SCCM Best practice for Internet Clients

[Geoff]

I have a bunch of laptops and home users that I want to manage though SCCM. They sometimes come into the office but are usually just connected to the Internet and remote in via Citrix.

 

Currently I have a SCCM site server and a bunch of Distribution Points running at my remote sites (connected over MPLS WAN). This all works fine internally.

 

What's the best way of dealing with these Internet clients. Would a Distribution Point in the DMZ work, or do I need a secondary site server. What about an Azure Cloud management gateway. would that be better?

Edited August 23, 2017 by Geoff

[Steve21]

Is this for full management including software etc? or just settings if they're remoting in?

 

Things like Windows Update you can just set to update from Microsoft but with your deployments of custom software etc you'd need an external FQDN setup for what they're connecting back to. So this depends if you want them to connect to one place, and manage them all, or whether you're having each site with a separate one etc e.g. connect back to each branch on it's own

 

Steve

[Steve21]

The short version is IBCMs don't support a lot of the main features you can do over WAN/VPN etc.

 

Say Remote Control/Software Deployments etc aren't supported. (The one exception being where a user can connect to an IBMP to authenticatae with ADDS)

 

Software updates can be setup to automatically try to connect to Microsoft first so should download it without needing your bandwidth etc anyway

 

Your site would need to be a primary one, you couldn't use secondary as they won't support untrusted connections.

 

Generally speaking a lot of faff for what you'd get out of it if they're using software via remote anyway And I'm assuming if they're staying offsite for that long that you'll going to run into other problems with cached credentials etc, unless you're taking them off domain?

 

Might want to have a flick through this tidbit (Sorry got to go out so thought I'd type what I can):

https://docs.microsoft.com/en-us/sccm/core/clients/manage/plan-internet-based-client-management

 

Steve

[sparkeh]

Easiest way I found is to use Direct Access (if you have access to Windows Enterprise). DA setup includes specifying the location of your sccm server so takes care of that for you.

[Geoff]

Ok. Thanks. Sounds like Direct Access would be a cleaner solution. Presumably I just have a boundary for my DA clients and away we go? Edited August 23, 2017 by Geoff

[sparkeh]

Ok. Thanks. Sounds like Direct Access would be a cleaner solution. Presumably I just have a boundary for my DA clients and away we go?

Actually, I didn't have to alter boundaries or anything, I assumed that the clients are presented as if they are on site.

[sparkeh]

Actually, let me qualify my previous answers.

 

I have one AD boundary, I actually I guess I didn't need to alter any boundary as sccm knew about it from the AD boundary.

 

Also, I have used several VPNs and had remote sccm clients reporting in and preforming as if they were on site (Direct Access, Sophos SSL VPN and Smoothwall SSL VPN).

[Geoff]

Ok, I have multi-site with a MPLS WAN and several DPs so having boundaries is already a thing for me.

 

I would probably make a subnet per VPN type, Then create boundaries and throw them into the nearest boundary group. As the VPN would connect in at our main site that would be it.