computer_expert

What about boarding schools?

Yup, Full server versions (with GUI) tend to be aligned with the releases of windows 10 LTSB/LTSC (e.g Server 2016 & Win10 LTSB 2016/Server 2019 & Win10 LTSC 2019) https://docs.microsoft.com/en-us/windows-server/get-started/semi-annual-channel-overview

Server 2016 v1607 is the latest version of 2016 with the GUI Server 2016 V1803 is server core only Server 2019 has been pulled after the windows 10 1809 data loss issues as it was based on the same build (1809)

LAPS is great for workstations & member servers, but please don't install it on a DC unless you want to lock yourself out of the domain administrator account (like I did when testing on a test DC/Domain!)

Something to watch out for if you still use Windows 7 or Server 2008/2008R2. https://docs.microsoft.com/en-us/windows-server/get-started-19/activation-19

Have you tried installing Server 2008 via the lifecycle controller? I think you hit F10 on boot then look for the OS Deployment bit once it loads.

Bingo, That's the post! Thanks

I've seen a post elsewhere saying that their 2019 kms key is a 2012 r2 key and none of their 2016 servers are activating now.

Memory was a little hazy, but here is the post I mentioned earlier: http://www.edugeek.net/forums/windows-server-2008-r2/189923-server-2008-r2-locking-up.html

Do you have eset antivirus installed on the server? If you do, is it the server product (File security) or the workstation product (endpoint AV). I only ask as there was a post recently where there were similar symptoms being caused by the workstation version running on a server (and was resolved by removing the workstation version & installing the server version).

Forget the july .net update. it was a botched horrible mess. Install the August update instead: https://blogs.msdn.microsoft.com/dotnet/2018/07/20/advisory-on-july-2018-net-framework-updates/

you could run gpresult on a client machine to generate a HTML report and see which GPO wins: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult

Take a look at server 2016 1607/windows 10 LTSB 1607 CUs. 1.2GB each last time I looked and take hours to install (feels like days though...). I tend to use the full updates rather than the express/delta ones though.

Are you using the free or paid version of meraki MDM? the old legacy 100 devices free plan hasn't had any new features since 2015.

Doe Veeam require .net? if so, make sure you install the august 2018 update for .net as the july release broke lots of stuff. https://blogs.msdn.microsoft.com/dotnet/2018/07/20/advisory-on-july-2018-net-framework-updates/

What happens if you change the scheduled install time from 1500 to 1800?

This should do the trick (assuming you are using the public zone): sudo firewall-cmd --zone=public --add-service=snmp --permanent There is a good article on firewalld here https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7

Have you allowed the SMNP ports through firewalld? I think it is something like port 161 for SNMP but you'll need to double check

HTTPS is handled by the webserver (apache in my case) rather than osTicket, so that is where you would need to set up the HTTP>HTTPS redirect. You can do SSO but depending on your level of experience with kerberos/linux it could be rather challenging (I had to turn on and look at the verbose debugging logs to get it working here...). I don't use osTicket/apache on windows so cannot comment on how easy it is to set up on windows.

Anyone having issues on the 2nd logon where the machine tries to grab the profile defined in the ADUC user profile tab instead of using the local profile? First logon is fine, it creates the local profile but on the second logon it uses the profile defined in AD (which won't work as it is a Win7 mandatory profile). GP is using the options as per post #2. Have the same issue on LTSB2016 & v1703 CBB. The profile versioning reg key is set to 1 on the LTSB box, and no v6 profile exists alongside the Win7 V2 profile so can't understand why it's using that one instead

You could manually set the 'DisableTaskMgr' value to 1 in the registry at the start of the task sequence (but don't forget to revert the value before the end of the TS otherwise you won't be able to access task manager with the local admin account). There should also be registry values that you can set for the other values in the CAD menu as you can restrict most of these via a GPO

Look into Applocker & application whitelisting. It's a lot of work to set up but is worth it in the end as you can allow only certain programs to run and block the rest.

I think there is a jumper or 2 on the motherboard (somewhere around the memory banks/processors) that you can use to clear the bios and drac passwords.

You may need to add the radius server certificate to the trusted certificates mmc snapin (machine, not user) before it will connect successfully.

Anything useful in the iLO logs? (event log and IML logs are the 2 you need)