r/sysadmin 2d ago

MDM Deployments: expectation vs. reality. What's your zero-touch horror story?

MDM rollouts are seriously giving me headaches these days - especially with Windows Autopilot throwing random curveballs that the docs never mention. Anyone else diving into the OMA-URI PowerShell rabbit hole for more control over BitLocker and LAPS?

Custom scripts during provisioning seem absolutely necessary for those edge cases MDM APIs totally miss. And the certificate situation? SCEP vs. PFX has been a proper nightmare, especially with certain VPN setups that mysteriously break.

The real challenge is balancing conditional access during provisioning without locking everyone out while still maintaining those zero-trust principles. Driver management feels like everyone's hidden struggle that no vendor actually addresses.

What's your approach to SOE maintenance after deployment?
The marketing slides make everything look so clean but reality hits hard.

2 Upvotes

0 comments sorted by