Windows 11 Patch Management and software deployment

[Caffeine11]

Hi Everyone

 

Our school is looking to purchase a new windows domain server next year so we can support Windows 11. We normally use WSUS for updates and PDQ Deploy for software deployment but the PDQ licence cost is getting a bit high so I thought I would ask about alternatives for patch management and software deployment.

 

We have about 120 windows desktops and laptops so what would you recommend for deploying updates and software? WSUS is free so that is a big plus with our Business Manager. I have seen SCCM mentioned a lot but, at the moment, I have no idea of how much it costs or if it would be overkill for a 120 devices so any advice would be appreciated.

 

Thank you.

[DalekSec]

How are they managed atm? The general consensus from Microsoft going forward is Entra AD and Intune.

[mavhc]

Depends what software you're deploying, if it's all available as packages in a package manager, just use that, free.

 

Meanwhile use WUfB unless your internet is super slow

[TwistedHelixis]

Action1 is free for 100 endpoints. No idea how much it is over that amount.

[kevin_lane]

Action1 is free for 100 endpoints. No idea how much it is over that amount.

 

It’s a lot lol but it’s really good had a demo from them

[chaplic]

Not sure why youd need a new server to support windows 11, but in any case as others have said Entra ID and Intune, and licensing is decent value for schools. The learning curve is high but once you get there its plain sailing and opens up more opportunities.

 

Do Not touch SCCM. It’s yesterdays tech, complex and has little benefits.

 

You can actually deploy 3rd party software via WSUS if you’re feeling adventurous, and to that end basic MSI deployment is built into AD, but both approaches would be a step backwards compared to a proper tool.

[XiJ]

Yep I’d defo be looking at entraID, intune (and autopilot).

 

Once configured the Autopilot deployment and login to install apps is lovely.

 

A3 or A5 licenses and move away from ove licensing. CSP should not cost more these days - and often cheaper.

[Roberto]

• Autopilot to build laptops when they're added to your network or rebuilt
  
• Intune to manage user and device settings and distribute applications
  
• Autopatch to manage, well, patching.
  
• Entra ID (what used to be called Azure AD) to manage identity / login
  

 

All in the cloud. All fairly simple to set up. All have their infrastructure managed by Microsoft so you don't have to worry about keeping servers up to date and online. Use the 'new server' money for something else more important.

Edited December 7, 2023 by Roberto

[Cw2k]

• Autopilot to build laptops when they're added to your network or rebuilt
  
• Intune to manage user and device settings and distribute applications
  
• Autopatch to manage, well, patching.
  
• Entra ID (what used to be called Azure AD) to manage identity / login
  

 

All in the cloud. All fairly simple to set up. All have their infrastructure managed by Microsoft so you don't have to worry about keeping servers up to date and online. Use the 'new server' money for something else more important.

 

AutoPatch still not on A3/A5

[Caffeine11]

Hi Everyone

 

Thank you for taking the time to reply. I will have a look at your recommendations.

 

chaplic, we are getting a new server because ours is server 2012 r2, which is no longer supported, old, cannot be upgraded as it is TPM 1.2 and, as far as I am aware, 2012 r2 does not support Windows 11 clients. Also, we are not convinced about having our data in the cloud so want an onsite file and print server.

[mavhc]

Server 2022 does not require a TPM, and any supported version of Windows Server supports Windows 11

[DalekSec]

Hi Everyone

 

Thank you for taking the time to reply. I will have a look at your recommendations.

 

chaplic, we are getting a new server because ours is server 2012 r2, which is no longer supported, old, cannot be upgraded as it is TPM 1.2 and, as far as I am aware, 2012 r2 does not support Windows 11 clients. Also, we are not convinced about having our data in the cloud so want an onsite file and print server.

 

What makes you unsure about having files in the cloud? I've not used a on site file server for around 5 years+ now!

 

Print server i agree, keep it on site cloud options still have a way to go imo

[JDawgg]

Only issue I've had so far is using SMART Notebook files within Sharepoint. Even if the library is synced locally the files have to be downloaded manually before use.

Hard to get schools to move away from this as we do not have a Microsoft native app comparable to SMART Notebook or any cloud-based solution.

Similarly with MacOS and Garageband, currently having to support a suite of Macs because the software blows their competitors out the water

[RLR]

Are people doing hybrid join with intune so machines can be managed via GPO or are you going full cloud and having your machines only join via Entra AD - Even if your computers never leave site?

 

Has anyone got intune with device licenses only? We're mainly a Google school but have a lot of windows machines. Don't feel GCPW is the way to go but don't really want to pay for Microsoft A3/A5 if we're not going to use a lot of it.

[TwistedHelixis]

We're mainly a Google school but have a lot of windows machines. Don't feel GCPW is the way to go but don't really want to pay for Microsoft A3/A5 if we're not going to use a lot of it.

Same, although I am thinking about GCPW more and more.