Windows 10 Base GPO

[gshaw]

I've been playing with 10 on my laptop for some time and happy with it as a standalone system. We've got a batch of Surface 3 devices in from Microsoft (50% off RRP ) and just setting them up, starting with a Win10 Education upgrade.

 

Was wondering what basic GPOs you've all been applying that are specific to Win10 machines? Being a bit cheeky and trying to save some time getting these in a usable state

[zag]

From reading a few other threads in this forum, I don't see Windows 10 being suitable at all for locked down educational use.

 

I do wonder if anyone actually is running it with full working GPO's yet.

[Michael]

From reading a few other threads in this forum, I don't see Windows 10 being suitable at all for locked down educational use.

 

I do wonder if anyone actually is running it with full working GPO's yet.

 

I have a full set of tested/working GPOs and plan on deploying it next week when Office 2016 is released.

[gshaw]

Care to share or some pointers 😉

[Michael]

Care to share or some pointers

 

It's better to look at it from two angles - firstly the challenges Windows 10 itself brings, but also the requirements of your school - but in saying that, I suspect most schools have the same/similar requirements.

 

General pointers I can offer are -

 

- Make sure you're using the latest Windows 10 ADMX templates

- Use AppLocker to block access to Windows 10 Apps, such as the XBOX App

- Download/install RSAT for Windows 10

- If you already have working Windows 7 GPOs, you can easily build on this for Windows 10

- If you're looking at Office 2016, download the ADMX templates when they're released

 

- In the short term I intend on completely locking down the Start Menu, until Microsoft properly address the issue of a Redirected Start Menu using an xml file

- As before, I'm going to implement a Redirected Desktop as this is familiar ground for most users

[Arthur]

If you're looking at Office 2016, download the ADMX templates when they're released

They're already available.

[Michael]

They're already available.

 

Thank you kind sir. Now we just need Office 2016 Pro please

[Michael]

I should note, AppLocker also allows you to block/restrict:

 

- Microsoft Edge Browser

- Contact Support

- Taskbar Search Menu

 

In terms of locking down the Start Menu, it's in RTM form untouched (how I've left it), but using AppLocker blocks the Apps from running. I get the feeling Microsoft wants most/all menu items visible, but using policies you can block/restrict if they're run or not.

 

You can also do the same/similar by blocking the use of MMC. This blocks everything on the Start context menu.

 

@Arthur - Has confirmed that later builds to 10240 address the Start Menu issue, however they're all in beta and not something I wish to deploy. When an official update is released, I'd have thought it will be deployable using WSUS. At this point (subject to testing), customisable Start Menus should then be deployable, but we shall see

Edited October 1, 2015 by Michael

[Blue_Cookeh]

From reading a few other threads in this forum, I don't see Windows 10 being suitable at all for locked down educational use.

 

I do wonder if anyone actually is running it with full working GPO's yet.

 

We have it (Win 10 Education) deployed to around 40 classroom PCs and 5 staff, no problem yet.

[Washu]

I would love to know how you have achieved this as I have been having a constant fight with User Account Control Settings and The Apps Menu

 

I can create a menu with what is needed for each type of user but the menu items disappear with the UIC on.

 

When the User Account Control Settings are on it hides all of the apps and the Apps refuses to run as the UACS are off.

Either way I can’t get some apps i.e. the store to run, even as an administrator

 

Can anyone help me with this conflict or able to tell me what GPOs your using for this to work?

 

Thanks

[Michael]

UAC should be left enabled, I wouldn't recommend disabling it in Windows 10.

[Washu]

I do agree but do you know what I need to do to stop it from blocking everything?

[gshaw]

@Michael is it fairly safe to say that the managed Start Menu tiles method (XML file) isn't working on Win10 at present?

[Michael]

@Michael is it fairly safe to say that the managed Start Menu tiles method (XML file) isn't working on Win10 at present?

 

Yes - it's definitely 100% broken in Windows 10240 which is RTM, however as @Arthur confirmed it's fixed in a later preview build which is still Beta. So for now I'm just locking the Start Menu in RTM format and restricting the Apps on the Start Menu running using AppLocker. This is a perfect temporary solution.

[Michael]

I do agree but do you know what I need to do to stop it from blocking everything?

 

Have you only created block rules in AppLocker? If yes, this will also stop the Start Menu appearing completely. You have to create a default allow rule and then specify each App in turn (from Win10 RSAT) and block the ones you require. I think I've pretty much blocked all apart from the good ol' Calculator App

[gshaw]

Yes - it's definitely 100% broken in Windows 10240 which is RTM, however as @Arthur confirmed it's fixed in a later preview build which is still Beta. So for now I'm just locking the Start Menu in RTM format and restricting the Apps on the Start Menu running using AppLocker. This is a perfect temporary solution.

 

Did the AppLocker rules take long to generate? Can I get away with creating them directly as a GPO (only applied to a couple of test machines) or does it really need the whole "reference computer" scenario the MS documentation talks about?

 

The pre-installed apps and lack of a clean Start Menu is one area where I agree with @localzuk about the LTSB build, would've expected the Education SKU to have a clean install without all the consumer apps. Lazy from MS there I think.

Edited October 5, 2015 by gshaw

[Arthur]

Did the AppLocker rules take long to generate?

It takes the same amount of time as it does to generate any AppLocker rule.

 

www.edugeek.net/forums/windows-10/158751-settings-app.html#post1359458

[Michael]

Once I figured it out, it probably took me 20 mins to create all the rules, then another 10 mins to import them all into other GPOs.

 

Unfortunately you're right, it has to be done in a computer context, so it applies to all (even Domain Admins).

[burgemaster]

Can you please explain the issue with the startscreen xml you mentioned in RTM?

we have it working here with RTM, the start menu is redirected from a share and the startscreen set from an xml in netlogon.

Thanks

[cogrady84]

Can you please explain the issue with the startscreen xml you mentioned in RTM?

we have it working here with RTM, the start menu is redirected from a share and the startscreen set from an xml in netlogon.

Thanks

 

Having issues here where I specify the start layout xml at a unc path normally accessible by everyone, and my start menus appears blank, no tiles, nothing. Layout was exported to xml with the powershell cmdlet. Any updates on this? I'm on build 1511 edu x64

[Michael]

Having issues here where I specify the start layout xml at a unc path normally accessible by everyone, and my start menus appears blank, no tiles, nothing. Layout was exported to xml with the powershell cmdlet. Any updates on this? I'm on build 1511 edu x64

 

I have the EXACT same problem on Windows 10 Edu, build 10.0.10240.

[cogrady84]

I have the EXACT same problem on Windows 10 Edu, build 10.0.10240.

 

Makes Win 10 a non-starter for me at the moment to be honest, I was looking forward to having this capability and can't really be bothered with workarounds when the functionality is built in. Hope they get this fixed soon!

 

I'm not in a huge rush to get this rolled out, and got enough to be getting on with as it is, so would rather it just worked! I can wait... how long though?

Edited November 27, 2015 by cogrady84

[Michael]

Makes Win 10 a non-starter for me at the moment to be honest, I was looking forward to having this capability and can't really be bothered with workarounds when the functionality is built in. Hope they get this fixed soon!

 

I'm not in a huge rush to get this rolled out, and got enough to be getting on with as it is, so would rather it just worked! I can wait... how long though?

 

The Start Menu has been a headache, as have printers, but other than this, it has been OK on the whole and well worth the upgrade. Windows 10 especially saves a lot of time updating drivers for common devices - especially the likes of Intel HD graphics being a common one.

[gshaw]

The Start Menu has been a headache, as have printers, but other than this, it has been OK on the whole and well worth the upgrade. Windows 10 especially saves a lot of time updating drivers for common devices - especially the likes of Intel HD graphics being a common one.

 

Is this because they're included in the OS or the new deployment tools?

 

The lack of working Start Menu customisations and pain of removing unwanted default apps are really poor from a business use perspective. Why would anyone want an Xbox or Candy Crush app on the Enterprise version of Windows by default?!

[Michael]

Is this because they're included in the OS or the new deployment tools?

 

The lack of working Start Menu customisations and pain of removing unwanted default apps are really poor from a business use perspective. Why would anyone want an Xbox or Candy Crush app on the Enterprise version of Windows by default?!

 

I agree, but this isn't really a problem as Applocker stops them running if the end user clicks on it. The issue is the unflexible predicament Admins are put in to customise the Start Menu easily and consistently.

 

Windows 10 obviously has many other advantages - Internet Explorer 11 as standard, rather than having to install it on top of a new Windows 7 install, as well as .NET Framework 4.6, plus it boots up fast compared to previous versions.