Windows 10 has killed this job for me.

[FishCustard]

IIRC the GPO option for disallowing Cortana doesn't disable the basic Start menu search functionality, only the Cortana 'digital assistant' stuff. The Start menu will still surface program names, etc. as the user types.

 

Ahh apologies, I thought it was the digital assistant bit that you were referring to. Yeah, the new Win 10 search thing is harder to squash. Ultimately though, if your ACLs and other GPOs (e.g. SRPs) are set correctly it doesn't really matter.

[AJWhite1970]

Ultimate Windows Tweaker was a valuable tool for me when I was going through the Windows 10 security settings - puts it all in a nice GUI which is much easier for an oldie like me to understand

 

https://www.thewindowsclub.com/ultimate-windows-tweaker-4-windows-10

[free780]

Wow. Didn't realise they was this much strife. Maybe Microsoft's thinking is to target 1:1 business customers who are tech savvy. They can uninstall the modern apps they don't want, start the latest feature update etc. Its geared for a less heavy handed administrative load. In edu we can't fire the students when they go poking where they shouldn't. The larger issue seems to be user competence with doing things themselves. I spend a lot of time setting up User GPP settings. Maybe we've got so used to proping up the gap in knowledge and skills. Windows 10 will force you to tighten up on security.

@FragglePete Have you allowed the DBA app in AzureAD to have rights? I can't remember the powershell off the top of my head. I did wonder about automating a process to delete the _dev user. I did write a script to automate the re-activation.

Edited September 27, 2018 by free780

[Sheridan]

It’s not so much the security risk, as mentioned we’ve all got permissions etc in place to protect folders, but it’s the fact I set a group policy (which has worked since xp) that is obeyed by explorer only in certain circumstances. To me that indicates a broken or flawed system.

 

If I set a policy setting I want the bloody thing to be enforced, not pick and choose by cortana!

[mavhc]

Things like drive hiding were always a hack anyway, 100 ways around it.

 

I don't block cmd, powershell, win-r, task manager. Because I use them in lessons for a start

 

I do block bios, recovery mode, most things in settings/control panel

[FragglePete]

@FragglePete Have you allowed the DBA app in AzureAD to have rights? I can't remember the powershell off the top of my head. I did wonder about automating a process to delete the _dev user. I did write a script to automate the re-activation.

No - it's an Application that gets called during the MDT Sequence task sequence process based on where the downloaded office install files are: eg....

 

OPPTransition.exe -Tenant TennantIdNumberGoesHere -Key SecretKeyNumberHere -Domain TheDomainNameOfYourTenant.onmicrosoft.com -NoUninstall -Version 16 -Verbose

 

Its the Key bit you have to get generated; can't remember the steps I went through initially.

 

Pete

[free780]

Connect-MsolService

$objectId = Get-MsolServicePrincipal | ?{ $_.AppPrincipalId -eq "300e65c0-b3f4-4b46-b3d5-51d99dda4edf" } | select -ExpandProperty ObjectId

Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $objectId

 

Device Based Activation FAQ.pdf

 

 

This should fix the issue for regularly re-imaged PCs.

 

I've also used this on the client to reset it.

 

Set-Location c:

Start-Process -Wait 'cmd' -ArgumentList '/c cscript "C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS" /dstatus > c:\temp\365key.txt'

$osppoutput = Get-Content -Path 'C:\temp\365key.txt'

$last5 = $osppoutput | Select-String -Pattern 'Last 5 characters of installed product key:' | Select-Object -First 1

 

 

$last5key = $last5 -replace $last5.Pattern,$null -replace ' ',$null

 

Remove-Item -Path 'C:\temp\365key.txt' -Verbose

 

Start-Process -Wait 'cmd' -ArgumentList "/c cscript `"C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS`" /unpkey:$last5key"

 

Start-Process -Wait "\\wakecoll\software\Office 365\OPPTransition.exe" -ArgumentList '-Tenant -Key -Domain -NoInstall -NoUninstall -Verbose'

 

 

 

[supportman]

We use LTSB and avoided a lot of the initial problems, seems to work well after the settle down period.

 

Local profiles and redirected start and desktop seem to work as expected so far.

[dtstivo]

I feel your pain, but windows 10 in general hasn't been to bad for us. We use the Education version and using local profiles but we are not without odd issues. One serious one we cannot seem to solve I posted about here http://www.edugeek.net/forums/windows-10/199713-windows-10-office-2016-temp-files.html

[arjanver]

What is the benefit of using education version of Windows 10?

[gshaw]

What is the benefit of using education version of Windows 10?

 

Files on Demand was the big one for us, basically 1TB per user now accessible from File Explorer without having to sync the whole thing locally

 

Not sure whether MS have ported that into LTSB 2019 but it wasn't in the old one

[dtstivo]

To be honest, none that we notice. But in general it works ok, just a few glitches.

[deletemeplz]

Windows 10 has made my life a living hell with trying to keep things constant between devices

[maark]

It has taken a long time and a lot of headache to get things working. Best to have everything on on one build e.g. if staff logon to a 1709 build then logon to a 1803 build with roaming profile you will have problems - takes two logons to get anything to appear.

1803 seems better - not thinking about looking at 1809 yet as can't face more work to fix what it is going to break :-)

[Marcs_Dad]

https://www.bbc.co.uk/news/technology-45784482

 

Nice of Microsoft to mention that this is "Isolated cases", which is not great if you are on the receiving end!

[DavR]

Another half baked release thrown out there without proper testing!

 

How about one new release a year, and test it properly first..... anybody?

[mavhc]

TCP Windows, now with reliability!

[Simcfc73]

We all used to wait for SP1 or SP2 befroe rolling stuf out... might be best to stay a version behind with W10 too

[mikkydoos]

We all used to wait for SP1 or SP2 befroe rolling stuf out... might be best to stay a version behind with W10 too

 

I'm starting my W10 rollout with exactly the same premise in mind.

 

My experience so far is W10 is an absolute pile of dog sh*te... and its making my life uber frustrated too.

The most basic issues are SO difficult to circumnavigate and the M$ online documentation might as well not exist.

[sonofsanta]

This is the problem wieh Win10 though--where before Service Packs use to be about stability and refinement, Windows 10's major updates are about adding yet another pile of half-baked nonsense on top of the foundations of sand. 1809 won't be any more stable and sensible than 1803, which wasn't necessarily any better than 1709, which wasn't any better than... etc. etc. Some problems seem to get fixed, but new ones get introduced (documents deletion in 1809, wth! 1803's improved AV interferes with stuff, too, and needs more exceptions setting), and it doesn't feel like there'll ever be a solid version of the OS.

 

1903 is meant to be the next LTSB, isn't it? Very, very tempted to reimage entirely again next year to that, then at least we can build towards some stability internally and not have to worry about basic functionality breaking again with the next feature update. We'd need to reimage every year anyway to stay within the 2-years-of-security-updates window that each release gets, so may as well do it right and treat this first deployment as the trial run where we've learnt everything we need to be worried about so we can get it right next time.

[Arthur]

1903 is meant to be the next LTSB, isn't it?

The next long-term release of Windows 10 will be when Windows Server 2022 is released.

 

1809 LTSC is already available (once MS add the ISOs back to VLSC).

[sonofsanta]

The next long-term release of Windows 10 will be when Windows Server 2022 is released.

 

1809 LTSC is already available (once MS add the ISOs back to VLSC).

 

Ah, marvellous--that'll be the one I'll look at then. The last LTSC was a bit too old to consider, and I had the niggling feeling I'd be missing out on too much stuff on the long term channel, but now I'm running a current branch version I'm looking at the LTSC with doe eyes and wistful thoughts. A job for once I've updated my virtual servers to 2019!

[DrBeaker]

Just some issues I've seen:

 

* Updates that don't work

* No native DVD playback - what should we use for teachers to simply play a DVD then? Yes we could install VLC etc but that's not the point. "Older" versions of Windows had this feature natively - so with all the years of experience since then, why did MS in their wisdom decide to remove this feature rather than add and improve e.g. Native Blu-ray support.

* Forcing everything from Control Panel to Settings - why?

 

We have enough hassle as techs in schools without frankly this crap from MS with a bodged and frankly a product that's not fit for purpose. Windows 7 will be the new Windows XP.

 

Just sort it out Microsoft - we're waiting.

[Arthur]

* No native DVD playback - what should we use for teachers to simply play a DVD then? Yes we could install VLC etc but that's not the point. "Older" versions of Windows had this feature natively - so with all the years of experience since then, why did MS in their wisdom decide to remove this feature rather than add and improve e.g. Native Blu-ray support.

To be fair, is does seem rather pointless to include DVD playback software when almost all computers don't come with optical drives.

 

Windows 8 DVD playback issues: It's all about the money

 

... when you add all this up and apply to all Windows PCs, it is an ongoing cost of hundreds of millions of dollars per year to the PC ecosystem, well over a billion dollars over the lifecycle of the operating system and yet by most predictions the majority of PCs will not even be capable of playing DVDs.

 

The high royalty payments and complex licensing process are also why Apple never supported Blu-ray movies in macOS.

 

www.theregister.co.uk/2008/10/15/jobs_slams_blu_ray_disc

 

Speaking at the launch of Apple's new notebooks yesterday, CEO Steve Jobs described Blu-ray as "just a bag of hurt" - this despite the company's membership of the Blu-ray Disc Association (BDA).

 

Jobs admitted the optical disc format is "great to watch the movies" but, he added, "the licensing of the tech is so complex".

 

Jobs has already questioned the need for new optical disc formats, saying he believes people will be keener on download and/or streaming offerings.

[DrBeaker]

Yes but the Model-T ford didn't come with:

* Power steering

* ABS brakes

* Airbags

 

To name a few - yet all of these features are in cars nowadays to the degree we consider them standard and would be weird to not have them in there. By comparison is that not a continual improvement of functions and features in cars - yet by comparison IMHO MS is going back to the Model-T Ford way?