You can see live details of PCs that don't have the latest anti-virus definitions as well as any detected malware. Having all this in a single view is very useful for support calls, especially as you see Remote Assistance requests here too - the more details you can get without having to interrogate the user, the faster you can identify the problem.
Policies let you enforce settings like taking a system restore point before removing malware, stopping users from repeatedly postponing scans as well as choosing how to treat malware depending on how dangerous Intune thinks it is. There's a policy to replace existing anti-virus software with Endpoint Protection, but this only works with enterprise versions of five anti-virus tools.
Just staying on top of Windows updates can be a full-time job. With Intune you still have to decide which updates to apply but the interface makes it easy to review and approve updates and you can choose which PCs will receive them and when.
You can also set policies for dealing with updates and managing firewall rules. The templates abstract the differences between the Windows Firewall in XP, Vista and 7 so you only have to write the policies once - a big timesaver. However the number of policies you can set in Intune is very small compared to Group Policy and while Group Policy Objects (GPOs) are better suited for larger infrastructures than what Intune's target customers may have, the ability to control more settings on client PCs would be nonetheless be extremely useful. Microsoft plans to add specific controls in future updates for key scenarios like power management rather than replicating the current complex group policy interface, but this initial release errs on the side of simplicity.
