DSC vs. GPO vs. SCCM vs. MDM (Intune)

Microsoft Windows administrators now have a number of ways for managing their estates.

• Group Policy (GPO)

  Allows very fine-grained control over every aspect of Windows. Primarily aimed at Windows desktops. Requires Active Directory (AD) and very careful configuration. Requires well trained specialist staff to get it right.

• System Center Configuration Manager (SCCM)

  Allows central control over software delivery. Also requires AD. Configuration of delivery packages can be complex and very careful change control is required. Software delivery via SCCM can also be intrusive to users. Requires well trained specialist staff to get it right.

• Desired State Configuration (DSC)

  Though extended by Microsoft this is actually part of a wider open standard “Open Management Infrastructure” and so applies to other platforms as well including Linux. Mainly aimed at server configurations. Falls into the DevOps camp as it defines server configurations in purely text format and so can be put under source control easily. DSC is typically dynamic and enforces the correct configuration (normally every 15 minutes) which greatly helps ensure secure configurations.

• Mobile Device Management (MDM)

  Primarily aimed at mobile devices, this style of configuration is increasingly applicable to Windows Desktops with the advent of Windows 10. Microsoft InTune is leading the way with other MDM vendors following on. Not everything on the desktop can yet be controlled this way, even with W10 but many key settings and controls are already available. A much simpler method for enforcing desktop settings than the other methods, it allows fewer administrators and much less specialist knowledge.

The article from FoxDeploy covers the first three of those and lays out the purpose of each. Well worth a read.

What is missing is the 4th method which uses Mobile Device Management tooling. The leading contender for this is Microsoft InTune. However, InTune is really only focussed on Windows 10 (desktop and mobile), it has limited control in other Operating Systems.

Servers only ever exist in a given state. If they deviate or we make changes, we refactor and redeploy. DSC drives it all and the machine will be up and running on a new OS, with data migrated in a matter of minutes.

For all practical purposes, the first true large scale management tool we had for Windows systems in the modern era was Group Policy, or GPO as it is commonly truncated.

Comparatively, SCCM and MDT allow us to we import an image from a Windows install disk and then run dozens of individual steps which are customized based on the target machines platform, model, office location and other factors. The sky is the limit.

Curated from DSC vs. GPO vs. SCCM, the case for each. – FoxDeploy.com

Update 2018-05-04 - Intune and Autopilot 🔗︎

It should be noted that Intune is now much more capable than when this was originally written.

Intune now has mobile device management that easily rivals any of the other MDM tools across all platforms. It is also well able to manage Apple OS X as far as Apple actually allow remote management of this type (they provide only a restricted set of API’s unlike Windows).

It should now be possible to manage and configure Windows desktops (at least Windows 10) just using Intune via the Cloud without any input from the other tools.

Intune coupled with Microsoft Autopilot provides a massively powerful and attractive set of tools for the deployment and configuration of Windows 10 based devices.

Autopilot lets you ship devices straight from the manufacturer to the end user with no build needed. The user only requires a broadband Internet connection. Devices are unboxed by the user and connected to the Internet. The user logs in with their cloud identity. Intune “knows” which organisation the device belongs to and begins configuration. The whole process takes about 10 minutes to give a device that can browse the Internet and 1 to 2 hours at most before all local client applications are installed and configured (in the background) depending on the complexity of your configuration.