Microsoft Intune alternatives and competitors

We have two main use cases of Desktop Central. The first is patching, because we want to keep our systems secure. We install Microsoft security updates using ManageEngine Desktop Central every month. The second case is to deploy applications. We want to install applications to the machines from a central location. Also, we want to give access to users so they can install whatever applications they need using the self-service portal option. When there is a common application used by many users, we publish it to the self-service portal so users can install it themselves instead of contacting local IT. Those are our two main use cases of ManageEngine, but we also use it for other tasks, such as remote connection. Our local IT uses two products: ManageEngine Desktop Central and TeamViewer. We use both to connect to the remote machines. 

We have the on-premise version, but we are looking to move forward to the cloud version once they start supporting data migration—at the moment, they don't support it. 

One of the benefits of Desktop Central is it made the provisioning process simpler because now we have a provisioning package. We have around 1,500 laptops at the moment and all these PCs were provisioned by a provisioning package. In the provisioning package, we have integrated every aspect of renaming, deploying applications, patching, etc., so we simply execute the provisioning package and as soon as it's executed, it will install the management agent. Once the agent is installed, it will take care of all the tasks, so we don't have to sit in front of the computer to prepare the machine. This really helps us to provision the PC quickly with our agent. 

Now, we are going to do a PC refresh. It's a big project for next year. We are going to replace all of our PCs—1,500 PCs—with a new one, for all the users, so we have big requirements for ManageEngine. ManageEngine does a lot of scripting work in the backend—including renaming the computer according to our conventions, distributing applications, patching—so when we prepare the machine, we want everything to be installed and ready to give to the user. We don't want to wait or take more time, so we've now combined ManageEngine with Microsoft's Autopilot and Intune to provision the PCs. PC provisioning is made easier with ManageEngine. 

Another benefit is we have the option to pilot updates with some machines before distributing them to production, and this can be completely automated. We don't have to create said task every time for testing and deployment, so once we scope it, it relieves the time we spend each month deploying patches. It regularly runs in our schedule with the reboot options. We give reboot notifications in a user-friendly manner to employees, with the option to postpone the reboot. This relieves the time that we spend with end users since it's user-friendly. 

One of the most valuable features is patching. They support third-party patching as well, so we don't have to use another product. They support both Microsoft and third-party updates, and this is one of the main functionalities that we use regularly. 

The software deployment feature is also valuable because, once in a while, we need to distribute applications, such as VCO, Office applications, etc. For example, when we prepare a PC for users. We use ManageEngine to perform lots of tasks. 

We also have the option to deploy scripts via ManageEngine. We use some scripts that are to be deployed during the machines' provisioning, to make sure our machines are renamed properly according to the naming conventions we want. For example, for the France region, we want FRP, France Paris, and then the serial number. We want to deploy some script that renames the PC after the machine is provisioned, and we also want to deploy background images, logon screen, logout screen, etc. So we deploy all these policies using ManageEngine.

ManageEngine could be improved by giving customers an option to perform certain actions proactively. Since I was a consultant, I worked on different products and some had advantages over ManageEngine. For example, proactive remediation—you want to proactively check something on the computers and run the script. In ManageEngine, you have the option to run the script, but Intune has the option to do so proactively. ManageEngine doesn't have this. You should have the option to act proactively, not just going ahead and fixing it once it's done. Proactive remediation should be a feature. 

Another thing is, with PC provisioning, they have to make it in a modern way. They have deployment, but it's a very outdated process right now. It's a modern workplace, so you have to provision a PC live, on the go—it's not that you create images and then distribute the image to the machines. Many customers are not using this and, in fact, we are not using it. We use a modern way of PC provisioning. So they have to concentrate on that more. 

There are small glitches, but it's not going to stop you from using the product. For example, when you open the configuration, you may not see the details, but if you refresh the page, you will see them. There are small glitches here and there that we can see. 

I began using this solution about a year ago. In the past, I implemented this solution for different customers, but now I am an end user.

This solution is very stable. It depends on the size of the company, though. For us, it's very stable because we don't have many machines. The overall count is 1,800 to 1,900 machines—our license is for 2,050, but we've currently only utilized 1,900. So our infrastructure is medium-sized, I would say. If you go for 10,000, 20,000, you might have some lagging in the performance, but I'm not sure. 

It doesn't really require much maintenance. You just keep it as you want and regularly do a cleanup of old applications—when you delete, you have a new version of the package, so you might want to clean up the old packages—and that's it. You have automatic cleanup functionalities in the product itself. For example, if you download an update for this month and, after three months, none of the machines require this patch anymore, it automatically cleans up. You have some settings to enable so that you don't have to manually work on the cleanup. 

This solution is very easy to scale. We are trying to create lots of virtual machines in Azure Virtual Desktop, so we might increase our machines by another 100 or 200. 

ManageEngine's support is one of the best, I would say. We have chat support, so I can immediately ping someone in support, from my end product console, and get assistance very quickly. If I have a question, I can ask them directly; if I have technical questions, I can ask them, and they will provide an answer right away. If I write an email, it will take three to four hours. Since I was a support engineer before, I don't normally raise questions, but when I do, I normally get quick replies. Because it's a one-to-one chat, you get immediate responses from the chat window. 

In the past, when I first joined this company, we were using WSUS to patch all of our machines, but we didn't have any control over what patches were installed. We didn't have a proper reporting aspect in WSUS—we could have, but it's very complicated. We'd have to connect the information using SQL Server and pull the information, and that's lots of querying. But with ManageEngine, it's explicit. You go and collect the reports as you want, such as the number of patches installed on a machine or how many machines got a particular update. We even have the option to uninstall patches once they're installed, so we can go back to the previous patch version of the application. 

Another drawback with WSUS is that you don't have the option to scale a reboot. With ManageEngine, we can give reboot notifications in a user-friendly manner to employees, with the option to postpone, and after a certain number of days, you can reboot forcefully. This relieves the time that we spend with end users, who now get a pop-up. You don't have many options with WSUS, but with ManageEngine, you do. 

The deployment process is very easy. It's a combined product, so when you install the Desktop Central EXE, you install the database on the same machine, as well as the web server components like Apache Tomcat and Observer. Basically, when you install the EXE, you just click "next," "next," "next," and then it's done. It's not a big deployment. In terms of planning, you might need a little bit of time, but that's it. It's a half-day or one-day task, not like SCCM where you have to spend a lot of effort and there are lots of technical guides, technical architectural documents, etc. So it's very user-friendly in terms of deployment, I would say. 

The number of people involved in deployment depends on the size of the company. As I was a consultant before, I worked with two people, sometimes with one to six people. So it depends on the company. For example, in our company, we have only two people who manage the platform. To be honest, I cannot say that only one person can install this solution. 

For us, the deployment took two to three days, but it's not a continuous three days. We installed the server component and we installed the distribution server component after two days. So on the whole, we would've spent two to three days, maximum. 

We implemented through an in-house team. 

The pricing is very low, compared to other products. Compared to Intune or SCCM, it's much less. I can say it's a good product for less of a price. 

Intune doesn't really have a price, at the moment, because they integrated Intune with another license for Microsoft. If you purchase M365, you get the license. They've made everything a combo now, so obviously any company will go for M365, which includes everything. That's what our company has, and we don't pay anything extra for it. If you split the money, it would be much less than Desktop Central, so you can't technically compare the two. 

ManageEngine's licensing is not as good. They add new features and they ask for money. For example, they introduced Browser Security, which is an extra add-on. Compared to Intune, you just buy the Intune product and that's it, you have everything in place—browser security, endpoint management, etc. Everything's included with the Intune license, which isn't the case with ManageEngine. That's something they really need to take care of. 

We also use Intune, which offers many functionalities since it's integrated with Office 365. In terms of the experience, it's very light, but since ManageEngine is a completely different product, you have to integrate a lot of things. For example, installing the ManageEngine agent to all the machines if you want to onboard them. In comparison, with Intune, normally when you prepare the machine, it's automatically included, so onboarding is easy. 

Also, since Intune is a cloud service, you don't need to manage any infrastructure and you don't need a server to host the solution. With Desktop Central, you need a server, and that server should be managed by someone else as well, like a GDC team, a server team. 

Both solutions have advantages and disadvantages. For example, creating packages in ManageEngine is easier than Intune. In Intune, you have to create a package and convert it to a package format supported by Intune. In ManageEngine, you can create EXE or MSI—both are supported—and you just upload and create the package. 

ManageEngine Desktop Central is a product that's worth the money. It's easy to install and quicker in action. If you start installing the product today, in a small environment, you will be able to deploy the application in two hours. 

I rate ManageEngine a seven out of ten. They have a lot of improvements to make. 

We used AirWatch or VMware Workspace ONE to protect mobile devices on a large scale. They were known for being focused on mobile, more than desktops. They may not be as good on desktops, but the main use case is to monitor and manage mobile endpoints, e.g. wireless devices such as  tablets and phones. AirWatch became well known for being really good at monitoring and managing mobile endpoints.

VMware Workspace ONE isn't that good with patching and fixing, especially when compared to BigFix. This is an area for improvement. BigFix did a really good job in terms of patching and fixing, but it had a lot to do with IBM's integration to virtually every other platform out there. That integration really helped from just a server patching and endpoint management situation.

They (IBM) are very good at doing discovery, which is basically surveying the endpoint asset and finding out what vulnerability was there. It might be you're running Windows 10.647, and there are known vulnerabilities below that, so the prioritization of that patching became easy to create rules for, and make sure that you patched all devices with that current OS expeditiously.

Training for VMware Workspace ONE could also be improved, especially when compared to HCL who did a good job, either remote or self-paced.

VMware support has always been good, even if they became a really large company. They have what I call "Amazonitus", e.g. there's a lot of level two triage or level one triage, but you definitely get a response back, though a lot of people have moved away towards self-service. The goal is never to take a phone call if they don't have to, which I understand.

Their tech support is still rock solid on both sides, but would really depend on the kind of problem you have.

The setup for VMware Workspace ONE is good, e.g. there are no complexities, and they all have good discovery now. You plug them in, make sure the nodes are aligned on the network, then you can get to them. The setup process for VMware Workspace ONE and one of its competitors IBM, is very good. They've both done a very good job of it.

I was able to evaluate HCL (BigFix), Microsoft, Blackberry, and Ivanti.

AirWatch evolved into VMware Workspace ONE, so it's the same product. AirWatch was more of a competitor of mobile device management and security, so they weren't as good in patching and fixing.

There's another type of solution now that we call unified endpoint management (UEM), and that's a whole new category. I actually have quadrants in that. I know that AirWatch, even when they were acquired by VMware, e.g. it's now VMware Workspace ONE, was still highly rated. HCL is still highly rated. Microsoft was also good. Ironically, another company that was very good for mobile device management and one of the security companies out there is BlackBerry. They're still alive.

I've worked on most of the UEM solutions, including VMware Workspace ONE. For Blackberry, we haven't touched that lately. We have touched BigFix. I do have customers that are still running BlackBerry Spark®. I know even Google is trying to get in the game. Ivanti is also another UEM solution we've been dealing with. There are a number of different ones, e.g. even IBM has moved their MaaS360® platform to try to do unified endpoint management now.

The advice I'd like to give to others looking into implementing VMware Workspace ONE, is for them not to have any qualms about implementing it. Things are quick to set up, even if our team does some very hardcore security things, e.g. identity and access management, all kinds of threat landscape stuff, attack surface monitoring and modeling, etc. VMware Workspace ONE is one of the easier technologies that can be implemented for what we do, so I'm recommending it to others.

In terms of rating VMware Workspace ONE, there are a lot of "mini-categories", so they don't do some of the things I was talking about, or they're just newer into it. If I look at unified endpoint management, e.g. mobile, desktop, and everything combined, I would probably put BigFix high up there. For mobile, I would put VMware Workspace ONE high up there along with some others. Some of the SaaS ones, e.g. Tanium, do a good job, too. BlackBerry actually does a really good job with unified endpoint management, too. They just don't have billions of their devices out there, but in terms of managing their own devices, they were really the best in the early days, with a very secure platform.

HCL for UEM could be rated the best. For mobile, VMware Workspace ONE would rate the best, because they were really focused on that from the very beginning. They led the way, even if in that space you'll see 500 competitors, with people jumping up and jumping down, and constantly moving. VMware Workspace ONE in the mobile space has been very sustained in terms of how they've been rated and how they've grown over time. They owned the market with four or five of these solutions, and they were able to maintain the lead.

I could rate VMware Workspace ONE eight out of ten, but it would still depend on the use cases. BigFix is better for unified endpoint management, the ability to patch all assets, etc. VMware, on the other hand, is more focused on mobile. VMware being an infrastructure company and everybody inexpensively spinning up VMs all over the place: they've tried to pull that side a little more toward the infrastructure side, desktops, and PCs, and even on the networks, but both of them have grown tremendously.

In the last two or three years, for obvious reasons, with all the resiliency planning we do now for mobile workforces, it's really important for them to develop new capabilities, which I think they have, but this has been really good for their development. They've seen everything at this point.

Microsoft Endpoint Manager is simply a desktop, a laptop, a smartphone, or a tablet. An endpoint is exactly what it sounds like. Microsoft, on the other hand, makes use of that tool.

Endpoint allows you to deploy the operating system level. It enables the packaging and deployment of applications. It enables you to secure systems with BitLocker and incorporate things with Active Directory.

We are a consulting firm.

Our clients use it to simplify desktop builds and to maintain the patch management on their servers and desktops, as well as to have an easy mechanism for both rolling out BitLocker, which is a Microsoft tool and publishing new updates for their various software packages.

Microsoft is investing significantly more in the cloud. For our use and our clients' use, and again, our clients who use Endpoint number over 500, with an increase of 1,000 users. It is effective. It significantly reduces the overhead associated with providing support. It actually works quite well.

The installation could be improved to be simplified.

I have been working with Microsoft Endpoint Manager for the last 12 months.

We are Microsoft partners. 

We have been working for well over a decade with SCCM, and now with Microsoft Endpoint Manager.

They are deployed both on the cloud, and on-premises.

Microsoft Endpoint Manager is quite stable.

Microsoft's cloud has a capacity of 100,000 users. Depending on what you are dealing with, it's highly scalable, depending on how and where you deploy it.

It's from Microsoft. However, we are a Microsoft Premier partner. As a result, we are quite familiar with the product. Again, there isn't much of a need for it. However, our clients call us if they run into problems, which happens very rarely.

You do not have to maintain the Microsoft Endpoint that is built into their cloud, it's a cloud-based service. Locally, there is now maintenance every 16 months if you are deploying the local endpoint or creating a hybrid to Microsoft's cloud. You have to upgrade if you are deploying the local deployment. The current build changes every 16 months, but the upgrade is a very low skill set, you don't need anyone to upgrade it.

SCCM is no longer known as SCCM. It's known as Endpoint. Microsoft no longer recognizes that product. Endpoint refers to both the local and cloud-based installations. And, prior to their acquisition by Dell, we were a long-term partner with Quest. We've had clients use Quest products, but we haven't.

According to Microsoft, SCCM is no longer in use. Microsoft Endpoint is the new name for the current build. You can now deploy an Endpoint structure locally or pull Endpoint from Azure.

SCCM is no longer active.

I have worked with both Microsoft Endpoint Manager as well as Quest in the last 12 months. We have clients running the Quest Software.

The most recent Quest software we've seen is the Exchange PTS, or mail migration tool. That is probably the tool that we've had clients deal with twice. However, that is apples to oranges in comparison to SCCM.

It is the mail migration utility. According to my understanding, Quest recently sold that to a different company. So it's an old Quest product.

The initial setup is complex.

You have to appreciate two points with Microsoft Endpoint Manager. Microsoft Endpoint is based in Microsoft's cloud, 365 Azure. And Microsoft has simplified it quite a bit. They also work well with Intune. Many of their services are complementary to the solution. Autopilot is being sent out. You can have a machine auto-built from a remote location, or you can order an Autopilot deployment from your HP, Dell, or Lenovo. They've simplified it considerably since the old days, but there is still a technical element. For those with a technical nature, it is quite simple. Anything is simple if you understand the product.

You should probably consider cloud deployment before local deployment because Microsoft has made significant investments in the cloud. The local deployment is still in place. Microsoft's cloud comes with a lot of extra features that are free of charge. Furthermore, if you deploy it locally, you must own SQL, whereas, in the cloud, SQL is not required.

I would rate Microsoft Endpoint Manager a nine out of ten.

We are using BigFix for sending patches to our servers and desktops, such as security and regular updates.

BigFix has enhanced our organization by demonstrating its efficacy in delivering software updates to endpoints. For example, Microsoft releases patches and we are able to easily make them available for our end-user computing platforms. Additionally, by utilizing the network inventory feature in BigFix, we have been able to substantially improve error percentages and completion statuses, and generate reports on patching percentages within a day and subsequent weeks.

The most valuable aspect of BigFix is its ability to patch desktops. While we have complete control over servers and can easily push patches to them, desktops pose a greater risk for leaks and vulnerabilities if patches are not installed in a timely manner. By using BigFix, we have significantly improved our ability to patch desktops, whether they are laptops, desktops, or other mobile devices used by end-users.

In order to derive maximum benefit from BigFix, it is essential that we configure all of its features and implement them effectively. If the automation could be improved we would be able to mitigate the risks associated with zero-day threats.

I have used BigFix within the last 12 months.

The solution is stable. The primary role of the solution is to patch the systems to the latest released security updates. We have not had any issues once we had deployed the solution correctly.

During our exploration of available solutions, we found that very few in the market offer comprehensive security features. In our evaluation of BigFix, we were particularly impressed with its VMware functionality, which far exceeded that of other solutions we considered. Rather than having to configure multiple solutions, BigFix provided us with basic security information and VMware management detection and response all in one. While the effectiveness of BigFix is certainly a key consideration, its ability to consolidate security features was a major factor in our decision to choose it.

I rate the stability of BigFix an eight out of ten.

I rate the scalability of BigFix an eight out of ten.

I rate the support of BigFix an eight out of ten.

Positive

We were using Microsoft SCCM prior to BigFix. We switched toBigFix because we wanted to have a complete solution. Microsoft SCCM was lacking features, such as managing the network endpoints, the discovery of the endpoints, VMware functionality, and Linux patching.

The deployment of BigFix is complicated. There are a lot of firewall ports that need to be configured and with a company with 50,000 employees, this can be a challenge. The configuration could improve by being more streamlined in the future.

We were assigned a project manager from the BigFix team who provided us with a comprehensive list of requirements for establishing effective communication. However, implementing these requirements across multiple countries and coordinating with various network teams posed a challenge, particularly in terms of opening the necessary communication channels through firewalls. This was a daunting task, especially if the application utilizes codes that are commonly blocked by firewalls.

The full deployment of the solution took three months.

The price of the solution is high. There are not any additional fees from the standard license.

I rate the price of BigFix a seven out of ten.

For those considering the use of BigFix, my advice is to pay close attention to the deployment phase. This involves identifying the necessary firewall ports and ensuring that the servers are configured to communicate with the internet to download patches. Proper deployment is critical for ensuring smooth operation in the future, as troubleshooting can be difficult once the solution is fully deployed.

I rate BigFix an eight out of ten.

We have used it as a help-desk ticketing system, a software deployment platform, a patch management platform, and a hardware inventory platform.

KACE is incredibly wide in terms of what it will do for you. In certain cases, it's too much for my small businesses. Most of the companies that I support are anywhere from ten to fifty people. Whereas, KACE is such a large piece of software. It has its advantages as well as disadvantages for my businesses. It's just too big.

I think KACE could be designed a little bit more intuitively in terms of administration. Their knowledge-based articles are very good. But one of the things Microsoft does well is that they bake in a lot of the instructions and make the UI design a little bit more intuitive. So if you're flowing through something, the need to go back to the manual with Microsoft and it is not as heavy as it is with KACE. It is not necessarily always a good thing, but I would say KACE feels like an old-school piece of software. You need to make sure you've got the manual open while you're utilizing it.

Now I am trying to get the right size solution for my small businesses.

I have been using this solution for around eighteen months, probably. We just upgraded to version thirteen from eleven.

They are nice and stable. I would rate it nine out of ten.

I can't say I have had many experiences in making it scalable. With my businesses, I have never had to grow from fifty to a thousand employees.

I have used their technical support before. They are good. You pay a lot of money for their support and updates, but they do assist you when necessary. I have had positive experiences with them.

For the size of the company that I typically support, it's hard for me to say yes. I think I'm trying to kill a fly with a shotgun while utilizing KACE.

Coming from a small business standpoint, they're really expensive for the number of users. But that's not necessarily a knock against them. They're producing a piece of software for a particular segment. I just do not think they necessarily designed their virtual appliance and their support for a ten-person company. They are expensive, but are they unjustifiably expensive? I can't say that.

In my opinion, what KACE does better than Intune is third-party patch management. I think that Microsoft Intune and KACE both have the same technical functionality. But Microsoft Intune takes quite a bit of scripting in third-party management. Intune is always a lot cheaper and offers a lot of their packages as well. You have to consider what you need and what you are paying for. I would say that's the big difference between the two so far for my particular use.

Do a lot of research and make sure it fits your use case. If you're a small business, the likelihood of it being worth it to you in my opinion is minimal. If you've got a large environment where you can dedicate technical resources for managing the KACE system, onboarding and offboarding users monthly, and supporting a good number of devices and applications then maybe it works. But for a small business, is the juice worth the squeeze? I don't know.

I would like to rate the solution nine out of ten.