invite them or they can't see it.

Check out the options on the share panel... you can share via link (anyone in our org can view) OR you can share via link and ANYONE with the link can view (and if you want edit). no login required at all.  sharing a file does not get any more simple than that :-)

I don't think there's a separate non-profit version of file sharing, but we've had several supposedly knowledgeable folks look at this and too often someone has said the file was on Google, they go looking for it and until they get sent a link, they can't open it.  If it's not easy enough for non-tech people to figure out, it's not easy enough to be a solution one should consider.

As far as MS Office compatibility, I am personally impressed with how well google handles MS Office files.  

Really?  Wow.  I've been nothing but disappointed and as I've said, it's been a huge pain.  OpenOffice does a better job than Google.

If you had to pick a company that forces you to work how THEY want you to work, I'd have to say Microsoft takes the cake.  I mean... does MS Office attempt to open gdoc files.. how about save to gdoc format?  Atleast google tries to make it so that you can still use MS Office formats if you want.  Apparently not perfectly... but atleast they put effort into allowing people to use MS Office if they want.

If you want to be a Word Processor you HAVE to support .doc/.docx.  I've never heard anyone before suggest I send them a gdoc or an odt file... although Office DOES support .odt file format.  

In any case enough deraling the thread lol.. (my fault I know!)

You mention $8/user/year as a TCO... that is not including support contracts and cost of infrastructure/backups/etc to run the server...

With google for instance, redundandy/infrastructure/support is all built into the cost.

What support contracts?  You buy Microsoft Support Contracts?  The only people I've ever heard of buying support contracts are HUGE businesses with 1000's of users.  

So when I am looking for TCO of windows I am looking for total cost of ownership - to include support, backup software, infrastructure to run the server, infrastructure to provide backups for the server both locally and remotely/cloud... all that adds up to WAY more than $8/yr/user... right?

Are you saying you DON'T backup your Google documents?  Again, the file sharing aspect I'm not intimately familiar with, but Google doesn't seem to offer versioning (something equivalent to a Windows File Server's Volume Shadow Copy).  And even if they did, it's unwise, in my opinion to NOT maintain backups.  Just like Office 365 of Gmail - if you want backups of your mail, *YOU* back it up.  The tools for that are built in to Windows... not sure about Google.  But there can be an essentially zero cost for this from the Windows side.  Media is a wash - you need it for both, you can look at backup methodologies and I can't offer comparisons for Google, but some methodologies and tools are zero in cost and very low in cost for learning curve and testing.  

Costs vary depending on how intense you want to get.  And I'm assuming you already have virtualization in place. Given that, a Windows server needs Disk, RAM, and CPU.  Disk to cover whatever you need to store, redundantly.  RAM is minimal for a file server 2 GB is more than enough in most cases - chopping off 2 GB from an existing VM host doesn't seem a big deal, but if you want to price that out, $50.  One time.  Storage depends entirely on what you need, but if you're willing to go cloud, you probably don't need speed (no cloud connection is going to be faster than an on-prem RAID 6 with caching RAID controller (and again, I assume you already have a host system, so at most, add a few drives... let's say $600.  Backup depends on what you want.  Couple of external drives to create offline copies of your backups can be sufficient.  Use Hyper-V replica and replicate to another local system for redundancy and then to a remote site for off-site redundancy with minimal risk of data loss and use scripts and backup tools and you have minimal costs - the hardware can be a couple of old machines and the free Hyper-V server can be used.  You now have a low cost DR plan with off-site backups.  As with anything, you have to know what you're doing, which is why factoring that in to TCO isn't necessarily appropriate in my opinion.  You either understand the technology and how to implement it or you don't  It would cost me very little to implement this Windows solution but a heck of a lot more to do something with VMWare and Linux (which you may well find quick and easy).  You can add more things to both scenarios but you don't know what you don't know.  And you know VERY WELL I can't give you a detailed TCO without understanding your business, what you do, what you need to do, what kind of acceptable downtime you have, etc.  All these things play in to what you need and then based on what you need, you look at solutions - Google may be best for you... Maybe not.  As I've said to many people DO THE MATH.  And recognize there are things you don't know in both cases.  You don't know if google won't suddenly change their pricing scheme in 2 years and then your TCO is blown away... and you don't know if they won't start charging for getting the data out of Google... in which case, if you don't have local copies of everything, you could see a huge bill.  The cloud isn't CLEAR.  It's opaque.  It does many things for you and eases your burdens in many areas - but at the cost of not having the control or the ability to control your destiny.

Im trying to get my CDW guy to get me the "true" TCO for windows - but I would be curious if you want to take another stab at it and include the TOTAL cost of ownership, not just the cost of licensing spread over 8 years. :-)

Again, your guy can't possibly do that without knowing your business.  If you want to painstakingly detail it, we can come up with a more accurate estimate, but now you're getting into an area I charge clients for... I do a lot for free online... but I do have limits.

Thanks Lee!  I do realize this thread may be a bit derailed but in my opinion, it's informative (for both of us) to hear a little bit from the other side :-)  Also - I do still have some on-topic questions below because I am still seriously considering a Win2016 server (Standard w/ cals)

Are you saying you DON'T backup your Google documents?  Again, the file sharing aspect I'm not intimately familiar with, but Google doesn't seem to offer versioning  

Huh?  Google Drive keeps every version of every file for the past 30 days. (for google native files it's often much longer than 30 days)  And it allows restoring any of these versions in a way that is easy enough for a non-tech user to restore for themselves (vs me having to go restore it) In a google doc/sheet just goto "File > Version History".  For non-google files, you right click and select "Manage Versions".  

Additionally, in this dialog users (non-tech users) can select to keep particular version forever if they like (https://fieldguide.gizmodo.com/keep-older-versions-of-your-documents-on-google-drive-f-1671188573)

So yea - I don't backup my google documents beyond googles own backups.  I have used Drive for years personally and professionally and never, lost a file, or an email.

I don't think there's a separate non-profit version of file sharing, but we've had several supposedly knowledgeable folks look at this and too often someone has said the file was on Google, they go looking for it and until they get sent a link, they can't open it.  If it's not easy enough for non-tech people to figure out, it's not easy enough to be a solution one should consider.

I'm shocked by this - I'm curious if a file was shared with them and they were looking in "My Drive" instead of "Shared with me"...  File sharing in google is so wildly easy... if you have any problems though, google chat or phone support is generally available in less than 5 minutes... usually less than 2 minutes in my experience.   There is no reason to rely on "supposedly knowledgeable" people - just ask google support!

with regards to comment about "if it's not easy enough for non-tech people to figure out"... Do your windows users never need your support?  Do they know how to map a drive? Do they know how to share a folder?  I am guessing the only way your windows users know how to "share" files is probably by putting them in folders you shared, and then mapped as drives on their PC's right?  So if you have to set up a shared folder within google the same way, because the individual file sharing option is too complicated for them, that's pretty much the same thing - right? :-)

What support contracts?  

So we do have a VMWare server - and that has our main linux production servers on it - right now our Windows SBS is a physical system.  Dell's mission-critical support includes software support in addition to hardware - so when I have needed it, I used that.  (And I agree - Dell sucks in MANY MANY ways...)

You mention using Dell support was my problem... and you say that you don't know anyone who buys Microsoft support contracts except big companies... so what is the proper channel for simple support questions? (or complex migration questions)  If I pop Win2016 Standard in a small VM, with 40 CAL's, who helps me with the migration?  Who helps me if I need to set something up on the server I don't know how to?  Who helps me if the server stops talking on the network like my server did sporadically for weeks.  I am HAPPY not to use Dell... they suck is MANY ways... but then who?  (I am not trying to be smart here... I am seriously asking where you suggest I get the support... because while I am pretty staunchly set on using Google Drive at this point for file storage and sharing because I don't have to mess with backups or restores for users anymore... I am still considering using Win2016 Standard just to centrally manage users.  

With google, support is always just a couple minutes away 24/7.  Including detailed help with migration, using the admin console, etc. But Google can't centrally manage my windows users...

This doesn't happen for no reason.  Your user likely set something up that used his or her credentials for authentication.  Then forgot about it, changed their password, meanwhile this service keeps trying to log in so the account gets locked.

Yes - I'm sure it was something like that - my point was I spent days/weeks with people on EE that could not solve the problem or help me figure out why the account was getting locked out.  Shouldn't Windows be keeping some log... shouldn't I be able to identify WHAT is causing the lockout?  I have never had such a problem with google... but if somehow I did, I would not be surprised if google support could get to the bottom of it, and if not, I can more easily rename the user, without effecting the users login profile on thier PC.  (And thus possibly having to migrate it with forensit or something like that)

I haven't been involved with the technical side directly for years, but I know we have the appropriate DMARC/SPF records setup.  

Not sure what to say there... I have linux servers that most definitely DO NOT have correctly setup DNS/SPF records, and google accepts the email just fine... most of the time... Though it is true, I switched to having my linux server use mutt to send email through a gsuite gmail account - mostly though because I don't want to have my own SMTP server running...

If you had to pick a company that forces you to work how THEY want you to work, I'd have to say Microsoft takes the cake.  I mean... does MS Office attempt to open gdoc files.. how about save to gdoc format?  Atleast google tries to make it so that you can still use MS Office formats if you want.  Apparently not perfectly... but atleast they put effort into allowing people to use MS Office if they want.

If you want to be a Word Processor you HAVE to support .doc/.docx.  I've never heard anyone before suggest I send them a gdoc or an odt file... although Office DOES support .odt file format.  

You got me there... Microsoft built a great monopoly... possibly by intentionally sabotaging Word Perfect, it's main competitor in the 90's Office arena... but either way, they won.  Point here is that you said about google

if you can work how THEY want you to, I'm sure it's fine. But if you like to have any control over things, forget it.

I'm just pointing out how Microsoft is notorious for "their way or the highway" :-)

Also - if you think google is inflexible, perhaps you have not looked around the admin panel very much?  If you were not even aware google Drive provides backup/versioning, I can't imagine, how you know enough about google's offerings to accuse them of being inflexible.  :-)

Oh yea...

RAM is minimal for a file server 2 GB is more than enough in most cases

As mentioned I probably wont even be using this as a file server... just a Central user/device management server... is 2GB RAM really enough?  (say for 40-80 devices?) . (I went up to 80 because small chance I would try to get the call center PC's (the 40 or so that are windows) onto the domain so I atleast have ALL my windows PC's on the domain)

And I ask this because I have been a lifelong windows desktop user until last july when I switched to Mac (I am a developer in my day job)... But until 9 months ago I used windows all my life.  2GB is what I used for XP.  4-8GB for vista.  8-16GB for v7 and 16-32GB for v10 (though I admit the 32 was overkill, but ya know... factors of 2 are the common jumps)...

Point is I am flabbergasted at the idea of running a windows AD server with just 2GB of ram... (I guess networking services are way less taxing than desktop use?) if that would really work, that is a STRONG argument for doing it... the cost of service license+cals what surprisingly cheap.... If I can really get away with 2GB RAM then I don't even have to worry about upgrading the RAM of my vmware server.

A few more things...

RAM is minimal for a file server 2 GB is more than enough in most cases

As mentioned I probably wont even be using this as a file server... just a Central user/device management server... is 2GB RAM really enough?  (say for 40-80 devices?) . (I went up to 80 because small chance I would try to get the call center PC's (the 40 or so that are windows) onto the domain so I atleast have ALL my windows PC's on the domain)

And I ask this because I have been a lifelong windows desktop user until last july when I switched to Mac (I am a developer in my day job)... But until 9 months ago I used windows all my life.  2GB is what I used for XP.  4-8GB for vista.  8-16GB for v7 and 16-32GB for v10 (though I admit the 32 was overkill, but ya know... factors of 2 are the common jumps)...

Point is I am flabbergasted at the idea of running a windows AD server with just 2GB of ram... (I guess networking services are way less taxing than desktop use?) if that would really work, that is a STRONG argument for doing it... the cost of service license+cals what surprisingly cheap.... If I can really get away with 2GB RAM then I don't even have to worry about upgrading the RAM of my vmware server.

Though I still have that question of SUPPORT from my last post (which aside from my questions, personally I recommend you read to understand the benefits of good services a bit better)

Oh - also - can you help me understand what exactly are the benefits of a Windows2016 Standard server?  Can it really "FORCE" windows/office patches out to domain PC's?  Can it generate decent looking reports on patch status we can show clients?  How about third party updates? (pdf, filezilla, etc) .

Also - can I "easily" run scripts on the domain PC's?  Either to transfer and install a new app, or to do any sort of system config?  Can I do this both on-demand/immediate, as well as scheduled?  

I am comparing this to tools like CW Automate, Atera, and GoverLAN.  

Thanks!

Question answered.