rinzwind

Seems the licensing has been changed to number of targeted user for some time now. If you only need a policy for your staff, thats possible.

Setup Outlook online mode to prevent those OST's from creating and it also makes Outlook startup more quickly and prevents search index issues... but it has its own issues like sometimes the Office 365 servers are just SLOW and Outlook still is not really internet connection friendly. Sometime may hang a few secs or longer. In combination with setting up the mail attribute for auto profile creation would be a OKish solution. Signatures are stored in %appdata%\microsoft\signatures (and maybe a localized name to make things more difficult).

Yeah, when doing GPO security filtering one should always give authenticated users read access, even if you do not want to apply it to them. Otherwise stuff won't work since a MS update in the past.

AutoLogoff can do this as one of its features.

What is the login performance of Windows 10.. both first time and subsequent times using roaming? Does that app stuff keeps running every time when switching pcs?

Another way is to just keep fast user switching enabled and automatically logoff inactive users with utility named autologoff . Number of simultanious sessions is limitrd that way.

Haha even within MS they apperently dont talk to each other. Exchange 2017 also is not "validated" against .net 4.7... jeez https://blogs.technet.microsoft.com/exchange/2017/06/13/net-framework-4-7-and-exchange-server/

One thats definitely easy to implement and email based and can be enabled for a subset of users (students...) is a tool called AD Password Mail Service . So as long as your OK with email based reset you can test drive it .

Neh thats not fast. Navigating the tree is already tiresome . Plus quickly sorting on category, key, etc not possible. Its just a copy of what you already have in the gpmc .. The gprg is way better, that one adds something new to the mix

Windows Apps are horrible to manage. You simply cant and I dont expect much of it because MS already had a long time to figure things out and think it through... Windows 8. There are some arcane Powershell commands available but these dont help much. You can lurk around in windows. C:\program files\windowsapps contains your apps, even if you delete them (the default ones are still there at least). You cant go into the root folder. Beyond me why they decided to block it because a regular user still has to have access to the sub folders and you can if you know the path. What is wrong with simple copy and past package deployment? For once ms could made things simple but just didnt. Same as with start menu layouts. We have found some workarounds but stilll.Windows seems more and more a personal OS. A BYOD OS.

You might want to take a look into a tool called the Group Policy Reference Guide. Should come up somewhere on Google. I am not allowed to post a simple link so... But its a searchable and fast browsable catalog of all your admx templates.

And after reading the start menu doesnt roam issues (which really is a basic functionality) I think MS again did not look that much into the roaming profiles stuff... Which in itself is old and fragile technology but still has no alernative. Yes maybe MS azure accounts

The problem was it was always busy with app setup (lots of data going every time to the local appdata etc). Ofcourse you can go ahead an remove everything app related but thats a bit rough.

Hows the login experience with roaming profiles in Windows 10? Windows 8 was terrible with all those app setup stuff going on and on even if you went through it already on another pc.

Just to be helpfull... profilehelper by ws does this through the group policy management console this and it's quite affordable I think.