Keberos integration for SSO, Group Policy Objects (GPO) -- which is a big one in my opinion; you need to script or orchestrate things to replicate that -- built in DNS and DHCP, cert stuff, and a lot of domain-forest relationships