karlr

I'm currently trialing "SimpleMDM", and so far I'm quite impressed. It does seem to deliver a lot of the power that you'd get from profile manager, yet seems far more reliable/user friendly. It includes the DEP options to heavily streamline the setup questions. The location tracking is achieved via an app that gets pushed down.. however the manual intervention required to open the app and grant location permissions still exists. I suspect that this will be the case for any MDM provider, unless they get some sort of special access from Apple. It doesn't look like I'll be able to proceed with AirWatch as it turns out there's a minimum license quantity that's more than double the number of devices we're currently looking at. AirWatch Express has been suggested, though I'm concerned about the fact it will have a limited set of features, similar to what I found with Jamf Now.

Nope, we generally only rebuild the base image when we're preparing for a site-wide re-image. Any imaging outside of this schedule will install the updates as part of the MDT sequence, and WSUS takes care of updates to existing machines naturally. It would be a trivial task to compose a base image every month, however.

That's not quite the same thing though, is it? Presumably you can't get the location data if you put the phone into lost mode after it's been destroyed/turned off/etc? Or does it actually cache the data on Apple's servers?

My preferred method of building updates into base images is actually just to run an MDT task sequence designed to do exactly that. Install Windows using stock media, install all updates, and then sysprep + capture a base image to use. It's fully automated in the sense that the only manual intervention required is PXE booting a virtual machine to MDT, and then importing the new image into MDT when it's finished.

I signed up for JAMF Now and took that for a quick spin, enrolled a test device using DEP etc. Unfortunately Jamf Now does seem like quite a basic product - it has significantly less options than Profile Manager, and doesn't seem to include any sort of location/mapping functionality (apart from Lost Mode). I suspect you are familiar with Jamf Pro instead? Unfortunately that isn't an option for us due to the minimum purchase requirement + the mandatory training cost.. Going to see if AirWatch is more suitable, though first I'll need to figure out the difference between the different editions..

Yes I do suspect that a proper MDM will remove many of the niggles. I have been trying to find a way to move as much as possible off the Mac Mini "server" anyway. Will try to push for this, especially since it can be quite cheap (Jamf Now is at least). Apple sometimes update various ToS relating to DEP/iOS/School Manager (as in, you have to log in to school.apple.com and accept the new one). Profile manager turns its device enrollment feature off until the ToS has been accepted, but that might just be another quirk of PM and not something all MDMs do). As far as network communication goes it's working just fine as far as I can see. We took the time to configure this properly as we're also using Profile Manager to push settings to macOS clients. Nine times out of ten we can right click a phone in PM, click wipe, and its registered in a couple of seconds. It just seems to randomly break for a phone every now and again which is then a pain to fix.

We have a small number of school owned iPhones that are intended to be signed out and used for a period of time by members of staff. This is for things such as exam invigilation, school trips, etc. When originally setting these up we were given a requirement that staff be able to receive their work e-mails on the phone, but that all data relating to that staff member is also removed from the phone when it is handed back in. To that end our model involved the use of an MDM (currently Apple's own Profile Manager) and wiping the device upon its return. This had mixed results, as staff ended up getting frustrated with the setup procedure when handed a fresh phone. We managed to cut out most of the setup steps, but the procedure still involves choosing the language, connecting to wifi (we use 802.1X so the user authenticates with their own credentials), entering their username and password again to authenticate to profile manager, agree to receive the school's configuration, set a (mandatory) pass code, and a prompt to enable location services (without which the timezone will be wrong). On occasion the enrollment process can also fail, sometimes due to Apple updating ToS and thus disabling the Device Enrollment Program until an administrator logs in and agrees to the new terms. Other times the failure is for an unknown reason and our Mac Mini server needs to be restarted to resolve it. Users can often expect to be able to simply grab a phone and be out the door for a trip in under 60 seconds, so these problems can create a lot of friction. When it comes time to wipe the device we also sometimes encounter problems with phones not receiving the wipe command (or any other command, it seems to stop communicating with the server). This leaves us with an iPhone that can't be wiped (the previous user will have set a passcode and likely won't remember it), resulting in a restore option from iTunes as a last resort. Potentially a lot of this trouble could be solved by migrating a paid cloud-based MDM which is something we're considering. However we now have an additional requirement that the phones be tracked at all time via GPS, for example if an incident happens during a school trip we'd want the last known location to be available. We do have a GPS tracking solution, however there doesn't appear to be any way to automatically configure the client for this application (Traccar) as it does not support managed preferences. There's also the hurdle of how to tell iOS that the application should run automatically and is allowed to track the device's location without user approval. "Find My iPhone" was also considered as an option however it seems this would also require manual configuration on the device when it is configured for a new user each time. The alternative would be to avoid wiping the phone each time and simply handing the same "session" on to the next other. However this does raise concerns about the previous user's data, including e-mails, text messages, as well as the general state of the device. Is anyone else dealing with similar challenges?

LayoutModification can be quite picky at what it chooses to show. For URLs consider doing the following: (so using DesktopApplicationID instead of DesktopApplicationLinkPath and specifying the URL in the XML itself). Is the "Log Off PC" some sort of shell command? I've had difficulties getting certain items to pin when using LayoutModification, for example "This PC". Also note that PowerPoint and Calculator show to the right of your Office group rather than below it. Was that how you arranged the original menu, or is that only showing up when applying LayoutModification? In your XML the cell width is set to 6, and you're using 2x2 tiles, so logically you should never have more than three columns, however this seems to be yet another bug (Caveat: I've only played with LayoutModification on 1709 so far).

We have an Office 2016 roll-out scheduled for the summer, and have installed it on some select machines to gather feedback from staff on any problems. One problem we've had reported is documents not printing "WYSIWYG" - that is, the layout isn't quite right, and printed text may appear on the previous/next page when compared to the print preview. I have attached an image demonstrating this behavior - note that in print preview the last number on the first page is 31, whereas it ends at 32 in the PDF. Printing the document results in the same output as the PDF, which I believe is the "correct" layout. This is on word 16.0.4639.1000, volume channel, latest updates installed through WSUS as of 22nd June 2018. After doing some research it appears that this is something that people have been encountering problems with for several years, but Microsoft still haven't been able to resolve despite attempts at fixes. Specifically the issue seems to present when using certain OpenType fonts (with PostScript Outlines). For example, we use "Helvetica Neue LT Standard 55 Roman" as our default font per our brand guidelines. The issue does not present if using a standard Office font, e.g. Arial. https://answers.microsoft.com/en-us/msoffice/forum/msoffice_word-mso_win10/bug-word-2016-fails-to-print-margins-correctly/22b484d4-f808-42e1-a2c0-b04de305edb3 https://word.uservoice.com/forums/304924-word-for-windows-desktop-application/suggestions/10992303-word-2016-fails-to-print-margins-correctly-messe?page=1&per_page=20 There do appear to be some workarounds available, for example forcing compatibility mode and enabling the "Use printer metrics to lay out document" however this may well cause additional side effects and could be a difficult setting to deploy, especially when it comes to existing documents. Is anyone else encountering this issue? Are you using Office 2016 successfully with purchased fonts? this older topic seems to describe the issue.

Do the store and photo apps actually run on the machines that still have the icons? In my experience I could still click on Photos and Store, but they just didn't do anything. There's also another nasty bug in 1709 that will cause you to be missing all modern apps if you delete a local profile and then log back in. I would argue that missing a core version of .NET (at least one for use by modern apps) doesn't bode well for a stable system.

I had the exact same problem. The issue is that the removal of one or more certain apps also results in a certain version of .NET being removed (Microsoft.NET.Native.Runtime.1.4) which Photos and Store depend on. The problem apps seem to include the Zune and Xbox ones. To resolve this on an existing system I believe you would need to find a source for that version of the framework (trying to install either it or Photos using Powershell is likely to fail). I am currently removing the following apps without issue: Microsoft.BingWeather Microsoft.DesktopAppInstaller Microsoft.GetHelp Microsoft.Getstarted Microsoft.Messaging Microsoft.Microsoft3DViewer Microsoft.MicrosoftOfficeHub Microsoft.MicrosoftSolitaireCollection Microsoft.MicrosoftStickyNotes Microsoft.Office.OneNote Microsoft.OneConnect Microsoft.People Microsoft.Print3D Microsoft.SkypeApp Microsoft.StorePurchaseApp Microsoft.Wallet Microsoft.WindowsAlarms Microsoft.WindowsCamera microsoft.windowscommunicationsapps Microsoft.WindowsFeedbackHub Microsoft.WindowsMaps Microsoft.WindowsSoundRecorder

Sounds like the AppLocker policies are very close but no cigar? The fact that it'll leave state in place even if the policy is removed is quite unfortunate. Still, I suppose it could be useful for blitzing specific apps that are impossible/hazardous to remove would never be conceivably needed.

As far as I've seen there isn't a way of removing those apps from the start menu short of uninstalling them. An option I am considering is prefixing my own start menu folders with a symbol (e.g. "- Microsoft Office 2016") to force them to group together at the top

The apps all appear to work just fine while logged in using the network default profile. Is this a "clean" default profile or has it been created using CopyProfile? Also were any apps removed from the image during build/before copying the profile? Also note that the apps will be broken if you subsequently delete a local profile from the system and then try to log in again. There are some additional registry keys to clean up to resolve that.

I'll have to run some tests/timing to determine the advantage of the centralised default profile. With a default profile you don't actually point users at it, you'd leave the profile field blank in AD. "Default User" (.vX) is actually treated as the "network default profile" by Windows. It will be used as a template for new local profiles, so clients will never try to write back to it. In terms of network throughput the profile comes in at under 500kb. Using that script to clear up local profiles on a similar schedule may be a workable solution, and you'd no longer have any roaming profiles to maintain so profile problems should clean themselves up.