The real main issue with SDU for us is that sometimes, the pre-install scan procedure goes utterly ape____ bonkers and brings an endpoint to its knees. And I'm not talking about old XP boxes that should be retired, but brand new newly-deployed high-end workstations. We'll end up with SDU scripts in a logjam, sometimes three copies of the same script queued up. Support's response when we complain about this is either "you're doing it wrong" or "there'll be a hotfix."
There's a good chance we won't renew when our licenses run out, I'm sayin'.