computer_expert

I run several on a mix of debian and ubuntu VMs. Updating is pretty simple too - just run 'apt upgrade' and it stops, upgrades and starts everything back up again. I've always found it easier to run on linux.

The great firewall of China blocks it (or at least most of it). I know of a few other schools that have the same problem with students located within China. It's not available on the on the Chinese office 365 instances operated by 21vianet either

Are they disabled in the BIOS/UEFI settings?

If you can self host, OSTicket is very good. You can have separate email addresses (one for IT, one for maintenance etc) and restrict departments from seeing each others tickets. Moved from spiceworks on prem many years ago.

You could use something like the free version of PDQ deploy to push it out.

Try editing customsettings.ini like this: [settings] Priority=[b]TaskSequenceID[/b], Default [DeployW10] DeployType=NewComputer Add the bit in bold to the priority line at the top of customsettings.ini, then replace DeployW10 with the ID of your task sequence.

I think there was an issue with REFS/Modern backup storage and DPM 2016/19 at one point. Are you using the REFS file system? I always find DPM server reboots to take ages anyway (but that's probably down to my DPM server only having 8GB ram...)

I had a RD server and just port 443 was open inbound. Make sure you have RD gateway/web access installed and configured. Whatever you do, do not open port 3389 inbound as that is a reasonably fast way to get compromised.

If the suggestion by by @LeMarchand doesn't, these templates may help: http://www.edugeek.net/forums/windows-10/191783-windows-8-10-file-explorer-ribbon-customizer-adm-template-2.html#post1712936

3020s work fine with UEFI/Secure boot & Win 10. The only ones I've had issues with are the older 390/3010 which had to stay on BIOS due to issues with PXE & UEFI

Would this not do the trick for you? EduGeek.net - PaperCut makes BYOD printing free for everyone

Stab in the dark here, but maybe if you look at the computer object's OS version in AD and see if it changed during the upgrade. If not have a look at the created/modified date on the object tab in AD users & computers (you may need advanced features turned on in the AD U&C snap in). If a VMware VM, see what OS is listed in the VM properties? edit - or have a look to see if you can find any of these log files https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs

I ran this on an R420. Don't use iDRAC enterprise to mount the ISO then run the updates otherwise you will be in for a world of pain. https://www.dell.com/support/article/uk/en/ukbsdt1/sln296511/update-poweredge-servers-with-platform-specific-bootable-iso This ISO won't do things like the PSU firmware for good reason and may not have the latest updates if they were released after the ISO image was built.

Are you missing the latest SSU (Servicing Stack Update)? Sometimes you have to apply the SSU first before the updates apply correctly. What happens if you use a fresh wim with OSDBuilder or WimWitch to apply the updates?

Also using papercut on Server 2019 with sql express here...no issues to report

They promised the same with gen1 unifi switches and then removed all mention of it from the website...

Enable the pre/post windows update task sequence steps (just above your 'custom tasks' folder). This should then pull the latest updates from from your WSUS server, providing the machine has either applied GPO with WSUS configuration, or you have manually specified WSUSServer in customsettings.ini as below: WSUSServer=http://wsus-server.fqdn:8530 MDT will then handle the reboots for you. If you want to continue with WSUSOffline, you'd have to manually watch the WSUSOffline process and see how many reboots it needs (it's variable), then keep calling update.cmd from the TS like you are, then using the MDT task sequence step to reboot the PC every time WSUSoffline requests a reboot. If you don't let MDT handle the reboots then you will break the task sequence.

I use OSDBuilder to inject the latest updates into the WIM. Anything else is then pulled from WSUS.

What about using the session time limit GPOs to kick them off once the session reaches a specified length? https://docs.vmware.com/en/VMware-Horizon-7/7.3/horizon-remote-desktop-features/GUID-83C8A02F-814F-4F3F-A046-C7778195BA4F.html

With SCCM this is a checkbox toggle to disable, MDT on the other hand requires you to mount the boot image and edit an INI file as described here: Disable F8 during LTI install (updated) You'll need to do this every time you update the boot image. Edit - just re read the post and the above won't help. Leaving the post here though.

From windows 10 1507 to 1809, updates fall under the windows 10 product. W10 1903 has a separate product which you have to enable (I think there will be a separate product for the next build of windows 10 too). I sync the 'Windows 10' product (possibly features on demand too but I can't check at the moment). I don't sync any of the other products. I've seen WSUS instances where syncing drivers effectively killed them requring a fresh install & new database to speed it up

I think a script with something like certutil -renewCert may be your best bet. Longer certificate validity periods (5yr plus) may cause issues when your intermediate/root ca certificate is approaching it's expiry date though. As a preventative thing for next year, you could set up a temporary SSID with a wpa2 passphrase (and ACLs to lock it down to only access your DC(s) & CA) and use something like this to push the new profile out.

Not a definitive answer but how long are the certificates valid for? If 1 year, what about changing it to 2 years within the certificate template (should at least get you through the summer holidays!). edit - what about playing with the renewal period box in the certificate template? (note the certificate will renew at any point between the value here and the expiry date)

Nice! Any other cool features you know of? --------- If you use the CLI (which you should at least look at if you have a managed switch!) you can type menu and you get a nice little menu to configure basic things (like vlans) on HPE/Aruba gear

MDT 2013 doesn't look supported for anything newer than Windows 8.1/Server 2012 R2. I'd try upgrading to the latest version (8456). Log in to the machine after the deployment has completed and check there isn't a (possibly hidden) folder called "_SMSTaskSequence" in the root of C:. If you have this folder left on the drive, it's more than likely that the build has failed for some reason (see the logs in the log folder).