From Nubus to an Automated Linux Desktop: A Case Study from pro mente tirol

A social services organization in Tyrol, 24 locations, and the conviction that our data belongs in our own network: Here’s how we put that principle into practice with Nubus and Ubuntu.

Since 2014, I have been heading the IT department at pro mente tirol, a non-profit organization providing social psychiatric services for people with mental health conditions. We operate 24 locations across Tyrol, employ around 300 people, and are 100% publicly funded. At some point, Windows 7 reached the end of its lifecycle. The question was: Should we move to Windows 10 or should we consider something different for the desktop? I’ve been an open source enthusiast since my university days, so we decided to explore an alternative.

In this article, I’ll explain how, together with Siedl Networks, we made the transition from Windows to Ubuntu, using Univention Nubus as our Identity & Access Management foundation, Ansible for automation, and custom Python scripts to configure network shares. I’ll also explain what the migration cost, how our employees responded, and how we organized support after each site migration.

Before deciding which operating system our employees would use, we first had to answer a much more fundamental question: Where should our data reside, and who should control it? Our management’s answer was clear: As much data as possible should remain within our own network. We do not rule out external solutions, but we carefully evaluate where the servers are located.

The second strategic decision was not about the infrastructure but about the applications themselves. Early on, we decided to move as many applications as possible into the browser. Today, most of our applications run as web applications, including email, document management, collaboration tools, and client documentation. Locally installed software is essentially limited to a web browser, LibreOffice, and printer drivers. That gave us considerable flexibility when choosing a desktop operating system because the more runs in the browser, the less it depends on the operating system itself.

That flexibility ultimately became our opportunity. Windows 7 had reached end of support, and around 220 PCs needed to be replaced or upgraded. At standard market prices, new hardware and software would have cost us around €170,000. Even with discounts available to non-profit organizations, the total would still have been approximately €120,000. To be fair, obtaining those discounts involves a significant amount of administrative work: forms, proof of non-profit status, and the same paperwork every year. It all ended up on my desk.

In the end, our migration to Linux cost around €15,000, including my own working time and the development work carried out by Siedl Networks. And there’s more: We were able to keep around 90% of our existing hardware. We installed a few SSDs, added RAM where necessary, and occasionally replaced a power supply.

Linux Mint, Zorin OS, and a dozen other distributions, we’re often asked why we didn’t choose one of those instead. As an administrator, one factor stood out above all else: Ubuntu is the most widely used Linux distribution. There’s a good chance that some employees have already encountered it at home. That’s preparation I don’t have to do myself.

Ubuntu is also backed by a large online community, including a very active German-language forum that provides answers to many user questions. In addition, Ubuntu includes much of what we need out of the box. It was important to me that we install as little additional software as possible.

For us, 2018 was the year of preparation. We defined the core principles that would guide everything that followed.

At pro mente tirol, Nubus is the central control point for desktop management, and LDAP groups are the key to making it work. We first create a group in Nubus, then create a network share, and finally assign that share to the group. The reason is simple: We work with team accounts, not individual user accounts. Which network drives someone sees depends on their group membership, not on an individual user account.

When setting up a workstation, we still perform several tasks manually: installing the operating system, configuring SSH remote access, setting up printers, and installing remote support software. These tasks cannot be meaningfully automated because they depend on the individual location. We then join the PCs to the UCS domain. Only at that point does the system know that the computer exists and can assign it to the appropriate groups, shares, and permissions.

After that, Ansible takes over. The playbooks install all required packages, including software for accessing Samba network shares and a LibreOffice build from our own Personal Package Archive (PPA) repository. The Snap version of LibreOffice provided with Ubuntu also includes help and developer files, which noticeably slows startup on older hardware, although this is hardly noticeable on newer machines. Using our own PPA also means we are not dependent on Canonical’s package maintenance and receive updates directly from the software vendor.

The Ansible playbooks also deploy a variety of configuration settings, including the browser’s home page and extensions, history and cache behavior, and the default application for opening PDF files.

A custom-developed Python script then reads the directory service to determine which network shares are assigned to which groups. Based on this information, it automatically generates two files: a bookmarks file for the Nautilus file manager so that network drives appear in the sidebar, and a configuration file that automatically mounts the Samba shares when users log in, just as Windows users are accustomed to after signing in to a domain.

During the very first login, users must sign in twice. The first login checks the network drives; after the second login, everything is in place: bookmarks, application shortcuts, assigned network drives in the file manager, and the taskbar. From then on, everything is configured automatically each time the user signs in. Even if someone rearranges their icons, they’ll be back in the expected places after the next login.

For asset management, that is, keeping track of our devices, we initially experimented with Landscape, Canonical’s commercial management solution. After two years, we switched to a leaner approach: our own Cockpit server, which provides an overview of all our devices. The same server also runs Ansible for automation.

Office compatibility was initially one of the key topics for our support team. During the migration phase, Linux users could access a Windows environment with Office 365 via a Terminal Server if they ran into problems with a document. We have since discontinued this access: users have not needed it for around four years. We now handle the remaining compatibility cases using OnlyOffice in our Nextcloud.

And we approached the issue from the other direction as well: all Windows PCs now use the ODF open file format as the default, so our Windows colleagues also create ODT and ODS files. For remote access to virtual desktops, we now use KASM, which replaced Guacamole. Since the beginning of 2026, we have no longer provided Windows desktops there either.

What surprised us positively was the feedback on performance. Logging in is faster and applications start more quickly—even on older hardware. Our users mentioned this repeatedly. One of our employees told us that they no longer go for a coffee while waiting for their PC to boot.

The look and feel of the new environment was not a problem for most people. One employee, for example, said that the interface felt pleasantly neutral. Another commented that working with it was just like working on her Mac. Of course, there are other opinions as well, and some users still consider Microsoft indispensable, but those critical voices are becoming fewer and fewer.

We started the first rollouts in 2019. We proceeded one location at a time, from Reutte to Landeck, then Imst and Schwaz, all the way to Kufstein and Lienz. By late summer 2020, all PCs scheduled for migration had been converted. In 2021, we then quickly upgraded all systems from Ubuntu 18.04 to Ubuntu 20.04. Since the end of 2024, all of our Linux PCs have been running Ubuntu 24.04.

The next Ubuntu upgrade, however, will have to wait a little longer. Ubuntu 26.x uses Wayland by default, and that creates a problem for our support team. When issues arise, we often log in to employees’ desktops unattended in order to investigate them directly. Wayland does not easily allow this: screen sharing and remote input require a consent dialog that the logged-in user must confirm every time. That simply does not work when a workstation is unattended or still at the login screen.

The rollout process for employees was always essentially the same. Around one month before the migration, we contacted the respective team and scheduled a meeting. Two or three hours in which we explained what they could expect: what the new desktop would look like, which applications they would find, where compatibility issues might occur—and why we were making the change. We showed the cost comparison, talked about data security, and explained the reduced attack surface compared to ransomware. Those are convincing arguments, even for employees who are not particularly interested in IT.

After the migration, we dedicated ourselves exclusively to that team for two weeks. All other tickets were put on hold so that the priorities were clear. Anyone who encountered a problem contacted us and received immediate support.

At the same time, we established a tiered support model: first look into the issue yourself, then ask your colleagues, and only then call IT support or open a ticket. In some teams, a technically minded person naturally emerged as the first point of contact, collecting questions and passing them on to support, a welcome side effect. The better a team works together, the more people help one another, and we have experienced that time and again over the years.

The move from Windows to Ubuntu was only half the story. Equally important was the parallel transition from locally installed applications to web applications.

The portal is now the central point of entry: our employees sign in once via Single Sign-on and then have access to all applications assigned to them, regardless of whether those applications are hosted internally or externally.

The role-based system behind it makes administration much easier. Which tiles someone sees in the portal depends on their group membership, the very same logic we already use for our network shares. New employees automatically receive access to the right applications without us having to configure every account individually.

The more applications we can integrate in this way, the less depends on the individual desktop computer. The portal becomes the actual workspace and the operating system underneath becomes secondary.

The move to Linux desktops for our employees has been a success. I don’t say that because everything went smoothly, but because we were able to deal with the problems that arose. The performance improvements were real and immediately noticeable. The costs were significantly lower than those of a Windows upgrade. And we were able to continue using around 90% of our existing hardware.

What we underestimated was Office compatibility during the initial rollout phase. We also underestimated the fact that the open source world is constantly evolving something that often remains invisible to users but regularly creates additional work for administrators.

Our most important lesson, however, is this: If you bring your employees on board before the first PC is migrated, you will face much less resistance later on.

Our data stays with us. Our infrastructure belongs to us. That was the fundamental decision – and it still is today.

One open question for the community: the Wayland issue is currently preventing us from moving to Ubuntu 26.x. If you manage a similarly distributed Linux environment and have already found a solution without sacrificing security features, we’d be happy to hear from you in the comments below this article.