Windows 10 has killed this job for me.

[sonofsanta]

Reinventing exam accounts for Win10. Should be simple, right? Stripped down Start Menu, couple of overly broad SRP paths for Office etc., RTFs defaulting to WordPad and no internet.

 

1) Default file associations are a computer GPO now, not user GPP. Had to use third-party software to fix this.

2) Calculator is a modern app, so can't hide it from the Start Menu. Had to block all of C:\Program Files\WindowsApps\ to stop it and other carp. Actually surprised this worked.

3) Took a day to get the Start Menu XML working properly for a layout of 4 (four) tiles, because I'm buggered if I can find anything in Event Viewer that ever tells me why it fails. The taskbar layout was working so it was applying the file, it just ignored the Start Menu part. Finally got it working by copying and pasting the relevant code in from a working layout file and altering the shortcut paths. Best guess is that some white space broke it. White space. In a markup file. Fffffffffffffffuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu

4) Browsers removed and blocked. Except Edge. Edge can't be blocked through SRP. Edge can't be taken off the Start Menu. Edge opens from Cortana searches on the Start Menu anyway. User added to Blocked Users on filter, except some sites (Kerboodle etc.) are proxy exceptions so don't get filtered, and Edge is still letting them get to said sites. AppLocker may work but is a Computer setting, not user. Should just be able to block on a per user basis, as before. Should just be able to control what appears on the Start Menu. Should just be able to control this OS outright, without it deciding what's best for me, without it reeeeally begging pleeeeease use this new software we worked ever so haaaaard on, without it arbitrarily ignoring settings when it suits it.

 

Should have been an hour's job. Currently on day 3.

 

As a consumer, I actually quite like Win10. As a sysadmin I loathe this OS like it's a Tory cabinet member.

[mikkydoos]

Anyone here done MCE's in Windows 10 ?

[rosslaing]

Reinventing exam accounts for Win10. Should be simple, right? Stripped down Start Menu, couple of overly broad SRP paths for Office etc., RTFs defaulting to WordPad and no internet.

 

1) Default file associations are a computer GPO now, not user GPP. Had to use third-party software to fix this.

2) Calculator is a modern app, so can't hide it from the Start Menu. Had to block all of C:\Program Files\WindowsApps\ to stop it and other carp. Actually surprised this worked.

3) Took a day to get the Start Menu XML working properly for a layout of 4 (four) tiles, because I'm buggered if I can find anything in Event Viewer that ever tells me why it fails. The taskbar layout was working so it was applying the file, it just ignored the Start Menu part. Finally got it working by copying and pasting the relevant code in from a working layout file and altering the shortcut paths. Best guess is that some white space broke it. White space. In a markup file. Fffffffffffffffuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu

4) Browsers removed and blocked. Except Edge. Edge can't be blocked through SRP. Edge can't be taken off the Start Menu. Edge opens from Cortana searches on the Start Menu anyway. User added to Blocked Users on filter, except some sites (Kerboodle etc.) are proxy exceptions so don't get filtered, and Edge is still letting them get to said sites. AppLocker may work but is a Computer setting, not user. Should just be able to block on a per user basis, as before. Should just be able to control what appears on the Start Menu. Should just be able to control this OS outright, without it deciding what's best for me, without it reeeeally begging pleeeeease use this new software we worked ever so haaaaard on, without it arbitrarily ignoring settings when it suits it.

 

Should have been an hour's job. Currently on day 3.

 

As a consumer, I actually quite like Win10. As a sysadmin I loathe this OS like it's a Tory cabinet member.

Applocker is a computer policy but the rules within it are item level targeted to users and groups so you should use that. I use it to block all browsers for exam accounts and it took me 5 minutes to set up. just make sure you decide form the beginning whether you are white-listing everything and then blocking apps, or blacklisting everything and allowing apps, from the start so you can plan properly. Id be using this for any of the Modern Apps as well, like calculator.

 

You can create default rules automatically as a base to work from, but be sure you check them as they are restrictive to certain folder structures for allowing apps, you may want to expand your scope there, I did!

[rosslaing]

Anyone here done MCE's in Windows 10 ?

 

not me, last one I sat was the XP one, who has the time!

[mikkydoos]

not me, last one I sat was the XP one, who has the time!

 

Just wondering if doing them sheds any proper light on the thing.... or is it just shat like we all know already.

[rosslaing]

Just wondering if doing them sheds any proper light on the thing.... or is it just shat like we all know already.

Is there any point in doing one for Windows 10 anyway, changes every 6 months haha, I think you answered your own question btw.

[Rob_D]

4) Browsers removed and blocked. Except Edge. Edge can't be blocked through SRP. Edge can't be taken off the Start Menu. Edge opens from Cortana searches on the Start Menu anyway. User added to Blocked Users on filter, except some sites (Kerboodle etc.) are proxy exceptions so don't get filtered, and Edge is still letting them get to said sites. AppLocker may work but is a Computer setting, not user. Should just be able to block on a per user basis, as before. Should just be able to control what appears on the Start Menu. Should just be able to control this OS outright, without it deciding what's best for me, without it reeeeally begging pleeeeease use this new software we worked ever so haaaaard on, without it arbitrarily ignoring settings when it suits it.

 

We got edge blocked using SRP, by blocking "C:\Windows\SystemApps\Microsoft.MicrosoftEdge*"

It doesn't stop it trying to open, but it crashes out straight away with an Access Denied error.

[sonofsanta]

We got edge blocked using SRP, by blocking "C:\Windows\SystemApps\Microsoft.MicrosoftEdge*"

It doesn't stop it trying to open, but it crashes out straight away with an Access Denied error.

Perfect! I had blocked the folder, blocked MicrosoftEdge.exe and MicrosoftEdgeCP.exe, and blocked MicrosoftEdge.exe via hash, and none of it worked. But using the wildcard path blocks it correctly (and on 1803, at least, gives me the correct error, not a crash).

 

What a perfect summary of how nonsensical administering Win10 is. It is an OS of dark secrets and whispered tips, hard won knowledge and cargo-cult solutions.

 

(Also remembered, just in time, that removing shortcuts is no longer enough, because Win10 is oh so helpful and still offers a program if you type the process name. chrome.exe and iexplore.exe now explicitly blocked, too...)

 

RE: AppLocker: it remains forever on my list of "stuff I really need to look at". I want to go the whitelist route, but that makes it a big job, and I've not yet got round to it. Given how many fires I'm constantly putting out with Win10, I don't know if I ever will...

Edited November 8, 2018 by sonofsanta

[sparkeh]

What a perfect summary of how nonsensical administering Win10 is. It is an OS of dark secrets and whispered tips, hard won knowledge and cargo-cult solutions.

Haven't you just described working in IT?

[robjduk]

We use the LTSB version on nearly 2,000 computers and don't face these issues. There is a big debate as to weather it should be used or not but it works for us.

 

Exactly the same setup here and even use it on my work laptop. No apps, no surprise updates and just 10 years of security updates. Once I got it working with start menu and taskbar layout for staff (a faff but done now) I sit back and relax in the knowledge I dont really have to worry about updating Windows for years to come.

 

Do yourself a favour and go LTSB mate. Removes 95% of the network managers hassle.

[mikkydoos]

Exactly the same setup here and even use it on my work laptop. No apps, no surprise updates and just 10 years of security updates. Once I got it working with start menu and taskbar layout for staff (a faff but done now) I sit back and relax in the knowledge I dont really have to worry about updating Windows for years to come.

 

Do yourself a favour and go LTSB mate. Removes 95% of the network managers hassle.

 

 

I plumped for LTSB 1607 too. I still have a few stupid niggles with it.

 

GP's not applying, some loopback processing GPO's REFUSE to work and many other niggles. But.... from what I've read from others and my own experience with trying to use current servicing... its a doddle.

 

I refuse to use current branch. Its cak.

[supportman]

Exactly the same setup here and even use it on my work laptop. No apps, no surprise updates and just 10 years of security updates. Once I got it working with start menu and taskbar layout for staff (a faff but done now) I sit back and relax in the knowledge I dont really have to worry about updating Windows for years to come.

 

Do yourself a favour and go LTSB mate. Removes 95% of the network managers hassle.

 

Some good info here in the future ideas for the Windows team, basically they are going to carry on releasing feature updates every 6 months.

 

https://www.zdnet.com/article/microsoft-re-releases-windows-server-2019/

 

LTSB/C surely the way forward now.

Edited November 14, 2018 by supportman

[mikkydoos]

At the end of the day.... its a computer... its meant to make things easier for people... and it should be getting easier to manage for us admins..... but with M$.... it so isn't.

 

They have got it so wrong in the last few years. Even O365 is full of mistakes.

[robjduk]

You're right it should make things easier but just does not. Why was it such a pain to arrange tiles in W8? Why did it take years and not months to be able to set a company wide taskbar in W10? I rolled out some powerpoint updates a week ago which crashed it when opening from a network location! And dont get me started with Technet.... happy to find someone else with my issue when the official response will be "run updates" while endless posts underneath saying it still does not work before you notice the thread is 3 years old and there is no fix for your problem.

I went to a 365 session at a local Microsoft company a few months back and didn't mean to but really went off on one about how irritating 365 is to manage when compared to Google products. How you need powershell scripts to licence users however they don't give you these scripts and instead make you trapse through random websites to adapt other peoples code.... or I just run the Google sync and it just works.

 

I'm stripping the last of 365 out my school and glad we didn't go in further.

 

Sorry to rant OT a little but if I had the option I would remove MS from my school and use iPads or Chromebooks. Windows S is far to little too late for me.

[sparkeh]

how irritating 365 is to manage when compared to Google products. How you need powershell scripts to licence users however they don't give you these scripts and instead make you trapse through random websites to adapt other peoples code.... or I just run the Google sync and it just works.

You don't need PS to assign licences. I just assign AD groups to licences in Azure AD and when AADC syncs users get licences

[robjduk]

thanks for the tip. I set it up years back and other than the odd sync client update I have not touched it much.

[jmak]

thanks for the tip. I set it up years back and other than the odd sync client update I have not touched it much.

I have both set up and while O365 has improved and in some ways has more flexibility, I would have to agree that G Suite is far easier to manage and often integrates into a standard MS environment better that MS's own system. Even after years and years, it feels like MS is always playing catch up.

[PotNoodleTech]

I have both set up and while O365 has improved and in some ways has more flexibility, I would have to agree that G Suite is far easier to manage and often integrates into a standard MS environment better that MS's own system. Even after years and years, it feels like MS is always playing catch up.

 

Difference is, Google is actually listening to educators. MS couldn't give two BEEEEEPS about educators views.

 

One company will end up building a strong loyal base of education customers who feel valued, the other company will haemorrhage customers.

[jthompson]

We started up with G Suite and Windows 10 around the same time (this year). From a sysadmin perspective, G Suite has been a dream, whereas Win10 feels like we're battling rising waters.

[atcoates]

Yes I hate so say it I think the Google solution for schools is just a win, win. Microsoft seem to be shooting themselves in the foot with Windows 10!