Looking for the closest thing to Jamf MDM for Windows `

Jump to latest Follow Reply
Y

YodaNT

Ars Praefectus
3,099
  • #1
    I deployed Jamf a few months ago to streamline the onboarding and management of Apple computers and it's cut our setup time in more than half. Now I'm trying to find an MDM solution to speed up the deployment of Windows laptops.

    I'm hoping to find some recommendations for a Cloud based MDM that will work with Windows 10/11 based laptops. Mobile devices aren't necessary but could be useful down the road.

    Right now we setup the initial user account on a Windows machine and then run some commands against it via our SSO agent to setup certain things in the registry and install a few standard apps.

    I'm hoping there's an MDM solution for Windows out there that just allows us to install a local agent on the Windows machine and then it takes over and runs these commands and installs our standard apps without too much interaction and potentially continues after a reboot. Ideally we could have someone in a remote location setup their user account and then install this agent and then IT monitors the installation/setup process.

    Additional features:

    Remotely location a machine, reboot and erase machines
    Self Service portal for installation of applications
    The ability to push configuration files to specific folders ie: Similar to Jamf does with Configuration Profiles
    The ability to work with remote employees around the globe for a team of 200-300


    We can eliminate Manage Engine as a possibility for this. And we don't want to go the imaging route.


    So I'm ideally looking for something that works similar to Jamf but for Windows once that agent is installed on a new machine.

    Anyone have any suggestions or real work experience with something that might work for this situation?
     
    Y

    YodaNT

    Ars Praefectus
    3,099
  • #8
    continuum said:
    Intune apps being installed can have installation issues if the enrolled device trying to do the install is on a slow connection and the connection craps out before the install finishes. I unfortunately am not closely tied enough to the process to know all the terminology off the top of my head.
    Click to expand...
    Thanks. It's the same connection and the same machine we're seeing this behavior on. Actually two test machines in two different locations that work if you do enrollment right at the initial Windows setup instead of adding/joining the machine after login. The connection isn't an issue at either location.

    Maybe it's me but it definitely seems like Microsoft hasn't ironed out a lot of bugs in Intone. We also see issues where the install of an app has completed but Intune hasn't updated in the admin portal to show the app was installed. Or maybe we're just having some bad luck with Intune?
     
    MorsePacific

    MorsePacific

    Ars Tribunus Angusticlavius
    6,794
    Subscriptor++
  • #11
    We use Jamf and Intune to manage our macOS and Windows fleet respectively.

    Intune is a long way from being as comprehensive as Jamf, but if you want to do cloud-managed PCs joined to Azure AD it seems to be the only way to go right now.
    When I joined my current org they were building all machines by hand and had no MDM on either platform, which was a priority to fix. They already had Azure with Office 365 so upgrading to a SKU that supported Intune and going with that was the path of least resistance. We also had issues with all the machines being bound to AD and a large number of users working remotely and never connecting to VPN, so machines losing their trust relationship was common and a major driver of Helpdesk tickets.

    What I will say is that our basic Intune setup 'just works' for what we needed, but definitely has shortcomings compared to the macOS side of the house.

    I don't think Intune is a proper package manager; it's reporting leaves a lot to be desired, and scoping groups based on installed software doesn't seem possible.
    Even simple things like scoping a policy to all Autopilot-enabled machines - which to my mind should be a checkbox exercise - requires Googling for non-obvious identifiers to create dynamic groups from.

    We looked at moving to VMware's Workspace One which promised a lot, but after a full 12 month contract they couldn't find a way for us to silently deploy the agent to enroll the device under the user's own name, so we junked it. Not to mention the actual implementation of the thing took about 5 months after they had to contort the product in multiple interesting ways to work with all of our cloud vendors.

    I'm considering an Intune + Chocolatey/Scappman/something else for 2023. The Autopilot piece of Intune is great and works about as reliably as ADE does on the Mac, but we need a better way to manage packages and Intune isn't it.
     
    • Like
    Reactions: YodaNT
    I

    Incarnate

    Ars Tribunus Angusticlavius
    8,806
  • #13
    YodaNT said:
    @MorsePacific Thanks for the info. I don't think we can currently go with Intune as our SSO platform also needs to bind to the device for local user crews. Any experience on Hexnode? It seems to come up a lot of the time in "best of" MDM lists.

    Or anything outside of VMWare One or Intune that I might be forgetting?
    Click to expand...
    What are you doing for SSO?

    Intune is probably your best option, but I don't think we have enough information on your SSO or "local user crews".
     
    MorsePacific

    MorsePacific

    Ars Tribunus Angusticlavius
    6,794
    Subscriptor++
  • #15
    YodaNT said:
    @MorsePacific Thanks for the info. I don't think we can currently go with Intune as our SSO platform also needs to bind to the device for local user crews. Any experience on Hexnode? It seems to come up a lot of the time in "best of" MDM lists.

    Or anything outside of VMWare One or Intune that I might be forgetting?
    Click to expand...

    We're using Okta as our IdP; it's integrated with Azure via Office 365, so the login prompt on an Autopilot-built machine will redirect to Okta - it works great.

    I haven't heard of Hexnode ... goes Googling
     
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply