What are some affordable Intune alternatives for Windows policies?

Start with a feature checklist rather than looking for a direct replacement. Windows Update rings, security baselines, Defender settings, BitLocker configuration and recovery key storage, compliance reporting, and app deployment may not all be equally well covered by another product.

Fleet is one open-source option to investigate for inventory and policy visibility, but check its current Windows management capabilities against each requirement. A hybrid setup may be more realistic than expecting one open-source tool to cover everything Intune does.

ManageEngine Endpoint Central, Workspace ONE, and OpenText ZENworks are commercial products worth putting on the evaluation list. Get quotes for your endpoint count and test the policies you actually need. Being cheaper than a large enterprise product doesn't necessarily make a tool cheap at 200 devices.

Since you're considering leaving AD, ask each vendor how enrollment, identity integration, and policy delivery work without it. Workspace ONE is one option to check if Google is your identity provider.

Before ruling Intune out entirely, check what licensing you already have and price the relevant plan against the alternatives. Then include setup, support, and ongoing maintenance in the comparison. License savings can disappear pretty quickly if the replacement needs a lot of custom work.

A remote management tool plus PowerShell can cover some gaps, but you're taking ownership of the scripts, testing, error handling, and reporting. That can be reasonable for a few specific settings. It's a much bigger commitment if it becomes your entire policy system.

Pay close attention to the security of any remote management agent. It may have system-level access across the fleet, so review access controls and the vendor's security practices before deploying it widely.

I'd separate the AD decision from the Intune decision. If domain controller updates have been painful, investigate those failures and what would replace domain-based policy before removing AD. Microsoft Configuration Manager is another management option, but it doesn't fit a plan to get rid of on-premises AD.