Koldov Posted October 17, 2017 Posted October 17, 2017 (edited) As the title says really! Is it even possible? We don't use mandatory profiles, do not redirect folders and rely on GPOs to lock down most of the Windows 'extras'. With Windows 7 there actually wasn't much to hide apart from standard OS features and it really didn't take too many GPO tweaks to disable most of the things I didn't want little fingers clicking on. However as we missed out Windows 8 completely, 10 has come as a complete shock with the amount of MS bloat. Thanks to all the scripts, a lot can be removed before deployment but there are still a lot of things that need to be hidden/locked down/removed. Connect, Cortana, Edge, Mixed Reality Portal, Settings, Store, pretty much everything that appears under 'W' (Accessories, Admin Tools, Powershell, System) and so on. Anyway, I have taken a quick look through the GPO settings available to deal with one or two of these, only to notice 'Requirements: At least Windows Server 16, Windows 10'... I also had a look at 'Applocker' but don't seem to be able to get past 'Either choose from a list of packaged apps on this machine or browse for a packaged app installer to use as a reference for the rule'... I don't have either do I? We are not really in a position to wipe the DC server and install 2016 as it is our only main server (also running SIMS!) apart from an old print server (which also runs as a DC for AD/GPOs etc), so am I stuck not being able to lock down Windows 10? Edited October 17, 2017 by Koldov
Steve21 Posted October 17, 2017 Posted October 17, 2017 Yep, There are GPO packs you can pull in to 2012r2 and updates for WSUS etc to manage the new updates. The requirements are normally what the GPO applies to, as in if it's older version it won't have the settings to manage, rather than the "host". You can always install the GPOs on server, and open the GPO editor on a Win10 client to test it, doesn't need to be locally on server Steve 1
sted Posted October 17, 2017 Posted October 17, 2017 yes you just need to copy the latest adms to a central store usually C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions (if you download the admx files from ms and install it creates a policydefinitions folder in c:\program files . . . just copy that folder across (add office/chrome admx files if needed and job done gpmc on your server can now see policies that are only relevant to win10 1
3s-gtech Posted October 17, 2017 Posted October 17, 2017 Yup, we control Windows 10 1703 and don't have any Server 2016 servers other than an RDP one (so a client really). Server 2012 R2 DCs. The only thing I need to occasionally use RSAT (on a client) for is Applocker rules. 1
Koldov Posted October 17, 2017 Author Posted October 17, 2017 The requirements are normally what the GPO applies to, as in if it's older version it won't have the settings to manage, rather than the "host". Thanks! Yeah definitely having a senior moment there... I think I had got in my head from another post about some settings only being managed by Server 2016. When I saw the 'applies to' part I guess I presumed it would only work from 2016 for some reason, I wasn't thinking that the policy I was editing would be used on a server. yes you just need to copy the latest adms to a central store usually C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions (if you download the admx files from ms and install it creates a policydefinitions folder in c:\program files . . . Luckily I could browse to the correct folder from the installer. The only thing I need to occasionally use RSAT (on a client) for is Applocker rules. Ah yes, so that explains the 'point to a packaged app' part if I am setting it through a Win 10 client!
Koldov Posted October 17, 2017 Author Posted October 17, 2017 Doh! Everytime... So, I've disabled Cortana! Only, I haven't....
ollyyllo Posted October 17, 2017 Posted October 17, 2017 You are basically turning of the personal assistant aspect of Cortana. The search bar next to the start menu should be simplified now. The process still needs to run to provide search results. 1
Arthur Posted October 17, 2017 Posted October 17, 2017 So, I've disabled Cortana! Only, I haven't.... What does your taskbar search box look like? Cortana is disabled when it looks like this (even though Cortana is running in the background)... Cortana is the taskbar search so you can't get rid of it completely. 1
Duke5A Posted October 20, 2017 Posted October 20, 2017 If it's available to you then you should use the LTSB version of 10. It doesn't include any of the bloat that the OEM version does and doesn't require any of the script/tweaks to clean it up.
Arthur Posted October 20, 2017 Posted October 20, 2017 (edited) If it's available to you then you should use the LTSB version of 10. It doesn't include any of the bloat that the OEM version does and doesn't require any of the script/tweaks to clean it up. There are lots of downsides to the LTSB/LTSC version of Windows 10 too... https://www.edugeek.net/showthread.php?t=180723 https://twitter.com/hashtag/saynotoltsb Edited October 20, 2017 by Arthur
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now