I’ve done it with Puppet, mostly dropping config files around the place.

Everything was more work than it would’ve been under Windows, from endpoint configuration enforcement through to things like authentication and PKI.