FreelanceX

Just wanted to say thank you for sharing this. I work for an MSP that supports SIMS and Senso and this was driving us crazy at a bunch of our schools trying to figure out the problem. Much appreciated.

Thanks for the responses. We are the IT support for the schools in question, so in response to supplier/customer, we are both. We have a vested interest in the school getting their best bang for buck so to speak. We will be the ones supporting it going forward. I am aware it is purely WiFi switching only and the 16 core fibre. The only part i'm still trying to nail down is the switching. The reason i was asking about what switches others have had approved is, I don't want to be unreasonable with what switches we propose to the DFE and get declined, but I also want to make sure we aren't missing out on getting the best possible equipment for the schools. Looking at 2.5gb switches with 10gb uplinks does put you into the realm of 5 figures, so just wanted to make sure I am being reasonable.

Hi All, We are currently looking at a ton of our schools getting funding for this in the next few months. We are in a PIA where pretty much every school in the area will be covered. I am specifically looking to see what switches people have already had approved by the DFE, so I know what level/cost we can request. We are looking at Aruba CX switches which can be managed in Central. The cost for the multi-gig models can easy breach £10k and just wanted to see if people have had that accepted/rejected, before I go too far with my current research. Also wondering if people have gone redundant core or stacked edge with their switching and had that accepted. In regard to switching, the guidelines are very vague. Based of rough costs, a large primary could easily break £100k. Thanks in advance.

Was planning to upload my xml session, but on inspection it contains personal information I need to remove (and check then still works) before I can. That would be a good point to see what I remove/tweak. I perform a rather light customisation. I work mostly with primaries and don't require as such vigorous customisation as maybe a high school or college.

Personally unsure. As I said, never got around to testing it. I don't know if a user making a change would write back to the file in their home directory. If it did, then yeah it would travel with them. If changes write back to another file (and Windows reads both) then, yeah it wouldn't travel. I decided to just push out the file above and allow users to add their own shortcuts per device. I believe Microsoft's reasoning behind this (saw them discuss it somewhere, haven't got time to google source sorry) was due to them saying you may have different apps and preferences on different devices. This was in reference to it not following your Microsoft account on personal devices, unlike EVERY OTHER SETTING. I don't think they took this into account though with Businesses and Schools.

It is really simple to use. It will let you remove all the apps you want with simple tick boxes. Also warns what cant/shouldn't be removed. I only use the free version (limited feature set) but it does everything I need. I have considered getting the pro version. It is $50, which may seem like a lot for something which can be all done through PowerShell etc... But, think of the time saving. Time saved = Money saved.

If it helps, this is the default layout I use: xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1"> I apply it via GPO. All of this is enforced, but they can add their own below it. I don't redirect my start menu. If you do, this wont load the File Explorer or Office buttons. I also customise Office 2016 to dump the shortcuts into a single folder instead of Start Menu Root (Awful design!) so my code above reflects that. If you want to roam it (I don't), The links the people above me have posted will help. I did look into hosting the xml inside %HOMESHARE%%HOMEPATH% (GPP the default file there at user logon) and pointing the GPO to it. But never got around to testing it.

Microsoft.StorePurchaseApp Safe to remove. Only used in apps that support in-app purchases; which is never going to be used on a school device. Microsoft.Wallet I believe is this: https://www.microsoft.com/en-us/store/p/microsoft-wallet/9nblgggzlm1p . Safe to remove. Microsoft.Advertising.xaml Is this https://msdn.microsoft.com/en-US/library/mt125365(v=msads.100).aspx . The Advertising SDK (For Ads inside apps). Safe to remove.

Give me time and ill upload my config session. That can be imported and then you/people can go from there? I can always attach my reg keys and such too that I integrate. EDIT: Ive added the regkeys I integrate. Although I have noticed, the File Explorer default destination is now an option in NTLite. It wasn't before when I created the key. Regkeys.7z

Id say that is unlikely. ReFS doesn't even support system/boot drives on Server 2016 RTM, or on the current internal RS2 builds. ReFS has parts (that NTFS has) missing which prevent boot/system drive support at present. Before we see any version of Win 10 supporting that, you will see it on the server builds first.

For me its NTLite and then throwing it into SCCM or MDT for a task sequence with all my apps installing at the end. Cant be dealing with all the fuss of sysprep. But I do also look after 6 schools (currently) and I really could not be bothered keeping different syspreps for each one. One WIM to rule them all for me!

ReFS is available right now in Windows 10. You can format any non-system data drive with it. So I would take this with a pinch of salt.

Cant say I have any issue with the auto login. On SCCM my build gets stuck on the OOBE (Just wait a moment...) due to radical changes to the OOBE in 1703 (Cortana). I fixed this by attaching an unattended.xml to the SCCM Task Sequence to skip the OOBE completely. I haven't done this on my MDT builds, as it starts the OOBE and auto completes as it should, then logs in. You could try adding to skip the OOBE in your MDT rules? See if that helps? Glad NTLite is helping a few people. :-)

I use NTLite to customize a WIM. https://www.ntlite.com/ I use WHDownloader to grab all updates. https://forums.mydigitallife.net/forums/whdownloader.56/ Seriously, I don't know how I live without those tools. I use NTLite to customize services and components, strip out unwanted apps, integrate updates (from WHDownloader), integrate regkeys... I could go on. Dump the WIM into SCCM or MDT, deploy. No SysPrep, no golden image building, no fuss. I install all core apps during a task sequence for new builds. Best thing with NTLite, whenever a new WIM comes out, import it, load up your saved session, hit apply and all your changes are immediately applied to that WIM. Did it Wednesday. Needed to create an x86 image for some cheap tablets. Downloaded from the VLSC, imported into NTLite, imported my x64 session and hit apply. Took longer to download the WIM than it did to customize it for deployment. Hope that helps

Yeah have fun with this. Tried this week to setup some tablets I have on 1511 currently. Updated them to a clean 1703 (just ran setup.exe from MDT share which has been through NTLite) and that was easy. I used the WCD to create a package to try out this SharedPC/School mode as it sounded amazing and exactly what I needed. First of all, it didn't apply my wifi profile. Left me with a local only device. Thought, no problem... Ill just add wifi, log in and remove the partly installed profile. Nope. What I didn't know (and do not see noted anywhere) is SharedPC mode completely removes access to the C Drive. For ALL users. Even full administrators. Wouldn't let me remove the profile as it couldn't find the provisioning tool because it had locked the C drive (Blocked by School!). I had to manually add it to the domain and use the domain admin account to remove the profile. Domain admin also had C: locked down. This makes ZERO sense to me. So went back over my provisioning file, fixed the wifi profile and noticed I had enabled the restrict local drive access. Slapped myself around the face. That's why! Still doesn't make sense it applies to admins I thought, but oh well. I don't need it enabled anyway. My GPOs take care of that... So I disable it and reapply the profile. Nope... Slapped myself too early. Still completely removes access to the C drive for all users. On top of that, it wasn't removing the provisioned apps like I had asked it to (like xbox, feedback, 3d builder etc). So at that point I thought, stuff it. Its a nice idea in principal, but flip me its useless. Therefore, I went back to the way I normally do it. Customised a wim inside NTLite (reg/service tweaks, remove UWP apps, slipstream updates, unattend.xml to skip OOBE etc) and just ran it from my MDT share. Added back to domain, ran my installers from PDQ and let my GPOs take care of the rest. At some of my other schools I have SCCM and I would use that instead of MDT/PDQ as it supports building over Wifi. __ If you want some advice, Id use the WCD to add a wifi profile (that worked in the end. That was my fault), reset it to clean state (that also worked, got rid of all OEM stuff) get it to put it on the domain and let your management software of choice do the rest. I find my current setup does almost everything I needed from the SharedPC/Setup School thing. Only thing I really wanted from it which I cant easily do otherwise, is the account management and "edu" mode. If you get it to work, or if anyone else does, id be happy to listen how. Edit: A properly configured SCCM system with a good LOOSE GPO system, Windows 10 works great for school scenarios in general. I don't use MDM on Windows or log in with AzureAD to devices, so take that in to consideration when considering my opinion.

I have found it rather hit and miss. Especially on laptops that are taken off site. I have decided to kill of service plans for the moment. I am looking at custom WIMS for Windows 10 (Some modern apps removed, some reg tweaks to default profile, start layout built in, "Other User" text changed, cumulative updates slipstreamed) so the auto upgrade would break all of this. So I am completely disabling auto upgrade and will use custom upgrade task sequences so I can control it.

I have replaced all the files. But unless I apply the policy to enforce it for all users, it still shows the default logo. Not sure how as not even sure where it pulls it from now all files have been changed. With the user pics, they are in AD, so show up in outlook for example, but this doesn't input it into Windows 10. Its a different process. I have been looking at a script that pulls the picture from the AD and then sets it as the user tile. But first I need to sort out the default picture getting set without forcing it upon all users.

Do you have the GPO set to fully disable Windows Update? Do you have WSUS inside SCCM set to download Windows 10 upgrades with auto approval? The second one is what got me on a couple of machines. Although Windows Update was completely disabled, WSUS SCCM auto approved the upgrade and pushed it out to a few PCs. If you are on the current branch of SCCM (1606) you can set a Windows 10 plan and specify how long PCs will wait until they auto upgrade. If at all.

Followed your guide doing this, as have tried to do something like this for clients for a long time. Did what you said and directly edited that file from an offline wim, before importing it into MDT. The result: Looks great. But... To get the logo to apply to the logon screen, I had to set the policy to apply it to all users? So anyone with their Microsoft account attached, or having a logo pulled from elsewhere, gets overridden. What I want, is the logo to appear on the logon screen and get to the point where AD photos show for each user when they log in (I have been looking at scripts to do this as this isn't a simple task). But with this GPO applied, I wont be able to do that as it disables the ability for custom logos? Am I doing something wrong...?

Hi guys, got an issue at one of my clients. They have a 2012 DC / file server, Win 7 clients. At certain times, a bunch of pupils need to open a particular file from the file server and save a copy into their own area. This is causing a rather annoying issue. It can be 15-30 users trying to open the same document. The first user can open it fine, but following that, everyone else gets "downloading 0%" for about 15 minutes. One by one, they will all get the document, but by this point, half the lesson is over. This also happens if instead of opening it, they try a copy and paste. While this is happening, I can cancel it on one PC and then proceed to open any other document on the file server without issue. Server is by no means slow. 32GB RAM, 8 core xeon. Clients are also fine with i5 4GB Ram. Backbone is 1gb switches all round. Server is on 4gb team. The document which caused this this morning, was a 12kb word file! Tried google, but my googlefu must be off today as I cant find anything at all related to my issue. Not sure if issue is on client, or server, or its a GP, or an app causing issue! This is the only client I have ever seen this issue. Surely 30 users getting a 12kb file from the server should not cause this, seeing they all just logged on at the exact same time, which involves much more than 12kb. Thanks in advance for any help you can provide.

I use two powershell scripts. One on Machine startup and one on user logon. The user logon to remove it from current profiles, the machine startup to delete it from the default profile. Can use something similar to this:

Even if your functional level is at 2012 R2, the highest it can go currently on released OS's, you still wont see win 10 as an option for ILT unless you RSAT from Win 10. Major reason I always run a Win 10 VM on all my Hyper-V boxes. Edit: Unless you meant something else...

You know that doesn't work for gpp item level targeting right? You can only see as high as your DC, or whatever pc your on. Whichever is greater.

All windows insider builds remove rsat. For months pre 1607 I had all my devices in fast lane. Towards the end builds were coming in almost daily. So I was having to reinstall rsat every other day. Annoying but not end of world.

I find enabling the policy which disables the first sign in animation really speeds up initial log in times. By about 50%. Also I found I had to completely rewrite my gpos for windows 10. One schools setup completely broke win 10 once it was joined to the domain. The policies were from a 2003 xp setup still. Took me about 3 days to completely rewrite a template GPO setup for pure win 10 2012 R2 network. Works beautifully now though. You have to be FAR less restrictive with win 10. It just doesn't like a ton of the old lockdown settings.