[ltsb, 1607] Changing Default User settings on an installation...

[Koldov]

Hi,

 

Just wondered if anyone could point me in the right direction for changing the settings for the default user on an already installed Windows 10 machine?

 

I have Googled a bit, but all the instructions appear to assume this is being done on the initial installation, using Sysprep and OOBE whilst setting-up (which makes sense).

 

However, all my machines have been installed and are for single users apart from 3 in areas like the staff room, library and PPA room, which are obviously multi-use.

 

I am finding complaints that each new user has to accept settings for things like Media Player, IE and Office, there are no desktop shortcuts for items they would frequently use and the default programs are not set (I'm hoping all this can be achieved by configuring the default user profile).

Edited May 14, 2018 by Koldov

[Steve21]

Are these local users or domain ones? If they're domain based most of that can be resolved by just setting the GPOs for each bit.

 

WMP as a first-run GPO or reg key you can deploy.

Office does too.

IE it depends what bit you mean but most is GPO based.

Desktop GPOs are normally redirected but you can set them to copy/direct to the default users too.

And default programs are deployable by GPO.

 

Unless you really want to modify the default user profile it's best not to as it makes life easier with any rebuilds/upgrades in the future

 

Steve

[Patrick]

You can use group policy to suppress the first run windows for office and media player etc.

Computer Configuration\Administrative Templates\Windows Components\Windows media player\

Policy: Do Not Show First Use Dialog Boxes

For office it might depend on the version you are using.

[Koldov]

Thanks guys.

 

 

 

Yeah GPO should be the way to go, and they are Domain accounts, however it just gets complicated with the OU's as some will be computer based and some will be user based (haven't looked yet - just presuming) and a lot of the staff that are using the computers are already in their respective OU for their own computers (and others based on user) as they will be a mix of Teachers, TA's and even admin/support staff. I just thought it may be simpler if possible to have a default user with everything set-up, rather than adding a lot of extra GPO's to all the respective OU's.

 

Also, I am looking not to just suppress a lot of these screens as I do want to configure them (updates, store settings, connect to the internet, enable add ons etc).

[Steve21]

But unless you're trying to do anything more unique than a standard setup you shouldn't need to customise it per user. So one GPO at top level over these users would set it for any machine they're on.

 

As an example, setting Media Player to not show first run should be for all users normally.

 

Updates would be for all users/computers etc.

 

Unless you're trying to do something specific?

 

Steve

[Koldov]

So, signing in with a new user:

 

SMART update (untick - check for updates automatically) close update window

Windows Media Player - Custom settings - Privacy options - untick 'Display media information'.... etc. Make WMP default (even ticking this does not change the default programs in settings it stays as VLC)....

Microsoft Office - First things first.... Install updates only.....

Taskbar settings - Select which icons appear on the taskbar (ALL).

Internet Explorer - Use recommended security and compatibility settings (also several add-ons are ready for use - Don't enable). remove Bing and replace with Google for search providers - Tabs - open new tabs page (without news feed).

Adobe Acrobat Reader - Say hello to easy file access... cancel.

VLC - Allow metadata network access & Regularly check for updates... untick.

Settings.... this one is massive as I change all sorts of settings - from default programs to stopping autoplay to not allowing VPN or hotspot and turning off pretty much every option on the privacy options etc.....

 

There are other things that I change as well. So, really I am wondering if GPO can do all this or if the default user profile would even cover half of this?

 

Also, I know that the end-user is able to do the clicking... I just prefer them not to (after seeing the amount of toolbars, search providers and such installed when they just click ok) or they may just cancel certain things that need to be set-up.

[Steve21]

Most of those options for Smart/Office/Adobe etc are supposed to be done before deployment in the admin settings for the installers, but yes they can be modified after with GPO/Regkeys.

 

Basically anything you do manually can be replicated as it's all saving a setting somewhere. (there are an odd one or two you can't but that's so far aside really )

 

Steve

[Arthur]

SMART update (untick - check for updates automatically) close update window

I don't use this, but it's probably a HKCU registry setting? You could use RegFromApp or Process Monitor to find out.

 

Windows Media Player - Custom settings - Privacy options - untick 'Display media information'.... etc.

Do Not Show First Use Dialog Boxes +

 

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences]
"MetadataRetrieval"=dword:00000000

 

You'll find other WMP settings in the same registry key which you could set via GPP if there isn't a GPO for it.

 

Make WMP default (even ticking this does not change the default programs in settings it stays as VLC)....

You need to set your default app associations via an XML file in a computer GPO.

 

Microsoft Office - First things first.... Install updates only.....

Use the Office Customization Tool or Group Policy to change these settings. These are the main GPO settings I change...

 

User Configuration > Policies > Administrative Templates

Microsoft Office 2016 > First Run
* Disable First Run Movie = Enabled
* Disable Office First Run on application boot = Enabled

Microsoft Office 2016 > Miscellaneous
* Disable the Office Start screen for all Office applications = Enabled
* Suppress recommended settings dialog = Enabled

Microsoft Excel 2016 > Miscellaneous
* Disable the Office Start screen for Excel = Enabled

Microsoft Word 2016 > Word Options > General
* Open e-mail attachments in Reading View = Disabled
* Prompt the user if Word is not the default application for its file extensions = Disabled

Microsoft Outlook 2016 > Account Settings > Exchange
* Automatically configure profile based on Active Directory Primary SMTP address = Enabled

Microsoft Excel 2016 > Excel Options > Security > Trust Center
* Block macros from running in Office files from the Internet = Enabled
* VBA Macro Notification Settings = Disable all except digitally signed macros

Microsoft PowerPoint 2016 > PowerPoint Options > Security > Trust Center
* Block macros from running in Office files from the Internet = Enabled
* VBA Macro Notification Settings = Disable all except digitally signed macros

Microsoft Word 2016 > Word Options > Security > Trust Center
* Block macros from running in Office files from the Internet = Enabled
* VBA Macro Notification Settings = Disable all except digitally signed macros

 

Taskbar settings - Select which icons appear on the taskbar (ALL).

Use a start layout XML file to customize the taskbar icons.

 

Internet Explorer - Use recommended security and compatibility settings (also several add-ons are ready for use - Don't enable). remove Bing and replace with Google for search providers - Tabs - open new tabs page (without news feed).

Can be done with GPO/GPP.

 

Adobe Acrobat Reader - Say hello to easy file access... cancel.

You could use Adobe's Customization Wizard prior to deploying Acrobat Reader and/or Adobe's group policy template (ADMX/ADML, not the ADM).

 

VLC - Allow metadata network access & Regularly check for updates... untick.

Create a text file called vlcrc (no file extension) containing the text below and then copy it to your Default User profile (C:\Users\Default\AppData\Roaming\vlc) or via GPP on first login (for existing users).

 

[qt4]
qt-privacy-ask=0
qt-updates-notif=0

Edited May 14, 2018 by Arthur

[Koldov]

WOW!

 

Thank you so much for detailing all of this @Arthur !

 

Still makes me wish I could just copy over into a default user setting though...