Hi Paul,

For me, these would have been useful: 

What are the most common default settings that need to be changed and under what circumstances?

Each setting would need a brief reason though. EG:

• Push/Pull comms settings - distributed network, slow links, many end users, should consider changing to Pull rather than push.

Where do I find...<insert stuff>?

• Include a list of common where do I find stuff...

Why does <insert pretty much any value from home page of SEPM> not add up to.....?

• Explain where/how the figures are derived.

Why does the 'Security Response' section on the home page nearly always display 'No items to display'

• Make it clear that items are only displayed IF there are any category 3 or higher in the wild.

And finally - What should I take into consideration when upgrading from SAV to SEP?

• RTFM, RTFM and for good measure, RTFM...  IE really emphasize that this is NOT a simple upgrade. The more places this can be said, the better....

These were just a few off the top of my head - I'll post more if I think of any.

Nick