SCCM Pros and Cons

With the SCCM inventory, we found a lot of rogue applications. We were able to identify them, find out who was running them, and either put them on our application list or remove them.

It gives us the ability to set up schedules, according to what our security requirements are, to automate the patching of our servers and desktops.

What's valuable is the basic management of the systems, being able to control who can access the systems.

You can remote control or RDP. That has been the most valuable because we can go into one console and can get to anything we want. Instead of going to all these different consoles, we centralized everything.

Valuable features include configurations enforcement, compliance data gathering, and deployment of a standardized OS.

It saves a lot of money when you can install things automatically and they are installed the exact same way on every computer.

The most valuable feature is the graphical-based reports of software updates that have been successful, the ones that have failed, and a summary of where the failures are what security breaches may occur.

With the right administrator, application deployment can do wonders.

It is a good choice for deployment that performs very well.

There is a faster time to rollout. If we get a new PC, it can be ready for productivity right away.

Automation of operating system, application, and update deployments massively reduces IT operations effort.

There have to be made some improvement in WSUS and control in other non-Microsoft products updates.

This has made the management of our environment easier.

There is a reboot issue with the patching. Sometimes, if patching runs into any issue whatsoever, it doesn't reboot but it doesn't tell you it errored out. It just sits there and we don't find out until the next day whether it patched or not. That was a big issue for us. We're working through that. They added some stuff in there now where you can actually tell reboot is pending. But we still need some kind of notification that if something fails or is pending, we know. We shouldn't have to go in and look. They don't have anything for that right now.

Their compliance reporting is not accurate, and they admitted it on the phone when we had a call with them. We were trying to understand why their numbers didn't match on our compliance reports. It is not accurate and you cannot depend on the compliance reports. The numbers just don't match, and we can't figure out why. We called Microsoft and they said, "Yeah, that's a known issue." But there is no word that they're working on it.

There's no way to say, "I want this maintenance window to be on the second Tuesday of the month." It's strict. This window is this and that's it. You can't fluctuate.

As far as load balancing across, they don't have that support yet, so that you can actually build multiple primaries and have it load balance across. They don't have any of that functionality yet. That would be a nice feature, to scale that way.

Built in PowerShell cmdlets would be a nice feature because managing clients remotely can be a pain without knowing the WMI calls to run.

Our company would prefer not rebooting computers while people are using them. There seems to be no strategy behind it.

Marketing: Our management doesn't understand that there is a piece of software which helps them automate and manage the entire network, as far as operating systems on computers.

I would like to see an agentless version of the solution.

The main thing is that SCCM has to become an appliance instead of a server. When I say appliance, it has to come preconfigured so that it is drop-shipped into the enterprise and then you activate the feature sets that you want. It should pull down all the latest binaries. Once that is all there, it should have a discovery tool which goes out and discovers the assets within an enterprise. If the server, workstation, and applications are all coming from the same vendor, why not have the vendor do this work for us and automate it as much as it possibly can?

The setup was complex and I faced a lot of problems initially because I was new to the solution.

Troubleshooting in general needs improvement. There's just a ton of logs to go through, and so finding the error log that corresponds with that you're doing can sometimes be difficult.

It would be of benefit if Configuration Manager could be connected/integrated with multiple Microsoft Intune subscriptions rather than just one (the current limit).

I would like to see some improvements in WSUS and control of other, non-Microsoft, product updates.

Not everything is readily available, and there are a lot of commands that are only executable via PowerShell.