In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC.
Since i would have to set up (and buy another license) for an AD CS instance, i am asking myself if Kerberos is enough "encryption". Or if i should find a way to set up an AD CS for LDAPS.
All Clients use Kerberos (otherwise Password Changes would not be possible if i am right), and also all Unix-Boxes are connected via Kerbers (using
realm join ...).
Or am i mixing some points?