both AD and GPO are fucking incredible pieces of software.

AD is really the only way to manage an organization with thousands of endpoints and users.

I have some hope that someone in the EU will develop a competing product now that they're pushing to get away from Microsoft, but it doesn't exist yet.