computer_expert

If you use 1903 or later have a look storage sense. There's an option to clean up downloaded onedrive files as well as other options. https://www.windowscentral.com/how-manage-storage-sense-settings-using-group-policy-windows-10-may-2019-update

The optiplex 745 and 380s are going to be slow with SSDs & 4GB ram anyway (the remaining 380s I have range from extremely slow to slow). Sophos doesn't help either. Do you have any legacy startup/logon scripts pointing to slow to respond or decomissioned servers? Do you use group policy preferences to map printers? This can take a while with a large amount of printers needing different drivers

Don't use profile manager (part of the server app for mac) - it caused me no end of trouble with both iPads and macs. Apple school manager, DEP (device enrollment program) and Mosyle MDM are so much better. If your iPads aren't enrolled in DEP you can use Apple configurator (mac only last time I checked) to add them.

If you have an exchange server (newer than exchange 2003) then renaming domains isn't supported.

Do you have fast startup enabled in windows 10? I think fast startup breaks WOL.

Does the TPM section appear in the BIOS/UEFI settings on an affected unit? If not, see this section (How to Reset your TPM without Losing Data) There's a lot of info there on troubleshooting bitlocker too.

You could go with something like a Dell R730XD or the newer R740XD running Hyper-V/VMware ESXi and then run a VM for Emby and another VM for something like nextcloud (nextcloud would cover the file sync via apps). I have little expereince with Synology/QNAP devices so can't help much with those though.

I'd keep it on a separate system away from the hypervisor that runs everything else (an old server if you have one laying about?). If veeam is installed in a VM, then just be aware that it can be a hassle passing USB devices though (such as an external HDD for off site backups) to the VM with Hyper-V. I'll probably get a bit of criticism from other members but a backup server is one of the few roles I like to keep on a dedicated physical box (you can quickly isolate it by pulling the network cable in the case of a ransomware outbreak for example).

I would highly recommend looking into MDT. Makes things so much easier and more streamlined all for the great price of nothing. MDT only really uses WDS for PXE booting the litetouch WIM it creates.

Are you going to use Flash to clean up the mess you left?

There's an even easier way as you have SCCM/MEMCM - Windows 10 Servicing Plans https://docs.microsoft.com/en-us/mem/configmgr/osd/deploy-use/manage-windows-as-a-service My preferred way would be to use a task sequence to perform the upgrade as you get more control over the process (e.g. uninstall incompatible software before the upgrade and reinstall after, modern app removal etc)

It appears you can do something similar with MDT (here), maybe you can use some of the steps to get it going properly with plain WDS/WinPE

What about a deadline set in WSUS? I've not tried it with feature upgrades but when using deadlines on normal monthly updates it does the job.

With a server that old you'll probably have to run the free hyper-v server or some form of linux based hypervisor. I think the latest version of ESXi you can officially install is 5.5 (now end of life). V6 (also end of life) may work but you may have to perform a few workarounds. V6.5 or v6.7 added a warning that blocks unsupported CPUs and you'll have to find more workarounds. Hyper V server 2019 (CLI only, no GUI): https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2019 If you wish to use a windows guest VM with the free hyperv server above, you'll need to ensure the windows guest is properly licenced. Any linux VMs don't need a licence though.

Are you applying these edits in the User or Machine/Computer section of group policy? They need to be in the machine section as standard users cannot write to HKLM like admin users can (unless you fiddle with permissions).

The provisioning package does require a reinstall (you plug the USB key in when it gets to the OOBE part and it takes over). I'm not sure if it works with existing devices though. See this for manual enrollment. I can't remember if windows then promotes the account you use for enrollment to local admin or not (it doesn't if you use the provisioning package)

Have you created a provisioning package? https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-bulk-enroll If you have intune for education you may want to use the setup school PC app instead from the app store: https://docs.microsoft.com/en-us/education/windows/set-up-windows-10

I've not used it myself but I've seen WiX mentioned a few times before

Server 2016 updates are slow at the best of times. Use sconfig from the command prompt as I find it works better. Run Get-WindowsUpdateLog in powershell to see if that gives you any pointers in windowsupdate.log. Make sure you install any servicing stack updates first as these may be a mandatory prereq for the cumulative updates.

Not sure if this applies to HP caddies but on Dell caddies there are multiple sets of screw holes. If you use the wrong set the drive doesn't connect to the backplane connectors. HP servers can be fussy though when it comes to non HP parts like Norphy mentioned.

Having had experience of both HPE/Aruba and Ubiquiti UniFi switches, I'd say the Arubas are much better than UniFi kit. I'd go with something like an Aruba 2930f at the core and 2540 at the edge. If you need lots of SFP ports then have a look at something a bit bigger like the 5400r series for the core. If you go down the Ubiquiti route (HA!) then just be aware of the limited featureset of UniFi/Edgeswitch layer 3 bits as per the comment in post 2

That's Ubiquiti in a nutshell really. Just look at how long it took them to release layer 3 switching capability that was promised with the gen1 unifi switches (later all mention was removed from marketing stuff) and eventually they got there with the unifi gen2 pro switches. Have a look at the controller and AP firmware release notes to see what features they have added. That's probably the best way to see if it's been implemented yet. Link to release notes on their forum.

How are you trying to access the server when the DC is offline? via RDP or with a KB/mouse/monitor attached to the server? If you are using a locally attached KB/monitor, you don't have this setting enabled do you? https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation I'm not sure if the setting above applies to RDP connections though. I realise there may be constraints (budgets, lack of hardware, software licensing, maintenance etc) but I highly recommend that all AD domains have at least 2 DCs for redundancy.

Run "gpresult /h %userprofile%\desktop\gpresult.html" from an admin command prompt and look at the html file on the server's desktop. This should show you all the policies that are applied to the server and the name of the GPO that applies the setting(s). If you have a case where a local policy is set and a domain GPO setting overrides it, the domain GPO wins and is applied. I know there is a setting to change if the UPN is displayed on the login/lock screen somewhere in GP, but I can't remember where or what the setting is called. Hopefully a GPresult should show if this is set and should answer why the username looks different.

Do you have more than one DC at this site? If not, check to see if cached credentials have been disabled via GPO. https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available