Dummies guide for GPO

[manamaga2512]

Hi all, since the departure of my network manager recently I have been lumbered with the task of rolling out 50 windows PC's. Being an apple school for the past 8 years this has been quite a challenge, but.........I now have imaging setup and fully working. I now need to look at how to start looking at configuring the start menu and tiles, and the bottom taskbar. I'm thinking that this can be done via GPO but having read many articles since Monday of this week, I'm no further forward. I have managed to fumble my way through and create a GPO which maps our virtual print queue, and this is also working fine. So far so good. But I can't for the life in me, get my head around configuring the start menu and tiles. I'd also like to remove some of the features such as the xbox (why would you have that on the edu version of W10 is beyond me anyway!), groove music, 'Get Office' etc etc. I'd also like to limit access to some of the things in 'Settings'. Probably a big ask but I would really appreciate any help in getting this done. I've never worked with group policies before so I'm a real newbie. Happy to answer any questions if more info is needed.

 

Thanks in anticipation.

[NB9457]

There's a huge thread about it here: http://www.edugeek.net/forums/windows-10/163286-windows-10-start-menu-working-solution.html maybe that could provide some insight.

 

Classic shell is used by a lot of people and it is quick to set up and get working if you need something urgently, the Win10 menu and tiles are doable, but I miss the simpler times, which classic shell recreates.

[manamaga2512]

Classic shell is used by a lot of people

 

Classic shell??

 

Sorry, I really am very new to this. On a side note, where is best to be hosting GPO's, on the DC or our image deployment server?

[Rob_D]

The GPOs themselves will be the \\mydomain\sysvol folder which is synced between all your DCs (assuming you have more than one).

Where you have the GPO management tools is entirely up to you. It should be on your DC by default, but you can add it in anywhere else you like. We have the AD Users & Computers and the GPO management tools on most of our tech PCs.

Have you checked out https://technet.microsoft.com/en-gb/library/hh147307(v=ws.10).aspx

 

Classic shell is a 3rd party program that makes the windows 10 start menu look like the windows 7 one (or possibly even the xp one depending on your settings.)

[manamaga2512]

So I thought I'd start with a simple one first. I've just been having a look through the settings in User Config>Admin Templates>Start Menu and Taskbar and I have enabled the setting 'Remove and prevent access to the shutdown, Restart, Sleep and Hibernate commands' but that policy does not seem to be working. I've set the policy in the OU in which our test PC is sat, and I've even done a gpupdate /force on the PC, to no avail. Have I missed something along the way maybe?

[sted]

have you tried on a pc that the policy is applied to running rsop.msc from the run menu and see what it thinks its policies are (rsop dosent show everything but shows most non preferences settings if you want everything (any usually you dont need it) open up a command prompt and type gpresult /h c:\gpr.html (adjust file path to suit))

 

also be aware not ever gpo applies to every version of windows some only affect windows 2000 or 2000/xp or 8/10 and so on

 

also depending on how many policies you have it might be that another policy elsewhere trumps that one again rsop is your friend it shows you what settings are applied why and from where

Edited May 11, 2017 by sted

[JJonas]

Safety first, you probably shouldn't be making changes to the default domain policy at all. If you get it badly wrong you can lock yourself out of the domain completely

[manamaga2512]

Cool, I'll check using rsop. I did clock that this particualr setting was supported on 'at least' Windows 2000 so presumed it should work. And no, I've not gone anywhere near the default domain policy :-)

[manamaga2512]

So, the results are showing that particular policy is not being applied :-/

[Rob_D]

I think I see your problem. You said you have the GPO in the OU with your test computer. But the setting is a user one.

Anything under "User Config" will only* apply to targeted users, and anything under "Computer Config" will apply to target computers.

So if you're setting User Config settings you need to have the policy in the same OU as your user account (or a parent OU).

 

Sorry if I'm not explaining this very well.

 

*there are ways of changing this behavior, but don't worry about them yet.

[manamaga2512]

Aaaaah, that makes complete sense! I think. So I've deleted the policy from it's current location, and linked it to our OU called Teaching Staff (this is where our test staff account is sat, along with all other teachers). I'll see if that does the trick.

[TechMonkey]

Not wanting to be rude but see if there is a willing EduGeek nearby with half hour on their hands, buy a book or get on a course. GPO and AD is not something you want to just have a stab at.

 

I'm guessing GPO's are already running so you have a central store? As Rob_D said you need to bear in mind User and Computer settings. Generally never mix them and in fact it is a good idea to disable the section not being used to speed up the GPO and prevent accidents.

 

If you have a test OU you could set that to Block Inheritance and they you could link the GPOs you want, one by one. Do the same with a test user OU.

[manamaga2512]

I think I see your problem. You said you have the GPO in the OU with your test computer. But the setting is a user one.

Anything under "User Config" will only* apply to targeted users, and anything under "Computer Config" will apply to target computers.

So if you're setting User Config settings you need to have the policy in the same OU as your user account (or a parent OU).

 

Sorry if I'm not explaining this very well.

 

*there are ways of changing this behavior, but don't worry about them yet.

 

You my friend are a complete legend! That has done the trick. Now all I have left to do is get my head around configuring the tiles and start menu. It's a very simple setup we have, there's no network storage as we are a GAFE school. All PC's just have office installed and google chrome. If possible, I'd like to try have the Office tiles only showing, and in the taskbar, and get rid of everything else.

[manamaga2512]

Not wanting to be rude but see if there is a willing EduGeek nearby with half hour on their hands, buy a book or get on a course. GPO and AD is not something you want to just have a stab at.

 

I'm guessing GPO's are already running so you have a central store? As Rob_D said you need to bear in mind User and Computer settings. Generally never mix them and in fact it is a good idea to disable the section not being used to speed up the GPO and prevent accidents.

 

If you have a test OU you could set that to Block Inheritance and they you could link the GPOs you want, one by one. Do the same with a test user OU.

 

No, we are an apple school. We don't have any GPO's currently and no central store. I completely get where you're coming from but the situation here is quite unique in that, my network manager left recently. The current exec principal will not be promoting or employing another network manager. The school is in special measures and we have an exec principal who has decided to get rid of all things apple. As the school has no money, I have started to trade in our current apple kit in exchange for credit with a supplier, which we can then use to purchase PC's. I have about 50 PC's in stock now ready to roll out. We have also just learned that our current academy trust (whom our exec principal is director of) is to be handing us over to a new, very large Academy Trust. The process of due diligence is currently under way. This means that come September, we will be under a new Academy Trust, will be given a new name and have a new Principal. I have met with the IT guys from the new Trust, they came in to see our network setup. They are happy with our current setup on the server side, hardware wise, but when they come in September, they will be just wiping everything and 'doing it their way'.

 

With all this going on, I am having to get rid of all apple kit while it still has value, and roll out the PC's........learning as I go. No time (and probably no money) for going on a course. The great people on here have been fabulous with helping so far. I'm just wanting a basic setup that I can roll out that will put us on until we break up in around 6 weeks time. Because at that point, everything I have done will be undone by the network guys at the new Trust :-/ Mearly just trying to keep the school going for the next few weeks.

 

Oh, and there is only me and my technician. 12 months ago we were a team of four!

 

Sorry for the head mashing reply :-)

[manamaga2512]

I'm hoping that as we are taken on by the new trust, there will be career development opportunities for my technician and I. I know that there will be no network manager on site. Network stuff will be done by the 'cluster managers'. We may well become over paid toner changers :-/ But my loyalty to the staff and students continues, they need to be able to carry on working.

[round2it]

nows the time to ask the trust it guys to come in and setup the system they want, whats the point in you messing around for them to come and wipe it all?

[manamaga2512]

nows the time to ask the trust it guys to come in and setup the system they want, whats the point in you messing around for them to come and wipe it all?

 

Because they don't officially take over until the 1st September. And I have to get rid of all apple kit and roll out windows before then. For admin staff, we have just given them stand alone PC's for now, but I can't do that in classrooms, they have to be locked down to a certain extent.

[TechMonkey]

If you have Windows servers set up a central store for your GPS. These means they all share the same one rather than it getting confusing over what went where. https://www.google.co.uk/amp/s/www.petri.com/creating-gpo-central-store-windows-server-2012-r2/amp

[round2it]

Even so in the interest of the school the senior team need to step in. One guy a couple of days to setup the system is not too much to ask.

 

I was in the same position the nm got made redundant and the vle website guy too.

 

Just me for everything.

 

Google and youtube for training.

Felt out of my depth for quite some time.

 

Just ask the worst they can say is no.

It is unreasonable to be expected to setup what they need without the training.

 

But edugeek members are here to help they have got me out of the brown stuff on many occasions.

[manamaga2512]

To be honest, I think that SLT have given up. When the NM left, I was told that I could call this here outside company for support when required (it's a big company who provide IT support for schools), but when I called, I was told that we didn't have a support contract with them. The principal had not responded to their emails and calls to setup a support contract!! I'm doing most of this off my own back in order to future proof the school for the next 3 years or so. The apple kit we have is over 8 years old. I've worked here for 10 years and in that time we've only ever had one IT refresh. Now that it's likely that SLT will be replaced in September, they've lost interest. I feel like I'm the only one who cares at the moment. They just don't know the implications of migrating from Apple back to Windows. They think we can just sell the apple kit and install PC's......easy! :-/ We didn't even have a server to host and deliver an imaging service until last week. I took it upon myself to purchase a new server for that (after trading in some iMacs) and had some great help from the tech guy at our supplier to set the server up. I would have gone back to him for help with the GPO's this week but he left the company on Friday last week!! Sometimes it feels like your pi**ing in the wind. I think I will just have to buy some support for a day or two, rather than trying to battle through myself.

[round2it]

Dont forget you can bootcamp the macs all you need is a windows licence. Have you sorted ms licences yet.

[manamaga2512]

Dont forget you can bootcamp the macs all you need is a windows licence. Have you sorted ms licences yet.

 

Yeah, we have a couple of Mac's on bootcamp already. Our MS licensing runs out near the date when they're due to take over anyway, and from that point on the licensing is dealt with at trust level rather than each school

[Primus]

Careful with Macs and Bootcamp - your MS license usually only covers devices that shipped with an original copy of Windows - the stickers are meant to be on every PC.

 

Macs obviously didn't come with an original Windows license so need a license purchasing before you can use your MS site license.

[manamaga2512]

MS licensing works on an FTE basis, not machine basis. We are licensed for 65 Full Time Employees, which is more than enough. We can install our versions of W10 on 1000 computers (if we had that many) if we wanted.

[snagrat]

MS licensing works on an FTE basis, not machine basis. We are licensed for 65 Full Time Employees, which is more than enough. We can install our versions of W10 on 1000 computers (if we had that many) if we wanted.

 

No you can't!

 

The machines have to have some form of initial license. In most cases that is OEM.

 

If all machines have a Windows 7 Home license (for example) then yes you can put Win 10 Education on under your MS license.