"His face is open and alive, with a rosy..."

Rosy eh?

However, Eric Phelps, author of Vatican Assassins, would insist that this is not the 'Rosicrucian mask' of the Baconian's but that the Spear shaker's true identity was that of Edward de Vere, Seventeenth Earl of Oxford.

Whatever the real identity of these folks I'll bet my ballsack they're all Widows sons.

I was just about to download FreeIPA and try it under VirtualBox but had the good sense to read the FAQ first where it states:

  IPA Policy

      1.

                    Q: Can I specify different policies for different groups?
                    A: No. The current release of IPA supports one policy for all.

        The PRD for v2 does not explicitly list this requirement. There is, however, some requirement to improve password policies but not to that scope. This will be added to a future feature set. /end quote

Hence it seems FOSS advocates are waiting for IPA v2 or samba 4.x until they have a good chance of really booting MS and proprietary solutions out of the server room at least.

It would seem ZenWorks is the only Linux solution for setting group policies, yet it doesn't list XP Pro SP3 as a supported platform. Does it work fine with SP3 and is nobody working on a FOSS equivalent?

Thanks to everyone who has posted ideas, suggestions and comments so far- I've just finished reading them all now- much appreciated and very interesting stuff.

A few points that I should've mentioned in the original question are that (as most of you correctly assumed being a UK school) nearly all clients are Win XP SP3 with the odd exceptions of a few Vista, Linux and OSX machines. I say migrating to one server but of course that would have a back-up machine- its just that at the moment we have this crazy configuration of two physically separate networks/domains with their own DCs, switches, ISPs etc- one for students one for staff. I inherited one helluva crazy mess, indeed! What I mean is that all this is going to be amalgamated into one physical network and one domain, not one server.

We don't use Exchange so AD/Exchange inter-op isn't a requirement or an issue.

I was aware of eDirectory but didn't mention that in the question because its not FOSS- however this has been recommended much more than Sun's solutions and Apache hasn't even had a look in. I don't want to rule Novell out as a possibility as it may just be better a better long term solution than sticking with AD/2003. It would seem FDS/FreeIPA is the only serious FOSS solution available for this right now

Of course, AD *should* logically be the easiest one to stick with/ 'migrate' to but that doesn't necessarily make it the best choice. I think we'd be more than willing to hire a consultant to help transitions to an alternative if there were numerous long term benefits.

I'm going to have a play with FreeIPA on a small network of test machines or under VirtualBox and see how that goes first I think.