computer_expert

Does the hash of the downloaded file match the one posted on the download page? Usually when I have issues like this its down to the download being corrupted in some way. What happens if you use the utility from HP here rather than rufus: https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_360731071b404454b454390208 Also, you appear to be downloading a rather old version too. Here's the latest version (but take note of the UEFI & usb requirement listed in the instructions for this latest version)

You could use the DNS or HTTP header methods here if they are connected to a network you control: https://support.google.com/a/answer/6214622?hl=en Doesn't need a user to be signed in for this to work. Moderate restricted still blocks quite a bit of stuff.

Possibly UPNP punching holes through your firewall/router? If it is UPNP then disable it in your router settings.

What path is logged in the applocker event log when that prompt appears? https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker

Get something better than a UDM for core routing. Something like a proper layer 3 switch (e.g. Aruba/HP) and a separate router/firewall to make something like this: ISP > router > smoothwall > L3 switch > servers/clients (assuming the smoothwall is just the content filter and not the full firewall/filter product). As the UDM will NAT everything the upstream smoothwall will show everything as coming from the WAN IP of the UDM. does a fantasic job of describing the state of unifi routing products and puts it much better than I can (from 17:10 if the link doesn't take you there).

Windows configuration designer will allow you to create a provisioning package which should allow you to automate most of the config. Put the provisioning package on the root of a flash drive and plug it in before the device reaches the OOBE stage. If you have intune and autopilot you can upload the hardware hash and intune will provision the devices pretty much hands off (older versions of Win10 will have a few more prompts for language, as it was only fairly recently with something like 2004/20H2 that honours the autopilot langauge selection). Autopilot only works with pro and higher.

If the new settings app does the same thing then it's likely to be the 'Prohibit access to Control Panel and PC settings' GPO is enabled somewhere.

Last time I had issues with smoothwall it was due to the (newly changed at the time) intune URLs being classified as hacking.

Run Get-WindowsUpdateLog from an admin level powershell prompt to export the windows update log to the desktop folder. Look through the log and it should tell you what the error code was when WU last ran. Any errors narrowing down the issue in the event log?

I only ever run it on a ubuntu machine as by default it runs as a service. There are some instructions on geting it running as a service here, but they say it doesn't apply to windows server installs...

Sounds like it was back pressure doing it's job when the server was low on resources. Does your server have enough resources (RAM, Disk space etc)?

The NCSC site is down for maintenance now but there are some reference policies here Set the default domain to save typing the full email address in. Link Not all GPO settings appear in intune so it may be a case of applying the registry value via powershell instead.

Are you able to try autopilot on a hyper-v vm just out of interest to see if it's an issue with the hardware you are using? Office 365 shouldn't affect the process as it hasn't even got to the installing apps stage yet. Have you set up a dynamic azure AD group to target all autopilot devices? https://docs.microsoft.com/en-us/mem/autopilot/enrollment-autopilot#create-an-autopilot-device-group-using-intune Also see the 'Alerts for Windows Autopilot unassigned devices' section on the same page to see if you have assigned an autopilot profile to the device. If you don't have an autopilot profile assigned, create the autopilot group, and finally assign a profile to the new group.

Good to see you've got it going now. My best guess was that as you don't have proxy excusions defined for local servers/WSUS, they are getting routed though the proxy (possibly blocked?), then the september updates were causing issues with the upgraded requirements.

You don't need TPM for autopilot (only white glove as mentioned above). I have several machines without TPM and they work fine when deployed via autopilot. When it fails, hit Shift+F10, type MDMDiagnosticsTool.exe -area Autopilot;TPM -cab c:\autopilot.cab and grab the cab file. Some logs are best opened in CMTrace. There's descriptions of the various log files here Do you have any web filters performing HTTPS interception? are you able to try on an unfiltered connection?

I see you are using a proxy - there were some changes in september with HTTP based WSUS servers and proxies. https://techcommunity.microsoft.com/t5/windows-it-pro-blog/changes-to-improve-security-for-windows-devices-scanning-wsus/ba-p/1645547 If WSUS is too far gone then rebuild it. I find it's easier to rebuild from scratch than fix WSUS. My tips for rebuilding: Use SQL express rather than the internal database as I've found it to run better. Only tick the products and categories you need forget the driver category - it causes lots of issues Read this Newer windows server revisions default to port 8530 (8531 HTTPS) rather than 80 (443 HTTPS).

I have a few T320s with a mix of sata SSDs and assorted mechanical SAS/SATA disks. You can't mix SAS & SATA drives in the same array (if you wanted RAID10 and had 4 500GB drives but 2 are sata and the others are SAS, you would be limited to 2 RAID1 arrays (1 SATA and 1 SAS))

This article seems to suggest you can test a GPO WMI filter both locally and against a remote PC via powershell.

OSTicket looks like a good contender if you want to keep it on site. We moved from spiceworks many years ago. We have 4 different helpdesk departments running from a single instance of OSTicket with separate email addresses for ticket submission (IT@ goes to IT, admin@ goes to the admin team etc). You can log tickets via email and a web portal too.

How are you doing that out of interest? Script to push a registry key or via config profiles?

Not 100% sure if the latest version of sibelius sounds works the same way but I used this method to export the sound files and registry key and fired off a powershell script to copy the files and apply the registry setting to clients. I don't deploy sibelius any longer so sadly don't have the script but it was something simple like using robocopy to copy everything over and import the reg key at the end.

If they are school owned devices (they sound like they are) look into getting them enrolled via autopilot and the powershell script here https://docs.microsoft.com/en-us/mem/autopilot/enrollment-autopilot It's then a case of entering the credentials of your enrollment account to get it joined to AAD/intune and away you go... Edit - would help if I added the bits about blocking personal device enrollment https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set

That was for the older (better) UTM product. The newer XG one has hardware restrictions (4 cores and 6GB ram) and no IP limits. DNS ad blocking on pfSense can't get much better the the pfBlockerng addon. If you don't go down the pfsense route, then there is always pihole (which will run on x86_64 machines).

Is there any particular reason that you are still using build & capture with all the various issues it can create? I haven't used thick imaging (build & capture) since the XP days. Instead, I use thin imaging where you use the WIM image on the VLSC ISO then use task sequence steps to install updates/software etc. Yes, it may take a little longer than deploying a thick image, but when you need to update the windows image, you can just switch the deployed WIM in the task sequence (rather than go though the hassle of creating a new image). Updates shouldn't take too much time as generally you just need the latest servicing stack update and cumulative update. Drivers are dynamically deployed based on the model so you don't have to have separate images for each type of computer. I've only really used MDT to do thin imaging but looking at this post, it doesn't look too much different in SCCM.

Having recently installed server 2019 on an SSD in one of these, they are super slow now that they are ~10 years old. There's a certain bios revision that you have to install for server 2016 & later otherwise you won't be able to use the network card (something to do with NIC firmware I think).