Duke5A

What are you using for authorization, PSK or Radius? If it's Radius then it sounds like the computer accounts can't authenticate. Computer accounts members of the right group?

I'm glad I went through the trouble of moving my Squid proxies over to Kerberos a few years back. Chrome is our default browser, but luckily there hasn't been any issues.

You typically see those goofy unique IDs due to Remote Access Services. Are you running RAS on anything? You can also try going into the scope properties and under the advanced tab at the top hit the radio button to only assign addresses to DHCP clients.

I wrote up a blog post on my printer script here: VB Script for network printer deployment - Blogs - EduGeek.net. It'll collected nested group membership, OU location and other things to determine who gets what. I'm actually migrating away from VB altogether though and the printers are the last thing to be moved over to GPP. I found GPP to be far more reliable than VB when wireless devices are in play. One thing I did notice about GPP printer installation vs VB is that it seems to take a lot longer to install the printer drivers. To work around it I preloaded the most common printer drivers into the base image. Maybe it's just me since VB will run in the background while the desktop comes up where GPP won't load the desktop until its done processing.

It doesn't need to be this complicated. Load a fresh install of Win10, when logged in as the newly created local admin (don't create any other accounts yet) run the two Power Shell commands that were linked to in the second post of this thread. Only things you need to watch out for is to run Power Shell as an administrator (right-click, run as admin) and use the version of PS that matches the OS architecture (32 or 64 bit). Bam: First logons for users are nice and speedly without the crap. Also, I keep a log in all my base images to keep track of things. Here is the log for my Windows 10 image thus far. Windows 10 Enterprise x64 Base Image -- Created 2015/10/29 -Removed all provisioned apps with the exception of Cortana and the Store Get-AppxProvisionedPackage –online | Where-Object {$_.PackageName –notlike “*WindowsStore*”} | Remove-AppxProvisionedPackage –online Get-AppxPackage –AllUsers | Where-Object {$_.Name –notlike “*store*”} | Remove-AppxPackage -Uninstalled OneDrive '%SystemRoot%\SysWOW64\OneDriveSetup.exe /uninstall' -Group Policy: Computer > Admin Templates > Windows Components > Data Collection Allow Telemetry: Enabled - Set to 0 for off Computer > Admin Templates > Windows Components > Windows Error Reporting Disable Reporting: Enabled Computer > Admin Templates > Windows Components > Application Compatibility Turn off Application Telemetry: Enabled Turn off Program Compatibility Assistant: Enabled Turn off Application Compatibility Engine: Enabled Computer > Admin Templates > Windows Components > Windows Media Player Do Not Show First Use Dialog Boxes: Enabled Prevent Quick Launch Toolbar Shortcut Creation: Enabled Prevent Desktop Shortcut Creation: EnabledAnything Computer > Admin Templates > Windows Components > Internet Explorer Prevent running First Run wizard: Enabled Prevent participation in the CEIP: Enabled Computer > Admin Templates > Windows Components > Internet Communication Management > Internet Communication Settings Turn Off Windows Error Reporting: Enabled Turn Off Windows Customer Experience Improvement Program: Enabled Computer > Admin Templates > Windows Components > Search Allow Cortana: Disabled Allow search and Cortana to use location: Disabled Do not allow web search: Enabled Don’t search the web or display web results in Search: Enabled Computer > Admin Templates > System > System Restore Turn off System Restore: Enabled Computer > Admin Templates > System > Logon Show first sign-in animation: Disabled Turn off Windows Startp sound: Enabled Computer > Admin Templates > System > User Profiles Turn off the advertising ID: Enabled Computer > Admin Templates > Control Panel > Regional and Handwriting Allow Input Personalization: Disabled Computer > Admin Templates > Control Panel > Handwriting personalization Turn off automatic learning: Enabled -Registry (Edits made to HKCU hive are in the Default profile) (Disables the sending of data back to MS to improve typing and writing) HKEY_CURRENT_USER\SOFTWARE\Microsoft\Input\TIPC Enabled: 0 (Disables Windows from asking for feedback) HKEY_CURRENT_USER\Software\Microsoft\Siuf\Rules PeriodInNanoSeconds (DWORD): 0 HKEY_CURRENT_USER\Software\Microsoft\Siuf\Rules NumberOfSIUFInPeriod (DWORD): 0 (Disables WiFi Sense) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config AutoConnectAllowedOEM (DWORD): 0 (Disables CEIP in Office) HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common QMEnable (DOWRD): 0 -Services: Diagnostic Policy Service: Disabled Diagnostic Trackng Service: Disabled -Installed 7-Zip 9.20 -Installed Notepad++ 6.8.6 -Installed without auto update -Installed VLC 2.2.1 -Disabled update notifier and copied config file to default user profile -Installed VMWare Mouse and Display drivers -Installed Office 2013 -Added OEM information -Added Power Shell scripts to admin Windows Update client Group Policy edits were made using the 'gpedit.msc' and the registry tweaks were made by loading the Current User registry hive from the default user profile. A lot of the crap that MS has in Win10 doesn't have any means of controlling it via GPO, so I had to go this route. And I HIGHLY recommend dropping the Power Shell scripts in place to configure the Windows Update client from the command line seeing as how MS decided to do away with a lot of the basic functionality in the GUI. No sysprep errors either...

Fatted calf, huh? I'm going to have to try that. Goats have been losing their effectiveness.

Well, I've inherited a mess. I have a domain controller with certificate services installed on it and it's passing out certs to the entire network of about 1500 machines. The time has come to migrate to 2012R2 and this is stopping me from doing so. I'm a total noob when it comes to PKI, so please take it easy on me. Here is what I have: A 2008R2 DC with Certificate Services installed that needs to be demoted All joined machines in the domain are getting certs issue to them Two other domain controllers have the NPS role installed to authenticate our wireless network. Radius is using certs supplied from the CA. What I know: It is a horrible idea for a CA to be installed on a DC from a security standpoint. Also, this prevents me from demoting the DC while the Certificate Services role is installed. From what I read what I can do backup the CA role, uninstall it, demote, reinstall CA role, import settings from backup - this scares the crap out of me. Doing the above will still stick me with a CA name that makes it look like a DC. I need a plan before I go messing around with this - a long term plan. It's recommended to have a root CA that issues certs to an intermediary and the intermediary in turn issues to clients while the root remains off. Is this entirely necessary for a school network? I don't exactly have an abundance of Windows Server licenses to burn. Questions: Our NPS servers are configured with PEAP. Is it possible to use a self-signed cert? If a CA is a requirement, is it possible to stand another up and migrate over? So, what is the best course of action? As far as I can tell the only thing that uses the certs issued by the CA are the two NPS servers. If I could put an axe in the CA altogether it would be preferable. I've been doing a lot of reading, but damn, is it mind numbing. Everyone links to whitepapers or complete books on PKI. I just don't see my requirements being that complex, but I do want to set this up right. Thanks for any insight...

I wonder if Windows Defender would meet your State's requirement of AV. If so, this might be a route you could take too. The machines are scheduled by Deep Freeze to shutdown every night and will wake back up in the early morning. I can't count on users at all (staff or students) to follow any kind of procedure with equipment. Most I can hope to do is limit their options and force them down the direction I want. We already go this route on our wireless carts seeing as how we can't remotely wake the machines up for updates, the AV client brings them to their knees, and the definition updates are huge to the point it would cripple the wireless network. What worried me about the desktops is that 2 hour window in the middle of the night where they are thawed for updates. I've had to chase worms through a district before - not fun. I guess what I need to figure out is if Defender is enough to combat stuff like that; I'm not so much worried about malware since the users are limited and the machines are frozen when in use. Thanks for your input.

Another vote for The Dude. Honestly, I haven't found any other solution that is as easy to use and is as robust. I mapped out all seven buildings in it and setup monitoring for copy machines and even the battery backup units. It's really slick.

Cisco with 250 WAPs, three 4404 controllers and one totally useless install of Wireless Control Server.

Wrote my own .Net app that parses exports from our SIS. It'll take care of creation, home folder and a bunch of other oddities that need to be done.

The brunt of our student computers are Optiplex 780s with Core2/4GB RAM/mechanical HDD/Windows 7. The problem with them is they are unbearably slow when loaded with Symantec 12.1 End Point Protection; when Symantec is uninstalled they run great. The systems also have Deep Freeze from Faronics and are scheduled to boot up via WOL at night and thaw for updates. This got me thinking: Windows 10 has Defender built in; which is just rebranded Security Essentials, so do you guys think this is good enough in terms of AV? Security Essential's updates are delivered via Windows Update and Deep Freeze works great with it. In testing Windows 10 runs very well on these systems without Symantec being installed. So, good enough? I should also note that staff and students only have limited user rights on these computers. Thanks...

I haven't tried this method on Windows 10, but it works great on 7. Delete the registry key for the offending print driver and restart the print spool service. Windows will remove all printers using said driver and when you reinstall it will overwrite the remnants of the old driver. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3

Any advice is greatly appreciated! The client has already been stripped down and only contains 'Virus and Spyware Protection' and 'Proactive Threat Protection.' The weekly scheduled scan has also been disabled. We don't have many systems with SSD in them yet, but I the ones that do run just fine with Symantec. The problem is on desktops and laptops with mechanical drives. The installer is 1GB in size and when uninstalled system performance picks up considerably. All the systems are multi-core of some flavor with at least 4GB RAM.

function FindProxyForURL(url, host) { //Declare proxy strings as variables var studentproxy = "PROXY MrSquid.domain.com:3128"; // IP not to use proxy if (shExpMatch(url, "http://10.*")) { return "DIRECT"; } if (shExpMatch(url, "http://127.0.0.1*")) { return "DIRECT"; } if (isPlainHostName(host)) { return "DIRECT"; } // URLS not to use proxy server if (shExpMatch(url, "*schoolhomepage.com*")) { return "DIRECT"; } if (shExpMatch(url, "*someotherservice.net*")) { return "DIRECT"; } // Apply proxy if machine is on internal network if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0")) { return studentproxy; } if (isInNet(myIpAddress(), "10.0.0.0", "/8")) { return studentproxy; } else return "DIRECT"; } The two lines under the 'apply proxy' section was a fix I had to do because Internet Explorer and Firefox read subnets differently, or something like that. It was a long time ago and it still works. I forget who I got the above from, but it was from a member here.

I wish I could say my experience with it has been the same. The client is a total dog that renders respectable systems almost useless and it doesn't seem to catch anything. I swear I get more false positives out of it than anything else. I'm currently looking for a replacement. I was thinking Microsoft's offering, but the management piece is rolled into SCCM and I have no need for that.

What method are you using to do this remotely? A startup script runs with local machine credentials and will be able to do what you need it to do. Is the registry setting for mic boost in the Current User or Local Machine hive?

What about still using the registry method and restarting the audio service after it is done? It should pick up the changes without a reboot.

I'm starting to put together a Win10 base image and needed to remove all the junk that comes with it. It's considered a bad idea to remove the Store app, but everything else could go. Used these two Power Shell commands: Get-AppxProvisionedPackage –online | Where-Object {$_.PackageName –notlike “*WindowsStore*”} | Remove-AppxProvisionedPackage –online Get-AppxPackage –AllUsers | Where-Object {$_.Name –notlike “*store*”} | Remove-AppxPackage

Reboot the switch, I'm serious. I was installing a set of redundant switches for a virtual cluster and enabled jumbos. I couldn't for the life of me figure out why communication between the hosts and the SAN were problematic. I spent nearly two hours banging my head against the wall until I found that even if the config was set on these Cisco switches they needed to be power cycled for the change to take effect. I would be willing to bet this is the same problem with your HP gear.

I cannot begin to tell you how bad of an idea this is. By standing imperial decree there isn't a single device that is allowed to touch the internal network if it isn't being managed by me. You need a separate SSID and VLAN that is completely segregated from the internal network for BYOD.

Been rolling with the 2.4G and 5G radios on the same SSID since it's implementation in 2008. This is a fully managed Cisco setup with three controllers, 240 access points and Radius auth.

Try turning off video acceleration in Office and see if it makes any difference.

You need to read this: How-to: copy HDD to SSD with correct 4k alignment | Hardware.Info United States Simply copying a partition over is going to hit your performance.

Were these machines plugged into the LAN? I've seen computer where you could change the wake-up conditions between magic packet, pattern matching or both. If pattern matching was selected then the box would turn on if something was trying to talk to it. If the NIC supports the options they can be changed in Device Manager > 'Whatever your NIC is' > Advanced tab.