Does moving Active Directory domain controllers to Samba AD lower the cost of identity?
Replacing Windows domain controllers with Samba AD removes Windows Server core licensing for the controllers it replaces, but the saving is partial. Windows client access licenses, any Windows servers that remain for other roles, and support work can still apply, so a renewal or Windows Server lifecycle decision should be costed as a whole estate rather than as a line item. Samba itself is licensed under GPL-3.0 with no license fee, according to the samba-team/samba repository, so the money moves into infrastructure, migration effort, and either an in-house team or an implementation partner such as DeployOpen.
Start by listing every Windows Server instance and every client access license tied to Active Directory, not only the domain controllers. Ask Microsoft or a licensing adviser to confirm which licenses are required for each role after a move, including whether any member servers, file servers, or applications still need Windows licenses and which Software Assurance or subscription terms apply. No Microsoft prices are given here, so the figures must come from your own agreement and a written quote from Microsoft or your reseller. Record the licensing position in writing before you commit to a date.
Three cost categories recur or stay open after the move. Infrastructure is a recurring cost for the Linux hosts, backups, and monitoring that run the Samba DCs. Support is partly internal, since your team must own Samba administration with samba-tool and the Samba wiki's setup guide describes the DNS and Kerberos choices you must make. Migration is mostly one-time, covering testing, coexistence and rollback planning. Ask any quote to separate those three categories, to state who carries the on-call duty, and to say what happens to Windows licenses during coexistence, because running both estates for a period can raise cost before it lowers it.
Which cost components change when Samba replaces Windows domain controllers
This table compares each cost component of a Windows domain controller estate with the same component under Samba AD on Linux, and marks whether it is one-time or recurring. Windows Server and client licenses are commercial costs that you confirm with Microsoft, while Samba is GPL-3.0 licensed and carries no license fee, so the remaining costs are labor, infrastructure, support and skills. Use the table to build a quote request, not as a price estimate.
| Cost component | Commercial Windows side | Samba AD on Linux side | One-time or recurring |
|---|---|---|---|
| Windows Server core licenses for domain controllers | Licensed per core on each domain controller under Microsoft terms; confirm current edition and core counts with Microsoft or your reseller | No Samba license fee; GPL-3.0 software | Recurring if on subscription, otherwise one-time per license purchase |
| Windows client access licenses (CALs) | May still apply for users and devices that connect to Windows servers; confirm which server roles trigger CALs under your agreement | Not required by Samba for the AD DC itself; confirm any client access terms for other Windows servers that remain | Recurring under most volume agreements |
| Windows member servers and file servers | Separate Windows Server licenses remain for member and file servers that stay on Windows | Samba member servers can handle file serving, and the Samba wiki recommends a separate domain member for file serving when multiple DCs exist | Recurring for remaining Windows servers |
| Linux operating system | Not applicable in a Windows-only estate | Required for Samba DCs; distribution support and subscriptions vary by vendor, so confirm terms with your provider | Recurring if you buy vendor support, otherwise minimal |
| Hardware or virtual machines | Existing domain controller hosts or VMs | Often the same hosts or VMs, with added capacity for Linux DCs during coexistence | One-time for added capacity, recurring for hosting |
| Migration and cutover effort | Not applicable beyond planning Windows upgrades | Joining Samba DCs, checking functional level, transferring roles, and validating SYSVOL and idmap before demoting Windows DCs | One-time |
| Implementation services | Vendor or partner fees for any Windows-side changes | Fixed-scope implementation, hardening and documentation, priced from a written scope | One-time |
| Support and upgrades | Microsoft support terms and Windows Server lifecycle upgrades | Samba release series move through full support, maintenance and security-only phases, so plan regular upgrades; confirm support options with your provider | Recurring |
| Internal skills and operations | Existing Windows administration skills and tooling | Need staff who can run samba-tool, DNS backend choices and Samba-specific troubleshooting; training or retainers are a recurring or one-time cost | Recurring staffing; one-time training |
What Windows licensing still applies in each estate pattern
This pattern replaces Windows domain controllers with Samba AD DCs and leaves other roles and clients alone. The Windows Server licenses tied to those DCs are the main line that can drop out, because they are counted against the hardware running the DC role. Any Windows Server access licenses tied to the DCs need a separate review, since their scope depends on what each server does and how users reach it.
- Core licenses on DCs: Windows Server core licenses are counted per physical core on each server running Windows Server. Retiring a Windows DC removes that count for that host, subject to the minimum core rules in your agreement.
- Access licenses: Windows Server client access licenses cover access to Windows Server services. Confirm with Microsoft licensing terms or a licensing advisor whether any obligation remains for authentication traffic alone.
- Virtual machine hosts: If DCs run as Windows virtual machines, check whether host licensing changes for the guests that remain on Windows.
- Software Assurance benefits: If the licenses came with Software Assurance, confirm how the entitlement, renewals and any downgrade rights change once the DC is retired.
- Recurring and one-time costs: Core and access licenses are usually bought once with renewal fees for Software Assurance or subscriptions. Samba costs are labor, hardware, support and training, which recur in a different pattern.
Before you plan savings, list each DC, its core count, its virtualization host and the Microsoft agreement that covers it.
This pattern keeps some Windows servers, such as file servers or application servers that join the domain, while the DCs move to Samba. Those servers keep their own Windows Server licensing, and access to their file or application services still follows the access license rules. The Samba wiki advises against running a file server on an AD DC when there are multiple DCs and recommends a separate Samba domain member for file serving, so the file service cost moves to a different host.
- Windows file servers stay licensed: If a file server remains on Windows, its core licenses and the access licenses for users who reach it still apply.
- Samba domain member for files: The Samba AD DC setup guide recommends a separate Samba domain member for file serving when multiple DCs exist. That host is a Linux server, so it carries no Windows core license, but it does need hardware, storage and admin skills.
- Where the cost lands: File serving cost shifts from Windows licensing to hardware, storage, backup and staff time for Samba file services. Those costs recur in your own budget, so compare them with the license line they replace.
- Application servers on Windows: Database or line-of-business servers that stay on Windows keep their own product licenses, which are separate from the domain controller decision.
- Member servers joined to Samba: Windows member servers joined to a Samba domain still need Group Policy and management tooling plans, which can carry their own costs.
Ask for a role-by-role inventory of each Windows host and the licenses that serve it before you decide which servers move.
This pattern moves domain controllers to Samba while Windows desktops and laptops still sign in to the domain. Windows client operating system licenses belong to each device and do not change because the directory changes. Access licenses for Windows Server apply to the servers that users and devices reach, so they stay in place for any Windows server that remains. Samba's functional level support also limits how far the domain can be raised, which affects what Windows features you can keep.
- Client operating system licenses: Desktops and laptops keep their Windows licenses, whether bought with the device or through volume licensing. Moving the domain controller does not remove that obligation.
- Server access licenses: Access licenses follow the Windows servers users connect to. If those servers remain, the licenses remain with them.
- Functional level ceiling: Samba supports the Windows Server 2016 functional level since Samba 4.20, so confirm that the features your clients need work at that level before you commit.
- Management tooling: Group Policy and device management need a plan for the Samba domain. Any third-party tool or consulting work carries its own cost and renewal terms.
- Client and server mix: Licensing follows the device and the server that it reaches, so a mixed estate needs both lists.
For each client group, confirm the Windows edition, the servers it reaches and the management tools it depends on before you change the domain.
What moves the Active Directory and Samba cost comparison
The cost gap between Windows Server domain controllers and Samba AD depends on how many controllers you run, which Windows machines still need licenses, and what your directory depends on beyond authentication. Each driver below changes the size of the license saving, the migration effort or the skills you need to keep the estate running.
Number of domain controllers and sites
Every domain controller is a licensing unit on the Windows side, so a estate with many DCs across many sites pays for each one. On Samba, the same DCs run on Linux without a per-server Windows license, but each still needs hardware or virtual machines, monitoring and replication checks. Ask how many DCs you would need per site for availability, not only how many you run today. Treat the license line and the infrastructure line as separate costs.
Windows servers and clients still licensed
Windows Server core licenses are the saving on domain controllers, but file, print, application and database servers that remain on Windows still need their own licenses. Windows client access licenses (CALs) may also still apply for users and devices that connect to those servers. Inventory every Windows server and client that authenticates to the domain before you estimate savings, because removing DCs does not remove these costs.
Functional level in use
The domain functional level sets the newest features your forest can rely on, and Samba supports functional levels up to 2016 since Samba 4.20. If your estate runs a higher level, or depends on features only a newer level provides, Samba is not a like-for-like replacement and the migration scope grows. Confirm your current forest and domain levels, then check them against the Samba wiki's functional level notes before you model costs.
Group Policy and SYSVOL dependencies
Group Policy objects, scripts and software deployment often rely on SYSVOL replication and Windows-only management tools. Each dependency you keep on Windows keeps part of the license and management cost alive, and each one you rework adds project effort. Inventory GPOs, logon scripts and third-party agents that read SYSVOL, and decide early which ones move to another tool and which stay.
Availability and disaster recovery requirements
Replacement DCs must meet the same recovery targets as the Windows DCs they replace, which often means extra replicas in each datacenter and tested restore procedures. Samba and Windows both need backups and replication monitoring, so the recurring cost depends on how often you test recovery, not only on the license. Ask your team for the recovery targets written in your continuity plan and cost the replica count against them.
In-house Linux and Samba skills
Running Samba DCs well requires people who can administer Linux, Kerberos, DNS and samba-tool, and who can troubleshoot replication. If the team already runs Linux servers, the added cost is mostly training and on-call coverage. If it does not, the cost is either hiring, external support or a fixed-scope implementation followed by a support retainer. Count these people as a recurring cost in every comparison.
How to build the Active Directory and Samba cost model with your own numbers
This sequence turns vague licensing concerns into a side-by-side model of what Active Directory costs today and what a Samba AD estate would cost over the same period. The output is a single set of one-time and recurring totals you can take into a quote request.
Inventory domain controllers, servers and clients
Start by listing every domain controller, member server and client device that authenticates against the current Active Directory forest, along with its operating system version and role. Pull the licensing position for each from your Microsoft agreement, including which Windows Server core licenses are assigned to each DC and which client access licenses (CALs) cover users and devices. Confirm the position with your Microsoft licensing contact or reseller, because agreement terms vary. Done when every DC and server has one row with its license basis and renewal date, and you can state the current annual or term cost for each.
Map the Samba footprint per domain controller
Design the Samba side with the same granularity. For each planned Samba AD DC and its replicas, record the host sizing, the operating system it runs on, the DNS backend you intend to use (SAMBA_INTERNAL or BIND9_DLZ), and the site it serves. Note which servers will run file services, because the Samba wiki advises a separate domain member for file serving rather than an AD DC. Done when every planned Samba server has a row and the replica count per site is written down, so the infrastructure line items match the topology.
Price migration and cutover effort from a written scope
Migration effort is the largest one-time cost and the hardest to estimate without a defined scope. Write down the coexistence work: joining Samba DCs to the existing domain, checking the functional level, transferring FSMO roles, handling SYSVOL and identity mapping, testing Group Policy and client behavior, and retiring Windows DCs. Ask one or more integrators to quote against that written scope, and ask for the assumptions behind each line. Done when you hold comparable quotes that name the same tasks, so differences reflect method rather than unstated scope.
Add support and upgrade time for the Samba release series
Samba is open source, so its recurring cost is the time your team or a partner spends keeping it current. Samba 4.25.0 is the current stable release, and Samba 4.24.8 is also available for download. Each release series gets six months of full support, six months in maintenance mode and six months of security fixes only, with Samba 4.25 starting in September 2026. Plan for upgrades inside that window and estimate the staff hours each upgrade cycle needs, including lab testing. Confirm whether a support contract from a vendor or integrator is part of the quote. Done when the recurring upgrade and support line is written as hours per cycle plus any contract fee.
Add internal skills and training time
Running Samba domain controllers requires Linux administration, Kerberos and DNS knowledge, and the samba-tool command set. Estimate the time your current administrators need to learn these tasks, the time spent on a pilot, and any training or outside expertise you intend to buy. Also count the staff time that Windows-only operations, such as Group Policy management, will require for the new estate. Done when each skill gap has an hours estimate and a named owner, and the estimate is reviewed by the people who will run the platform.
Total one-time and recurring costs over the same period
Put both estates on one timeline, using the same number of years for the Active Directory and Samba columns. Separate one-time costs (migration effort, pilot, training, hardware or virtual machines) from recurring costs (Windows licensing renewals and CALs on one side, Samba hosting, support and upgrade hours on the other). Include the Windows client and server licenses that remain for other workloads, because they do not disappear with the domain controllers. Done when the model shows yearly totals and a cumulative total for each option, and every row cites the source document or quote that supports it.
Request quotes built from the written scope
Send the written scope, the inventory and the topology to vendors and integrators, and ask each to quote against the same deliverables and assumptions. Ask for line items for migration, cutover testing, documentation, support hours, and any upgrade work per Samba release series. Ask what is excluded and how change requests are priced. Done when each returned quote can be placed in your model line by line, and any gap between quotes is explained by a stated difference in scope.
The skills and support needed to run Samba domain controllers
The first decision is whether your team can run Samba as an Active Directory domain controller day to day, because the cost case depends on skills you already have or can build. The core skills are samba-tool administration for users, groups, replication and DNS records, a working understanding of Heimdal Kerberos, which is the default key distribution center in a Samba AD DC, and enough Linux operations knowledge to manage the host, time synchronization and backups. Treat Kerberos ticket behavior and clock skew as first-line troubleshooting topics, since they cause most authentication failures in a mixed Windows and Linux estate. Before committing, have your administrators run a test domain for a few weeks and confirm they can add a second DC, check replication health and restore a DC from backup without outside help.
DNS is the area where teams most often underestimate the work. A Samba AD DC supports the SAMBA_INTERNAL and BIND9_DLZ DNS backends, and the Samba wiki warns against the NONE backend and states that BIND9_FLATFILE is not supported. Your operators need to know which backend you chose, how zone data is replicated, and how client resolvers point at the DCs. Functional level raising is a one-way, planned change made with samba-tool, so the runbook should record the current level, the Windows Server level you need to support and the Windows DCs that must be gone first. Plan upgrades around Samba's release series. Each series gets six months of full support, six months of maintenance and six months of security fixes only, and the Samba release planning page lists the current dates. Confirm which series your estate will run and when you must move to the next one.
On support, Samba is licensed under GPL-3.0 and is maintained by a community, so no vendor is obligated to answer your tickets or fix your incident on a deadline. You can staff this in-house, contract a support provider, or combine both. If you contract, the written scope defines what is covered: hours of response, which Samba versions and DNS backends are included, upgrade and patching responsibilities, backup and restore testing, and what happens during an outage. DeployOpen agrees scope, deliverables and timelines in writing before work starts, and ongoing support is available as a retainer. Ask any provider, including us, to show the runbooks, escalation path and restore test results before you sign.
Questions buyers ask before pricing a Samba AD move
How much does Samba cost in licenses?
Samba carries no license fee. It is licensed under GPL-3.0, so the software itself is free to download, install and run in your own infrastructure. The cost of a Samba domain controller sits elsewhere: Linux operating system subscriptions if you buy them, server or virtual machine capacity, backup tooling, monitoring, and the staff time to build, operate and patch the domains. Ask any vendor or partner to separate software from support and labor so you can compare the recurring and one-time costs side by side.
Which Windows licenses still apply after domain controllers move to Samba?
Windows Server core licenses for the domain controllers you retire stop being needed once those servers are decommissioned. Windows client access licenses may still apply for other Windows servers that your users connect to, such as file, print or application servers, and they depend on how those servers are licensed and accessed. Confirm with Microsoft or your licensing partner which Windows Server and CAL entitlements remain for each remaining server role, and keep the inventory of who and what connects to each one.
How long does a migration to Samba AD take?
The duration depends on the drivers you control: the number of domains and forests, the Windows functional level you must keep during coexistence, how many applications authenticate against Active Directory, Group Policy and SYSVOL complexity, DNS layout, and how many users, devices and servers need testing. Each Samba release series also has a support window, so the target version affects planning. No single timeline applies to every estate, so ask for a schedule built from a written inventory and a defined scope rather than a generic estimate.
Can an in-house team run Samba domain controllers?
Yes, if the team has Linux administration depth and understands Active Directory concepts such as replication, FSMO roles, Kerberos, DNS and Group Policy behavior. Samba administration uses the samba-tool command, and the team must watch the functional level, the DNS backend and the file server design. Samba's wiki advises against using a domain controller as a file server when multiple DCs exist, so the design needs a separate member server for file serving. Assess your staff honestly against these skills before deciding who runs the domain.
What skills and operating work does a Samba DC need from staff?
Running Samba DCs needs ongoing work, not only initial setup. Staff must plan Samba release upgrades, since each release series receives full support, then maintenance and then security fixes only for defined periods. They also need backup and restore procedures, monitoring of replication and DNS, change control for schema and functional level changes, and tested recovery steps. Confirm the on-call model, patch cadence and documentation owners in writing before the move, because these recurring tasks drive the long-term cost more than the first install.
What drives the implementation fee for a Samba AD project?
The implementation fee follows the written scope. The largest drivers are the size and number of domains and sites, the amount of Group Policy, SYSVOL and DNS configuration to reproduce, the number of applications and devices to test, integration with existing identity sources, and the depth of security hardening and documentation you require. Coexistence work, cutover planning and rollback testing add effort, as does any compliance evidence you need. Ask each provider for a fixed-scope quote with deliverables, assumptions and exclusions listed, so you can compare offers on equal terms. DeployOpen plans and implements in fixed-scope engagements, with the scope agreed in writing before work starts.
Is FreeIPA a cheaper alternative to Samba AD?
FreeIPA is also GPL-3.0-or-later and has no paid edition of its own, so its license cost is also zero. The cost question depends on what you need it to replace. FreeIPA is not a Windows Active Directory domain for Windows clients, so it does not replace AD for Windows workloads in the way Samba AD does. It fits Linux-heavy estates that need Kerberos, host-based access control, sudo rules and certificates, and it can form a trust with an existing Active Directory forest. Compare the two on the services you must keep, not on license price alone.
How DeployOpen scopes a fixed-scope Samba AD implementation
DeployOpen plans and implements self-hosted open-source platforms inside your own infrastructure, including Samba AD domain controllers where they fit the estate. For Microsoft Active Directory cost vs self-hosted Samba AD, the work starts with a written scope that separates licence savings from the real effort of migration, support and skills.
How we scope
- Inventory every Windows Server domain controller, its role, and its licence and lifecycle dates before any cost comparison.
- Identify which Windows client access licences still apply to file, print and application servers that remain on Windows.
- Record the Group Policy, DNS, and SYSVOL dependencies that a Samba AD move must cover or replace.
- Agree deliverables, timelines and responsibilities in writing before work begins, since engagements are fixed-scope.
- Ask for a quote based on that written scope, which DeployOpen provides without a published price list.
How we build
- Stand up Samba AD domain controllers in your own cloud accounts, data centers or air-gapped networks.
- Configure DNS backends, replication and functional levels, and test each step against a non-production copy.
- Plan the coexistence period with existing Windows domain controllers, including role transfers and SYSVOL checks.
- Document the operational runbooks your staff will use to administer the directory with samba-tool.
- Run security testing on the new directory services and their integrations before cutover.
How we hand over
- Deliver configuration records, architecture diagrams and the migration decision log to your team.
- Walk administrators through daily tasks, backup and restore procedures, and patch handling for Samba releases.
- Prepare evidence and control records that your compliance team and independent auditors can review.
- Confirm with you which skills remain in-house and which parts of the estate still depend on Windows servers.
- Transfer ownership of documentation, credentials and change processes in a documented handover session.
How we support
- Offer ongoing support, upgrades and continuous testing through a retainer agreed after the initial scope.
- Plan Samba upgrades around the release support windows published by the Samba project, so each move stays supported.
- Schedule periodic restore tests and review replication health with your operations team.
- Re-run security testing when the estate changes, such as new domain controllers or new integrations.
- Confirm support terms, response expectations and included activities in the written agreement.
