It is also doing a lot with DNS and device management via group policy and is one of the only 'it just works' high-availability services I've ever used. Making a new node is usually as easy as doing a dcpromo and logging out.

You can replicate a lot of it in *nix but I've never seen anything as cohesive as a windows domain controller.

I think the only windows services I 100% would give a thumbs down to is websites (I do not like IIS) and print management.