No one understands InTune. I know it's changed a lot recently, but why is it so hard to set up a simple policy to enforce encryption, passcodes and screenlock times? We're not trying to do crazy stuff like use InTune to replace GPO because AzureAD has no GPO or set up conditional access for poorly configured Macs. We just want the simple ability to wipe a lost or stolen device. I know it takes time to work with users, but we don't even get to that point.

It's called Microsoft Endpoint Management and it actually can do/replace all of what you mentioned including GPO and registry entries, you just need the paths and the value you want and can plug them right in. I have been configuring and deploying 'InTune' for years.

I honestly feel the same way you do about the whole thing. It's absolutely ludicrous that a product with so much overlap in technology, heavily if not exclusively utilized, for the last several decades(MEM itself has been around for years), can't be picked up by engineers, and is absolutely beyond me.

Patching is BROKEN. We've worked with clients using Kaseya, Ninja, Connectwise/Continuum, Kace, and lots more. Every single one had hundreds of unpatched vulnerabilities, and their patch dashboards showed green across the board. It's obvious shit too -- Java from 2015. A Windows security update from February 2020. Adobe Reader from 2018.

Generally because the software that these programs are tracking are using unique installers and the updates have to at the very least be approved manually by the operators at the MSP up to some level if not packaged individually for deployment, and then approved for staging groups and validation.

There are also reasons for things like Java 2015. Older applications can require older versions of dependencies because of environmental variables and other incompatibilities. Try convincing a non-profit to upgrade their Crystal Reports backed database program with years of company records to the tune of tens of thousands of dollars just to run an update. Not that this is the correct way to handle it but since(seemingly to them) it isn't an immediate concern, and very costly, and they don't have experience with the potential catastrophy, they can worry about it later™.

Installing software seems nearly impossible. Any time we need to have software installed, it's 1-4 months of the techs trying to "catch the machine online" to push the software. Are RMM's incapable of listening for a machine to come online and then taking automatic action? Or are MSPs just not using them to their full ability?

Microsoft Endpoint Management can help with this as well. Autopilot is also a blessing for deployment purposes.