SCCM ICBM / Intune / VPN

[ADMaster]

Hello all,

 

I’m researching the best way forward with managing remote clients. I was able to push the free logmein central to most users before we got sent home, but there is no way I could afford it normally. I also find their application updates / management clunky.

 

I think the biggest hurtle right now is any changes I make to support ICBM, the clients won’t pick up until they are back on site.

 

A lot of my computers are hybrid azure joined, can I manage them with Intune without bringing them onsite?

 

I’m a bit worried about setting up an always on VPN, doesn’t that greatly increase the attack surface of my network?

 

Thanks

Edited April 9, 2020 by ADMaster

[FishCustard]

Without addressing the other points, an AlwaysOn VPN is no bigger an attack surface than any other VPN. At its core, it's a PEAP/IKEv2 VPN with some other Windows tech layered on it to make the deployment seamless.

[DalekSec]

Are you Azure AD joined devices in Intune also? If not then you will have to add them in, if they are remote devices you will most likely have to do them manually. We pushed out a GP a week before lockdown so managed to get the vast majority onto Intune before they went off site. Then the few that weren't we had to remote on, setup a VPN and run gpupdate to get them into Intune.

[ADMaster]

Without addressing the other points, an AlwaysOn VPN is no bigger an attack surface than any other VPN. At its core, it's a PEAP/IKEv2 VPN with some other Windows tech layered on it to make the deployment seamless.

I don't have a VPN setup myself for most staff. The only VPN we have is via the LEA with only select admin staff such as myself having access.

I'd be setting up RAS for all staff.

 

 

They are azure hybrid joined, but not in intune. So it looks like there will be a lot of manual effort if I want to manage them now.

 

What would be the best way forward for future remote management?