Recommend an MDM for a fleet of windows laptops used off site

[timbo343]

I've been pondering which MDM is best to use for a fleet of Windows laptops that teachers will use at home.

 

We still have the free version of Meraki which is ok but i feel we need to move on to the next level./#

 

I've been looking at Intune but wondered if this is the best solution or if there is anything else out there that might do a better job. Intune seem very limited on it's features - it certainly isn't Group Policy.

[jslate1980]

I've been pondering which MDM is best to use for a fleet of Windows laptops that teachers will use at home.

 

We still have the free version of Meraki which is ok but i feel we need to move on to the next level./#

 

I've been looking at Intune but wondered if this is the best solution or if there is anything else out there that might do a better job. Intune seem very limited on it's features - it certainly isn't Group Policy.

What features you looking for?

[timbo343]

What features you looking for?

 

I'm not really sure to be honest - i guess i need something to compare to Intune.

 

I guess the most important thing is remote wipe / disable. We think we have found a remote assistance tool - either quick assist or DWService.net

[rogerdnixon]

We us InTune - but as we use G Suite, thats being replaced by Google MDM for Windows which is good if you are G Suite and all new build PCs.

 

InTune has heaps of settings (The Edu portal is just a front for the main event) - so covers most things? What is not covered by InTune native settings, can be done with custom OMA-URI settings and you can also load up ADMX files - which is how we manage the basic Chrome settings.

[kmount]

Whilst not edu we recently reviewed a handful of offerings - Intune, Ninja RMM, and Zoho/Manage Engine and found that they were pretty much a much. (though Intune was the only one I could find that had a tickbox to say 'make sure it is bitlockered' the others would run a self written powershell script to tell you if it was but that just seemed clunky)

 

We settled on Intune in the end as we had licensing as part of our wider EMS licensing and with no immediately compelling functionality available in the others over it it is 'acceptable'.

 

It is by no means perfect or even close to a group policy / SCCM alternative but it ticked the relevant boxes for us - enforce encryption, plug into AAD conditional access, etc and it works across our Windows, and MacOS laptops plus Android and iOS Devices to give us a single point of management.

 

I am still not sold on it for the future though so interested in which direction you go.

[ricki]

Intune

[timbo343]

We us InTune - but as we use G Suite, thats being replaced by Google MDM for Windows which is good if you are G Suite and all new build PCs.

 

InTune has heaps of settings (The Edu portal is just a front for the main event) - so covers most things? What is not covered by InTune native settings, can be done with custom OMA-URI settings and you can also load up ADMX files - which is how we manage the basic Chrome settings.

 

We are a GSuite school too but i found the settings in Gsuite for Windows very very basic but good to hear that someone else is using Gsuite for windows for future discussions.

 

Whilst not edu we recently reviewed a handful of offerings - Intune, Ninja RMM, and Zoho/Manage Engine and found that they were pretty much a much. (though Intune was the only one I could find that had a tickbox to say 'make sure it is bitlockered' the others would run a self written powershell script to tell you if it was but that just seemed clunky)

 

We settled on Intune in the end as we had licensing as part of our wider EMS licensing and with no immediately compelling functionality available in the others over it it is 'acceptable'.

 

It is by no means perfect or even close to a group policy / SCCM alternative but it ticked the relevant boxes for us - enforce encryption, plug into AAD conditional access, etc and it works across our Windows, and MacOS laptops plus Android and iOS Devices to give us a single point of management.

 

I am still not sold on it for the future though so interested in which direction you go.

 

I'm thinking an itune license to be honest coupled with Impero and DWService. This should give us the best of a bad situation i guess.

 

I'm under the impression that it's all about the end user being responsible for the device and responsible for what they do on it. It's getting to the point where we are very much data keepers and less about blocking what a user can do unless local group policies are applied. Couple the installation with AV (in our case Sophos IX) the devices "should" be ok.

[timbo343]

Oh yeah, one last thing, if we decide to go down the Impero route, can Intune automatically install Impero remotely if the installer was placed on the net somewhere?

[Norphy]

Oh yeah, one last thing, if we decide to go down the Impero route, can Intune automatically install Impero remotely if the installer was placed on the net somewhere?

 

You can package installers and upload them to Intune so as long as the Impero installer can be installed silently, you're golden.

[DalekSec]

For windows devices Intune fo-sho

[MicrodigitUK]

The only other MDM I’ve found comparable to MS Intune and in some aspects slightly better, is VMWare Airwatch. However it can come in at 10 times the price! So after 5 years of Airwatch I’ve moved to Intune purely to not spend a fortune on our MDM.

[free780]

Any Windows MDM will have the same access as intune.

The difference is you can do Co management with SCCM and autopilot.

 

In theory you could lock down as much as GPO if you wrote powershell scripts to do it.

An always on VPN will enable GPOs etc.

[MatthewL]

We use Zoho/Manage Engine/Desktop Central for all our windows and Mac's on the domain, visible on the web to enable patching and remote support. All machines have DirectAccess so have access one way or another, that is about 3000 desktops, laptops and servers. We also use the MDM side for iPad's just in process of adding a batch in there, in total about 20 but means we have everything in one place. We do use a separate one for mobiles phones but I don't rate it and I think its what our provider recommended, not used for anything else and they do alot of the work on that.

[timbo343]

Just tried Zoho Assist and i think the free version will work great for what we want it to do. At the end of the day, we will be on the phone to the member of staff so unattended access is not required.