Logon times and folder redirection best practices

[miloshmedia]

Hi all,

 

 

I have a secondary site with sixth form with around 1500 students, 250 staff and 1000+ devices with a mix of laptops and desktops. My background is predominantly SMBs however find myself increasingly in the education space, so my experience is very slim with multiple users using multiple devices (rather than 10:1 or 1:1 setups which don't have as major problems/turnover).

 

 

The core infrastructure at the site is very modern with 1gb switching and whole-site Ruckus coverage. All devices have SSDs however some are older HP units with slower processors but all devices with at least 4gb RAM.

 

 

Since coming onboard I have done major work to get the AD setup up to speed and implement best practices, we have also built a new OU structure to try and 'standardise' where possible. I have also put together new GPOs to ensure there is nothing legacy as this had been merged from a legacy admin/curriculum network, putting users and computers under their own OUs and trying to segregate as logically as possible.

 

 

Over the past few months (from starting as local only profiles), we have tried redirected profiles which didn't work particularly well as students weren't logging off which were causing corrupt profiles, so have now gone back to local profiles (not default or mandatory) but using folder redirection on everything including AppData(Roaming) to each user's folder on the file server. This has cut logon times from about 7 minutes to roughly 3 minutes (although had a 45 second fresh login on test).

 

 

I've also disabled oobe graphics on first sign in and enabled detailed logon messages on sign in - students are getting hung on Applying Group Policy Folder Redirection Policy (I've now disabled offline files for student machines which seemed to have cured this one) but they are now stuck at Preparing Windows which is presumably where the local profile is being created. Delprof runs every 2 new users to keep the drives free as we have some DfE machines with the 64gb drives...

 

 

Any tips on speeding logon times up greatly appreciated or any GPOs I might be missing. Would love to hear how everyone has theirs setup or would have in an ideal if they started from scratch?

 

 

 

Best,

 

 

Miles

[Steve21]

Stick with local profiles including appdata (roaming etc aren't supported officially anymore). Redirected docs is fine, but as you said that's without offline etc. If it's not been redirected previously the first login will take time as it uploads all their docs to the server from the local machine

 

Remove "silly" apps from the image, things like xbox etc, as this provisions for every user when they login so slows things a lot

 

Remove delprof, that's not supported since 2018. Use the GPO settings for removal of old profiles

 

Get that RAM upgraded to 8gb+, 4gb is below minimum "real-world" spec nowadays

 

Steve

[miloshmedia]

Thanks Steve, hopefully remnants of slow logins are from where the offline files policy is being pulled down. I can remove the apps from the image, do you know if there is a quick way of doing this post-install via powershell etc?

 

We use the GPOs for removing old profiles, I said delprof for ease of use but I'm using the 'Clear profiles after x users' policy and might use Delprof2.0 in a bi-weekly script to polish up. The site is being upgraded to 8gb but unfortunately this isn't all in one go.

 

 

Thanks for the tips.

[Steve21]

Depending on what deployment methods you have available (whether SCCM or just GPO etc), you could just use one of the powershell scripts that does this

 

Example below (this is one of the ones we ran for Windows 10 via SCCM during OSD but it can work after too)

 

$AppsList = 
"Microsoft.BingWeather",
"Microsoft.GetHelp",
"Microsoft.Getstarted",
"Microsoft.Messaging",
"Microsoft.Microsoft3DViewer",
"Microsoft.MicrosoftOfficeHub",
"Microsoft.MicrosoftSolitaireCollection",
"Microsoft.MixedReality.Portal",
"Microsoft.OneConnect",
"Microsoft.People",
"Microsoft.Print3D",
"Microsoft.SkypeApp",
"Microsoft.StorePurchaseApp",
"Microsoft.Wallet",
"Microsoft.WindowsAlarms",
"Microsoft.WindowsCommunicationsApps",
"Microsoft.WindowsFeedbackHub",
"Microsoft.WindowsMaps",
"Microsoft.WindowsPhone",
"Microsoft.WindowsSoundRecorder",
"Microsoft.Xbox.TCUI",
"Microsoft.XboxApp",
"Microsoft.XboxGameOverlay",
"Microsoft.XboxGamingOverlay",
"Microsoft.XboxSpeechToTextOverlay",
"Microsoft.YourPhone",
"Microsoft.ZuneMusic",
"Microsoft.ZuneVideo"

ForEach ($App in $AppsList) 
{ 
   $PackageFullName = (Get-AppxPackage $App).PackageFullName
   $ProPackageFullName = (Get-AppxProvisionedPackage -online | where {$_.Displayname -eq $App}).PackageName
       write-host $PackageFullName
       Write-Host $ProPackageFullName 
   if ($PackageFullName) 
   { 
       Write-Host "Removing Package: $App"
       remove-AppxPackage -package $PackageFullName 
   } 
   else 
   { 
       Write-Host "Unable to find package: $App" 
   } 
       if ($ProPackageFullName) 
   { 
       Write-Host "Removing Provisioned Package: $ProPackageFullName"
       Remove-AppxProvisionedPackage -online -packagename $ProPackageFullName 
   } 
   else 
   { 
       Write-Host "Unable to find provisioned package: $App" 
   } 

}

 

You just add/remove things from the top list that you want removing, so if you want Print3D just comment it out or remove it etc

 

There are plenty of other versions though, things like "Decrapifier" yes that's the name that update scripts more often with new apps as they're released etc, but I prefer to start with less and add things to remove as you go

 

Steve

[miloshmedia]

Part of the work I did was implementing MDT/WDS with a view of moving to SCCM (as opposed to manual installs!)

 

Thanks for the script, I have slightly less strong alternatives but that one will be very useful to deploy as a GPO to clean up the devices. I'm a massive fan of bulkcrapuninstaller too which is good for 1-1 machines.

 

 

A great script, thanks for sharing

[Mako]

The Preparing Windows state is where the OneDrive and Teams (if installed) clients get installed on the user's account. By default, the clients are installed in per-user setting and will actively download/update the client for each new user. Converting them to Machine (instead of user) installs can speed up the process as they can install/be used from the local hard drive rather than download for each user that logs in.

 

Edit: It's not a life-changing amount of time gained, but it is noticeable.

 

Further, I am now actively making new staff and students default to OneDrive Known Folders so we don't use folder redirection anymore. Users that are fully OneDrive have quite a rapid login.

Edited October 18, 2023 by Mako

[tylermoss]

Hi all,

 

 

I have a secondary site with sixth form with around 1500 students, 250 staff and 1000+ devices with a mix of laptops and desktops. My background is predominantly SMBs however find myself increasingly in the education space, so my experience is very slim with multiple users using multiple devices (rather than 10:1 or 1:1 setups which don't have as major problems/turnover).

 

 

The core infrastructure at the site is very modern with 1gb switching and whole-site Ruckus coverage. All devices have SSDs however some are older HP units with slower processors but all devices with at least 4gb RAM.

 

 

Since coming onboard I have done major work to get the AD setup up to speed and implement best practices, we have also built a new OU structure to try and 'standardise' where possible. I have also put together new GPOs to ensure there is nothing legacy as this had been merged from a legacy admin/curriculum network, putting users and computers under their own OUs and trying to segregate as logically as possible.

 

 

Over the past few months (from starting as local only profiles), we have tried redirected profiles which didn't work particularly well as students weren't logging off which were causing corrupt profiles, so have now gone back to local profiles (not default or mandatory) but using folder redirection on everything including AppData(Roaming) to each user's folder on the file server. This has cut logon times from about 7 minutes to roughly 3 minutes (although had a 45 second fresh login on test).

 

 

I've also disabled oobe graphics on first sign in and enabled detailed logon messages on sign in - students are getting hung on Applying Group Policy Folder Redirection Policy (I've now disabled offline files for student machines which seemed to have cured this one) but they are now stuck at Preparing Windows which is presumably where the local profile is being created. We set up a file server for a storage area where students could exchange ideas for dissertation topics. However, we later decided to abandon this idea since it was also overloading the system and further slowing down the already sluggish loading speed. As a solution, we now use an online at dissertation topics in another location, and it's currently meeting our needs. This was one of many steps I took. Delprof runs every 2 new users to keep the drives free as we have some DfE machines with the 64gb drives...

 

 

Any tips on speeding logon times up greatly appreciated or any GPOs I might be missing. Would love to hear how everyone has theirs setup or would have in an ideal if they started from scratch?

 

 

 

Best,

 

 

Miles

 

 

I have now started transferring users to OneDrive and this has noticeably speeded up the loading time.

 

 

upd. I’ll add that it would be a good idea to set a default storage limit for users.

Edited October 18, 2023 by tylermoss