Question: If I want to setup a few Windows 7 or 8 PCs to only permit logins using domain accounts, must I fork out the cash to purchase a Windows Server for this? Or a LDAP server such as the Apache DS or even the LDAP server built in my QNAP NAS would do?

If I further want to apply policies on the PCs such as disabling users from changing the IPv4 Properties settings, can this be applied locally on each PC without using a Windows Server?

Answer: 
You can set up Linux to act as a domain controller using the SAMBA software. So no, you do not need to buy licenses for Windows Server simply for domain logins.

An ordinary LDAP server however, is not enough.

AFIK, you can even apply group policies using free software, SAMBA v4 certainly supports group policies though I'm not clear whether you should actually still license Client Access Licenses. Tools such as Likewise Open and Centrify Express I think claimed to do this though both sites seem to have moved on or closed since my last references. I've not actually done this so I can't be sure how easy it is. [Likewise Open](http://www.beyondtrust.com/Resources/OpenSourceDocumentation/) is now part of BeyondTrust.

The [SAMBA WIKI](https://wiki.samba.org/index.php/Implementing_System_Policies_with_Samba) has some basic instructions too though they appear a little dated & it looks like you can do most things purely with SAMBA as long as you are using v4.

UPDATE:

To answer the question about why LDAP alone is not enough. While Active Directory is indeed partially based on the LDAP standards, it has quite a lot of proprietary additions specific to Windows. You have to have non-LDAP services that will respond to client logins, deals with groups, licenses, group policies and tons more. 

LDAP on the other hand is a standard and protocol that came out of X.500 which was designed to provide an enterprise (indeed global) grade directory of users and related resources to X.400 based email systems. X.500 was overkill for most things and required a very complex client that was too heavy for most PC's of the time. So LDAP (**Lightweight** Directory Access Protocol) was born. In essence though, it is still just a mechanism for looking up user and similar data from a very large directory of items. All it does is take standard queries and return results in a standard way. There's a bit more to it of course but that is the essence.
A Samba 4 Domain Controller should provide all the functions you described. In particular it supports group policies and authentication you mentioned out of the box as long as you stick to a single server. Setup isn't too hard as long as you stick to the documentation.

As was already mentioned a standard LDAP server however won't do the trick. Windows is rather picky about the combination of LDAP, Kerberos and file services on the Domain Controller and all of them are a tiny bit different then what was standardized.

The limitations people are often talking about are mostly more setup complications then real limitations and all of them only come into play, if you are looking into anything more then a single server. In that case Samba 4 is lacking parts of the inbuild policy replication replication, so you'll need a script to work around that. The other issue that then comes into play is that NTP and Kerberos authentication are seperate services and need to be configured to match your first server. I would say once you have the first two servers running it isn't too much of a trouble to manage it, but the initial curve for setting up a multi server Samba 4 environment can be rather high. 

Of course commercial distributions, such as our UCS, can make it easier to get Samba 4 running and administer it, but underneath it's the same software we have running in 10000 user environments.