karlr

I'm currently trialing "SimpleMDM", and so far I'm quite impressed. It does seem to deliver a lot of the power that you'd get from profile manager, yet seems far more reliable/user friendly. It includes the DEP options to heavily streamline the setup questions. The location tracking is achieved via an app that gets pushed down.. however the manual intervention required to open the app and grant location permissions still exists. I suspect that this will be the case for any MDM provider, unless they get some sort of special access from Apple. It doesn't look like I'll be able to proceed with AirWatch as it turns out there's a minimum license quantity that's more than double the number of devices we're currently looking at. AirWatch Express has been suggested, though I'm concerned about the fact it will have a limited set of features, similar to what I found with Jamf Now.

Nope, we generally only rebuild the base image when we're preparing for a site-wide re-image. Any imaging outside of this schedule will install the updates as part of the MDT sequence, and WSUS takes care of updates to existing machines naturally. It would be a trivial task to compose a base image every month, however.

That's not quite the same thing though, is it? Presumably you can't get the location data if you put the phone into lost mode after it's been destroyed/turned off/etc? Or does it actually cache the data on Apple's servers?

My preferred method of building updates into base images is actually just to run an MDT task sequence designed to do exactly that. Install Windows using stock media, install all updates, and then sysprep + capture a base image to use. It's fully automated in the sense that the only manual intervention required is PXE booting a virtual machine to MDT, and then importing the new image into MDT when it's finished.

I signed up for JAMF Now and took that for a quick spin, enrolled a test device using DEP etc. Unfortunately Jamf Now does seem like quite a basic product - it has significantly less options than Profile Manager, and doesn't seem to include any sort of location/mapping functionality (apart from Lost Mode). I suspect you are familiar with Jamf Pro instead? Unfortunately that isn't an option for us due to the minimum purchase requirement + the mandatory training cost.. Going to see if AirWatch is more suitable, though first I'll need to figure out the difference between the different editions..

Yes I do suspect that a proper MDM will remove many of the niggles. I have been trying to find a way to move as much as possible off the Mac Mini "server" anyway. Will try to push for this, especially since it can be quite cheap (Jamf Now is at least). Apple sometimes update various ToS relating to DEP/iOS/School Manager (as in, you have to log in to school.apple.com and accept the new one). Profile manager turns its device enrollment feature off until the ToS has been accepted, but that might just be another quirk of PM and not something all MDMs do). As far as network communication goes it's working just fine as far as I can see. We took the time to configure this properly as we're also using Profile Manager to push settings to macOS clients. Nine times out of ten we can right click a phone in PM, click wipe, and its registered in a couple of seconds. It just seems to randomly break for a phone every now and again which is then a pain to fix.

We have a small number of school owned iPhones that are intended to be signed out and used for a period of time by members of staff. This is for things such as exam invigilation, school trips, etc. When originally setting these up we were given a requirement that staff be able to receive their work e-mails on the phone, but that all data relating to that staff member is also removed from the phone when it is handed back in. To that end our model involved the use of an MDM (currently Apple's own Profile Manager) and wiping the device upon its return. This had mixed results, as staff ended up getting frustrated with the setup procedure when handed a fresh phone. We managed to cut out most of the setup steps, but the procedure still involves choosing the language, connecting to wifi (we use 802.1X so the user authenticates with their own credentials), entering their username and password again to authenticate to profile manager, agree to receive the school's configuration, set a (mandatory) pass code, and a prompt to enable location services (without which the timezone will be wrong). On occasion the enrollment process can also fail, sometimes due to Apple updating ToS and thus disabling the Device Enrollment Program until an administrator logs in and agrees to the new terms. Other times the failure is for an unknown reason and our Mac Mini server needs to be restarted to resolve it. Users can often expect to be able to simply grab a phone and be out the door for a trip in under 60 seconds, so these problems can create a lot of friction. When it comes time to wipe the device we also sometimes encounter problems with phones not receiving the wipe command (or any other command, it seems to stop communicating with the server). This leaves us with an iPhone that can't be wiped (the previous user will have set a passcode and likely won't remember it), resulting in a restore option from iTunes as a last resort. Potentially a lot of this trouble could be solved by migrating a paid cloud-based MDM which is something we're considering. However we now have an additional requirement that the phones be tracked at all time via GPS, for example if an incident happens during a school trip we'd want the last known location to be available. We do have a GPS tracking solution, however there doesn't appear to be any way to automatically configure the client for this application (Traccar) as it does not support managed preferences. There's also the hurdle of how to tell iOS that the application should run automatically and is allowed to track the device's location without user approval. "Find My iPhone" was also considered as an option however it seems this would also require manual configuration on the device when it is configured for a new user each time. The alternative would be to avoid wiping the phone each time and simply handing the same "session" on to the next other. However this does raise concerns about the previous user's data, including e-mails, text messages, as well as the general state of the device. Is anyone else dealing with similar challenges?

LayoutModification can be quite picky at what it chooses to show. For URLs consider doing the following: (so using DesktopApplicationID instead of DesktopApplicationLinkPath and specifying the URL in the XML itself). Is the "Log Off PC" some sort of shell command? I've had difficulties getting certain items to pin when using LayoutModification, for example "This PC". Also note that PowerPoint and Calculator show to the right of your Office group rather than below it. Was that how you arranged the original menu, or is that only showing up when applying LayoutModification? In your XML the cell width is set to 6, and you're using 2x2 tiles, so logically you should never have more than three columns, however this seems to be yet another bug (Caveat: I've only played with LayoutModification on 1709 so far).

We have an Office 2016 roll-out scheduled for the summer, and have installed it on some select machines to gather feedback from staff on any problems. One problem we've had reported is documents not printing "WYSIWYG" - that is, the layout isn't quite right, and printed text may appear on the previous/next page when compared to the print preview. I have attached an image demonstrating this behavior - note that in print preview the last number on the first page is 31, whereas it ends at 32 in the PDF. Printing the document results in the same output as the PDF, which I believe is the "correct" layout. This is on word 16.0.4639.1000, volume channel, latest updates installed through WSUS as of 22nd June 2018. After doing some research it appears that this is something that people have been encountering problems with for several years, but Microsoft still haven't been able to resolve despite attempts at fixes. Specifically the issue seems to present when using certain OpenType fonts (with PostScript Outlines). For example, we use "Helvetica Neue LT Standard 55 Roman" as our default font per our brand guidelines. The issue does not present if using a standard Office font, e.g. Arial. https://answers.microsoft.com/en-us/msoffice/forum/msoffice_word-mso_win10/bug-word-2016-fails-to-print-margins-correctly/22b484d4-f808-42e1-a2c0-b04de305edb3 https://word.uservoice.com/forums/304924-word-for-windows-desktop-application/suggestions/10992303-word-2016-fails-to-print-margins-correctly-messe?page=1&per_page=20 There do appear to be some workarounds available, for example forcing compatibility mode and enabling the "Use printer metrics to lay out document" however this may well cause additional side effects and could be a difficult setting to deploy, especially when it comes to existing documents. Is anyone else encountering this issue? Are you using Office 2016 successfully with purchased fonts? this older topic seems to describe the issue.

Do the store and photo apps actually run on the machines that still have the icons? In my experience I could still click on Photos and Store, but they just didn't do anything. There's also another nasty bug in 1709 that will cause you to be missing all modern apps if you delete a local profile and then log back in. I would argue that missing a core version of .NET (at least one for use by modern apps) doesn't bode well for a stable system.

I had the exact same problem. The issue is that the removal of one or more certain apps also results in a certain version of .NET being removed (Microsoft.NET.Native.Runtime.1.4) which Photos and Store depend on. The problem apps seem to include the Zune and Xbox ones. To resolve this on an existing system I believe you would need to find a source for that version of the framework (trying to install either it or Photos using Powershell is likely to fail). I am currently removing the following apps without issue: Microsoft.BingWeather Microsoft.DesktopAppInstaller Microsoft.GetHelp Microsoft.Getstarted Microsoft.Messaging Microsoft.Microsoft3DViewer Microsoft.MicrosoftOfficeHub Microsoft.MicrosoftSolitaireCollection Microsoft.MicrosoftStickyNotes Microsoft.Office.OneNote Microsoft.OneConnect Microsoft.People Microsoft.Print3D Microsoft.SkypeApp Microsoft.StorePurchaseApp Microsoft.Wallet Microsoft.WindowsAlarms Microsoft.WindowsCamera microsoft.windowscommunicationsapps Microsoft.WindowsFeedbackHub Microsoft.WindowsMaps Microsoft.WindowsSoundRecorder

Sounds like the AppLocker policies are very close but no cigar? The fact that it'll leave state in place even if the policy is removed is quite unfortunate. Still, I suppose it could be useful for blitzing specific apps that are impossible/hazardous to remove would never be conceivably needed.

As far as I've seen there isn't a way of removing those apps from the start menu short of uninstalling them. An option I am considering is prefixing my own start menu folders with a symbol (e.g. "- Microsoft Office 2016") to force them to group together at the top

The apps all appear to work just fine while logged in using the network default profile. Is this a "clean" default profile or has it been created using CopyProfile? Also were any apps removed from the image during build/before copying the profile? Also note that the apps will be broken if you subsequently delete a local profile from the system and then try to log in again. There are some additional registry keys to clean up to resolve that.

I'll have to run some tests/timing to determine the advantage of the centralised default profile. With a default profile you don't actually point users at it, you'd leave the profile field blank in AD. "Default User" (.vX) is actually treated as the "network default profile" by Windows. It will be used as a template for new local profiles, so clients will never try to write back to it. In terms of network throughput the profile comes in at under 500kb. Using that script to clear up local profiles on a similar schedule may be a workable solution, and you'd no longer have any roaming profiles to maintain so profile problems should clean themselves up.

What I'm looking at doing is copying the "default" profile to netlogon (e.g. C:\users\default -> \\domain\netlogon\Default User.v6). However to do this I am just doing a straight copy of the folder - using the "Copy To" option option in "User Profiles" WILL mess up the permissions and at best Edge won't work on that profile. The NTUSER.DAT for that default profile can be loaded in Regedit for simple changes (e.g. removing the OneDrive setup from the run key). Potentially Sysprep's CopyProfile could also be used for creating this default profile in the first place but I'm now seeing advice on avoiding CopyProfile as well. "Copy To" should be avoided at all costs, however - unless you're prepared to write a script to sanitise the permissions (some of the registry permissions are also impossible to add back using the GUI). Having the default profile on netlogon also seems to speed up the first logon time (similar to a mandatory profile). Why this is the case is somewhat of a mystery as surely this is the very same default profile that any normal local login will be using. The policies "Show first sign-in animation" -> "Disable", "Allow Cortana" -> "Disable", "Turn off Microsoft consumer experience" -> "Enable" are also recommended. As far as clearing up profiles when a user logs off... this is also something we're really keen to keep. We are currently using mandatory profiles + "Delete cached copies of roaming profiles" on Windows 7. This means that each login is a fresh one (apart from on laptops, which get taken home by staff, so a cached profile is needed along with offline files). I am looking at writing a service in C# that monitors for logoff events using SENS and then calling DeleteProfile(). There's an added caveat on Windows 10 though which will require some further fiddling with the registry after the profile has been deleted, at least until Microsoft fixes this in April.

I've encountered the same issue on 1709 after removing several apps. Even though I didn't remove the Photos app it isn't available due to Microsoft.NET.Native.Runtime.1.4 being missing. Is this on a sysprep'd image by any chance? Wonder if this is a package that will work though? https://github.com/ms-iot/iot-adk-addonkit/blob/master/Source-x86/Packages/Appx.IoTOnboardingTask/Microsoft.NET.Native.Runtime.1.4.appx

Did you copy the default profile directly from a Windows 10 system or did you use the "Copy To" button? If it was the latter I believe Edge would still fail, however "copy to" is most likely not needed since the default profile should already be ready to use as a "template" profile by design. Do you have any customisations to the default profile? Presumably when a user logs on to a computer they leave behind a local profile which is what they will log in to next time they use that particular machine. In an ideal world that local profile would be removed as soon as the user logged off ("Don't save settings at exit" is quite an old policy and I believe it may only affect things like desktop layout, rather than protecting the entire profile from modification).

I've seen a lot of advice (including on Microsoft articles/blogs) discussing the removal of Windows 10 apps to improve sign-in times as well as simply removing clutter (Solitaire Collection, anyone?). There are useful guides on how to build this process in to MDT and this all seems to do what it says on the tin. However, I want to leave certain apps installed (for example Photos, the Windows Store). They are indeed left behind (by simply removing them from the RemoveApps.xml file), however they do not install on user's profiles or otherwise run. This seems to be down to the required dependency package "Microsoft.NET.Native.Runtime.1.4" going missing at some point during either RemoveApps or the Sysprep that follows when capturing a base image. I've done some testing and it appears that the .NET package only goes missing when one or more certain apps are removed. For example, if I only remove the Bing Weather app, then everything works as expected. However if I remove multiple apps (not the full list of the ones I want to remove, but a "safer" subset) I encounter the problem: Microsoft.BingWeather Microsoft.Getstarted Microsoft.MicrosoftOfficeHub Microsoft.MicrosoftSolitaireCollection Microsoft.MicrosoftStickyNotes Microsoft.Office.OneNote Microsoft.OneConnect Microsoft.Xbox.TCUI Microsoft.XboxApp Microsoft.XboxGameOverlay Microsoft.XboxIdentityProvider Microsoft.XboxSpeechToTextOverlay Microsoft.ZuneMusic Microsoft.ZuneVideo Is anyone else currently removing provisioned apps (specifically in 1709)? Do you have a list of apps that are "safe" to remove without having a knock-on effect elsewhere? I have gone through various lists/recommendations for apps to remove, but they aren't necessarily correct for 1709. Could it be that Solitaire is actually a core component of the Windows kernel and removing it will leave your system unstable? (I've seen that joke referenced in the past towards CandyCrush).

I'm currently researching and building a Windows 10 + Office 2016 deployment. Things are progressing but I've hit a snag when it comes to profiles. We're currently using a mandatory profile for our existing Windows 7 deployment and it provides us with a number of benefits: * Cached profiles are wiped at logoff, so most user/profile related problems can be resolved with a simple logon cycle * Logon times are reduced by skipping various "first sign in" actions * Certain customisations are baked into the profile, which would otherwise be awkward to achieve via group policy (or are beneficial to have in place before GPO processes) Mandatory profiles seem to have a questionable level of official support from Microsoft as of late, and we have had to implement a few hacks to get certain software to work. For example, certain cryptographic (PKI) functions in Windows will refuse to function if a mandatory profile is detected. However this can be bypassed by simply changing the registry value that describes the profile type (e.g. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\\State). Windows 10 (especially the Creators Update onwards?) seems to complicate matters even further. While it is now possible to create a mandatory profile on 1709 (as per https://www.htguk.com/how-to-create-mandatory-profiles-in-windows-10-creators-update-1703/) there are still some caveats. For example, Edge will not run on a profile that has been copied using the "Copy To" option in the User Profiles dialog box. I've traced this back to registry permissions that are present on profiles created by Windows, but are stripped by the "Copy To" process. Specifically the strange SID S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 which is not necessarily a user account but appears to be related to some sort of new security model for UWP apps (or perhaps just specifically Edge). While it is possible to restore those permission entries to a mandatory hive (programmatically, the GUI won't allow you to add unknown SIDs) I feel like this is potentially the tip of the iceberg of problems that could be encountered with mandatory profiles in Windows 10 (especially down the line in future updates). This raises the question of whether it's time to go back to local profiles to be more in line with something that Microsoft intends/supports (roaming profiles would probably introduce their own unique set of headaches). What route have you guys taken while rolling out Windows 10? I know a lot of people's advice is simply "don't use Edge", but I'd prefer to avoid any other hard-to-diagnose issues sneaking in in the future, too.

Hmm. Are you using the built in restricted mode modification? We created a new modification that enables the "moderate" restricted mode, as detailed here: https://support.google.com/a/answer/6214622?hl=en So our modification is simply "YouTube-Restrict: Moderate" and that is what we ignore for white-listed videos. Are you using any other methods to enable restricted mode? Do the pupils log in to Google? Screenshots of our config below: ---- ----

Hi Simpsonj Our specific solution in Smoothwall for this is as follows: * Create a new category called "Whitelisted Youtube videos" or similar * Add Youtube video IDs to the "URL patterns" box for this category (hidden under the "advanced" button). Add one video ID per line. The Youtube video ID is the part after the "watch?v=" part of the video URL, for example "rdklJDAzDKk". The URL patterns list in Smoothwall does not seem to make any changes to the case of the text you enter. * In content modifications create a new policy above the one that applies your "Youtube restrict mode" modification. Set the "what" to your new "whitelisted Youtube videos" category video, the action to "ignore", and specify the Youtube restrict mode content modification.

Unfortunately we never found a graceful way to get the SSO to work for this purpose. Our current solution using Smoothwall is to enable Youtube restrict (moderate mode) for all pupils. We then have a category that we can add youtube video IDs to, and then "ignore" restrict mode for any of these videos. You could potentially do something similar depending on which web filtering solution you use. For example, outright block youtube for pupils, but then allow the URLs to specific videos with a higher precedence than the block.

We've been using Youtube Edu/Youtube for schools for some time now. It's great - allows us to give pupils access to youtube but limit them to educational content. We could also whitelist individual videos on request. However, I've just noticed that Youtube for Schools is being retired discontinued as soon as this Friday.. The replacement seems to allow us to enable moderate or strict mode on youtube via HTTP headers; fine, easy enough to do in Smoothwall. The problem comes when approving videos - as far as I can tell, you can only approve videos for users that are logged in to a Google Apps domain. As it happens, we do have Google Apps for Education fully configured (with SSO via ADFS) while comparing it to Office 365. It is not currently being advertised/offered to users. I have tested the video approval using Google Apps, and this seems fairly easy and straightforward. The part where it all breaks down is the user experience for pupils when trying to access a whitelisted video on YouTube. They will receive a message saying "This video is restricted. Try signing in with a Google Apps account". Clicking "Sign In" presents them with the usual Google login page prompting for an e-mail address. Typing in a school e-mail address and clicking next triggers the single sign on process and all is well. However, it isn't really desirable for pupils to have to type in their e-mail addresses to sign in to Youtube (or GaFE in general), even if it's only once per session on the computer. Does anyone know of any workarounds to make pupil/staff access to GaFE/Youtube more streamlined? Ideally when accessing any Google services, there should be something in the background that says "ah I see you're from I'll log you in silently". Second best option would be for the sign in to detect the domain when a user manually clicks on sign in. This could be achieved via a HTTP header, custom browser agent etc.

We currently use NTLM for Windows clients and IdentD for Macs. It would be nice to switch to IdentD across the board, but there are a few security implications to doing this. Not sure why ident would work incorrectly under terminal services? Presumably you are running an ident daemon as a service. In this case it should be able to correctly map the owner of the local/remote ports in question, unless there's something special about a terminal services session?