An alternative to Active Directory
IronGate
A directory your office PCs can actually join, hosted for you.
IronGate is Active Directory as a hosted service — a genuine domain controller for your own staff and machines, with modern web sign-in on top. Each customer gets a domain controller of their own, never a share of somebody else's.
- Domain controller
- Speaks Active Directory's own protocols
- Protocols
- Kerberos, LDAP and NETLOGON
- Tenancy
- One domain controller per customer, never shared
- Passwords
- Held by your domain controller and nowhere else
- Internet exposure
- Directory ports closed by default
Built for a real domain join
This is not a sign-in button on a web directory. It is a domain controller speaking Kerberos, LDAP and NETLOGON, which is what Windows needs to join a PC to a domain and apply Group Policy to it. That is the design; a Windows join has not been demonstrated yet.
Your domain controller is yours alone
Every customer gets a separate domain controller with its own domain name and its own address. A shared one would be cheaper to run, but a domain controller holds exactly one domain, so there is no honest way to put two customers in it.
The password lives in one place
Web sign-in reads from your domain controller rather than keeping a copy. Nothing else holds your staff's passwords — not our control panel, not our database — so there is no second store to leak or to drift out of step.
Not on the open internet
The ports a domain controller listens on are closed to the internet by default. Your site reaches its directory through a connection it opens outward. Opening a port to your own fixed addresses is possible, and is a recorded decision, never a default.
A wrong clock gets told so
Kerberos refuses a machine whose clock is more than five minutes out, which makes a wrong clock one of the commonest reasons a join fails. IronGate is designed to say exactly that, instead of a generic authentication error.
Suspending is not deleting
A suspended account stops signing in immediately. Removing a directory and its backups is a separate, deliberate step, and never happens as a side effect of an unpaid invoice.