[22h2] Windows 11 AD members of Domain Guest vs WindowsApps (snipping, paint, etc)

[Kitkatninja]

Hi All,

 

We've started to roll out Windows 11 and we've noticed an issue with our students accounts.

 

We add them to the domain guests group in AD so that the profile is deleted when the machine reboots (in order to reduce used space on the SSDs). However we have noticed that apps like the Snipping tool, paint, calc, etc do not work on student accounts because they are a member of the domain guests (we have tested it without that group membership and the apps work). Mainly because from Windows 11 applications like these are now "app" rather than applications (the install place is different as well, instead of System32 it's now in the WindowsApp folder).

 

Anyway, has anyone else come across this? What did you do to resolve this?

 

We do have options, eg install 3rd party tools or take the students out of the domain guests but neither one's an option we want to go down at the moment.

Edited February 23, 2023 by Kitkatninja

[Patrick]

Thanks for posting this, we also use the domain guests membership and it's worked well on Windows 10 so it'll be good to know when we move to 11. Perhaps you may need to explore delprof options instead of domain guests for windows 11?

[Kitkatninja]

Checked out delprof - from the comments it has issues with Windows 11.

 

I'm now trying out the following, just deployed the GPO:

 

Created DeleteProfiles.ps1 (powershell script that includes the following):

 

 

$AccountsToKeep = @('administrator','Public','default','DOMAIN\administrator')

 

Get-CimInstance -Class Win32_UserProfile | Where-Object { $_.LocalPath.split('\')[-1] -notin $AccountsToKeep } | Remove-CimInstance

 

 

This is in the following the newly created GPO: "STUDENT Machine - WARNING Delete all profiles from PC", in computer -> startup script.

 

Other settings:

 

Computer Configuration -> Administrative Templates -> System -> Group Policy section. Enable the “Configure Logon Script Delay” policy and specify a delay in minutes before starting the logon scripts (sufficient to complete the initialization and load all necessary services). I put 2 minutes here.

 

and

 

Computer Configuration -> Policies -> Administrative Templates -> System -> Group Policy

“Specify startup policy processing wait time” option - set to 1 minute

 

Will update this thread on the outcome. From testing, it seems to work - deletes the profiles and reg keys, no errors so far. Tested it with 2 student logins, 4 standard staff member logins, and 4 admin accounts (to see if the same thing happens). All those profiles get deleted. I am having issues with one profile not deleting, will have to investigate that.

[Cw2k]

Have you tried the gpo for ‘Allow deployment operations in special profiles’ it should apply to Guest profiles.

[Kitkatninja]

Have you tried the gpo for ‘Allow deployment operations in special profiles’ it should apply to Guest profiles.

 

Just tested it, unfortunately doesn't work (at least in our environment) But thanks for the suggestion.