Duke5A

Try staging them in Power Shell. Something I found on the net a long time ago and have been using. # V3.0 # Changes: # No longer relies on Quest AD Snap in # No longer uses the kludgey Test-XADObject to validate the existence of computers in AD import-module activedirectory import-csv "c:\namescsv" | foreach-object{ #imports CSV containing Name and MAC headings $name = $_.Name $MAC = $_.Mac $CheckExists = get-adobject -Filter {(ObjectClass -eq "computer") -and (Name -eq $name)} #Will be $NULL if this is a new computer if ($CheckExists -eq $NULL){ [guid]$nbGUID = "00000000-0000-0000-0000-$MAC" #casts 0s + MAC into a GUID, which is required for the netbootGUID property new-adcomputer -Name $name -SamAccountName $name -OtherAttributes @{'netbootGUID'=$nbGUID} write-host $name " - " $nbGUID } else { write-host "$name already exists." } }

Two top level denies followed by the cleanup allow all. I used this when I was evaluating vanilla Win10 Enterprise, but decided on LTSB, so this really isn't used anymore except to block kids from opening the new control panel. A deny all will stop the Start Menu from functioning. Appx Ruleshide Action User Name Rule Type Exceptions Deny Domain\All Students Microsoft.WindowsStore, from Microsoft Corporation Publisher No Deny Domain\All Students windows.immersivecontrolpanel, from Microsoft Corporation Publisher No Allow Everyone (Default Rule) All signed packaged apps Publisher No

Security Log under Event Viewer on your Exchange server. Task category will be 'Logon' and it will contain the the username and other bits of information including the IP address of where the request originated. If it happened offsite then it'll be the public IP of the device itself or gateway it was routed out of.

Sorry I can't offer any advice on how to actually fix BE. We ran it here to do both physical and virtual and while the physical side worked (most of the time) the virtual side was always a mess. If it wasn't one thing it was another. Finally had enough of it and binned it for Veeam. They do have a free (unlimited time) version you can try if you wanted: https://www.veeam.com/virtual-machine-backup-solution-free.html

Security logs don't replicate. You can use the Exchange Management Console to fix this on your end. Under 'Recipient Configuration' find the user's mailbox and in the actions pane you should see a 'Manage Mobile Phone' option. Any user that has a device using Active Sync will have this option. Under here you can break the Active Sync trust and Exchange will stop listening to the device. The security logs on the Exchange server should also show the authentication failure and will give you the public IP of the offending device if you were interested.

Windows uses DNS to determine if it's on a domain network or not. What does your DNS settings look like? Should point to one of your domain controllers. After a storm a few years ago I was bringing the data center back up and virtual machines came back up out of order. The domain controllers were powered on last. All of the other virtual machines had no DNS for a few minutes and all defaulted to public network. Nothing would talk to each other. That was fun.

Heh, no way this makes it to my users any time soon. We're absolutely dead over here as far as projects and work orders are concerned. I'm bored!

So I'm not blind this time. I can't tell you how many times my wife asks for something in the fridge and I can't find it, only for her to step over and pull it off of the shelf that was right in front of my nose.

OK, they fixed the data loss issue, but has it been posted back up to VLSC for download yet? It's missing from mine.

That config for BIOS booting that lacks the system reserved partition has been what I've used for years now. Windows 7, 8 and 10. I only added it when I needed to make a UEFI configuration. The only other usage for it is Bit Locker from what I read, but I've never had any issues encrypting installs without it.

Check BIOS booting on the teacher VLAN now. You may have broken it specifying options needed for UEFI booting. The way around this is to use Policies in the DHCP configuration. The client identifies which mode it's booting in when it sends its request and the DHCP server can then hand out the appropriate options.

The new version of Office doesn't have the customization utility built right into the installer like 2007/2010/2013/2016? setup /admin

Sounds like you're building and deploying images the same way I do. I've got a few different answer files. I've got two client unattended files (one for UEFI and one for BIOS) that only contain settings that pertain to WDS initial questions after PXE booting, and one more for the image itself. Here are the two I use for client booting: BIOS x64 true 1 Primary true NTFS Local Disk C 1 1 0 true 0 1 UEFI x64 false 1 EFI 400 true 2 Primary 0 true OnError 0 2 With the above the initial disk and partition questions are answered. The answer file that is specific to the image is applied to the image properties in WDS. Hope this helps...

What happens if you turn off hardware acceleration in Power Point? Options > Advanced > Display

Proof that we're all living inside a computer simulation.

I've always pre-staged the computers in AD and used WDS with %MACHINENAME% in the answer file for computer name. Computer accounts that have been staged only need it to be done once. The script uses a CSV with two columns that associates MAC addresses with the name. I got that information from the DHCP logs before imaging labs. Don't know if this applies to MDT though. Script not my own - found somewhere on the net. # V3.0 # Changes: # No longer relies on Quest AD Snap in # No longer uses the kludgey Test-XADObject to validate the existence of computers in AD import-module activedirectory import-csv "c:\computers.csv" | foreach-object{ #imports CSV containing Name and MAC headings $name = $_.Name $MAC = $_.Mac $CheckExists = get-adobject -Filter {(ObjectClass -eq "computer") -and (Name -eq $name)} #Will be $NULL if this is a new computer if ($CheckExists -eq $NULL){ [guid]$nbGUID = "00000000-0000-0000-0000-$MAC" #casts 0s + MAC into a GUID, which is required for the netbootGUID property new-adcomputer -Name $name -SamAccountName $name -OtherAttributes @{'netbootGUID'=$nbGUID} write-host $name " - " $nbGUID } else { write-host "$name already exists." } }

It's a bit convoluted the way I have it setup. Staff and students use separate internal Squid proxies for traffic logging against AD and other tweaks. The Squids then use an external filter hosted in the ether as a cache peer via port 8080 through our firewall. Outbound ports 80 and 443 are blocked for all student and staff subnets so if any of them figure a way around the client proxy settings their web request will still be swatted down. The staff proxy allows complete access to YouTube, while the student proxy uses DNS redirection for the kids to enforce YouTube Restricted mode. That DNS that does the redirect is provided by a BIND install running on the same proxy with Squid pointing to it. If staff want to whitelist YT videos they can by logging into YT with their school provided G-Suite account. Not all of our staff use it. This setup allows me to give whitelisting capabilities to the staff and keep it off of my plate. Your mileage may vary....

@Arthur: You sure those are LTSC? I just installed the x64 en-GB version and it contains all the crap. No mention of LTSC anywhere.

Wow, this is rehashing memories. I haven't used this setup in a number of years. When I started getting devices that required UEFI booting (Surface Pros) I abandoned this. IMG files are disk images. 7-Zip can open them. I had to do something goofy to generate them so Sys Linux would use them. Anyways, I still have all my old stuff. Attached to this post is my dban image. Use this snippet for the menu config: label dban menu label DBAN kernel memdisk append initrd=/img/dban.img dban.zip

Just built it into the base image this year. Adoption is slow, but we're getting there. The more I can shove into GSuite the easier it will be for me to drop an axe onto our Exchange server.

Bummer I missed it. Chicago is only a few hours from me. :-(

I've got the CAD teacher at our high school wanting to turn the lab into a modular one. The end goal being able to move the tables around at will so that the students can break into groups for different projects. There are 35 computers in the lab and two to a desk. She keeps inquiring about wireless as a means to achieve this, but I'm not entirely certain it will lead to a good experience. Admittedly my knowledge is severely lacking in this area as our tech is a full ten years behind the curve. Our wireless infrastructure consists of three Cisco 4404 controllers and 1142 access points (gig Ethernet, N wireless radios). What I was thinking was perhaps removing the 1142 AP from the room and setting up three newer WAPs that can do AC with only the 5Ghz radios enabled. It would be completely separated from the current wireless network. I have reservations that wireless can handle the workload in a lab environment, especially with one that does CAD. What do you guys think?

No ideas as to the order, but network printers have always been a per-user thing - the only printers I see be available for different profiles are local ones. Are you sure the deletion is necessary?

Still using 1607 LTSB here with printers being handed out via GPP with item-level targeting. Seems to be running great. I'm not getting crazy with the targeting though...only using computer and user object locations in AD as a qualifier for who gets what. What I have noticed is the print spooler on the server running 2016 still needs its backside continually wiped just like it has with older server versions. I have two scheduled tasks to do this: one that runs at 2am the runs the script below to delete stuck jobs, and second, a reboot that runs at 2:30am to bounce the entire server. Some print jobs have file locks on them and absolutely refuse to be flushed from the queue. Don't think this would have anything to do with deployment issues others having, but my setup other than this is pretty vanilla. EDIT: Should also add we're using local profiles here on both student and staff computers. The student computers run Deep Freeze for the most part, so I don't worry about the profiles adding up on shared systems. Set objWMIService = GetObject("winmgmts:\\.\root\cimv2") Set colInstalledPrinters = objWMIService.ExecQuery("Select * from Win32_Printer",,48) On Error Resume Next For Each objPrinter in colInstalledPrinters objPrinter.CancelAllJobs() Next

Heh, if only the people in charge of budgeting would listen. We have a couple of PTZ cameras that used to be mounted to the light polls on the football field. Had a real bad lightning storm hit one of the polls and it back fed all the way to the switch and fried it (thank God it stopped there). I jumped up and down about relocating the cameras to the press box (which was lower than the light polls) and linking them back to the building via wireless, but was overruled. The following year it happened again and fried another switch. That time I won.