Duke5A

This may or may not be related: I just stood up a WSUS instance on Server 2016 and had the application pool crash often. This was with factory fresh settings. Server is physical with eight cores and 16GB of RAM and the only other thing that runs on it is WDS. I eventually found this was able to cure the pool crashing constantly. https://blogs.msdn.microsoft.com/the_secure_infrastructure_guy/2015/09/02/windows-server-2012-r2-wsus-issue-clients-cause-the-wsus-app-pool-to-become-unresponsive-with-http-503/

We dabbled with it, but in the end I made a wireless network specifically for Chromebooks (and iOS too I guess) set with WPA2 and created a 255 character password for it. Never type it, just dropped it in the Admin console. To setup new Chromebooks I have a service network that is only available in the office with a simpler password.

In your IE policy, did you leave 'Automatically detect settings' under the proxy config checked? Updating the Chrome policy templates that I had in AD and recreating the policy to set Chrome's proxy fixed the issue last year, but I just ran into it again a couple days ago. I made the above change to the IE policy above and haven't seen the issue since.

If you open up 'Network and Sharing Center' what type of network does it say that it's connected to? I've has 2012R2 installs incorrectly think they were on a public network and raise the firewall before.

I suppose it depends on where you're at with your fleet. The newest hardware we have is fourth generation Intel. Even when we buy equipment we pick it up refurbished - a fourth gen i5 does everything we need at a fraction of the cost of brand new. Besides, the level in which you need to chop up a base load of Windows 10 to get the bloat out of it I would be leery of using in mass deployment. Might cause further issues down the line with updates.

Do these laptops not have a TPM in them? I have a bunch of ten year old Dells that are Bitlocker enabled with the TPM and keys stored to Active Directory. Usually the TPM has to be enabled and then set to activate in the BIOS.

This is going to have to be scripted. Need a few more details: Were the AD accounts renamed or recreated? If they were simply renamed, then at worst you're looking at a single line's worth of Robocopy to copy the folders to the new server (and setting it to preserve the security permissions) and a four line script to change the homefolder path in the account properties to point to the correct server. To rename the folders to reflect the new usernames will require a few more lines to the script, but it can be done.

If it's available to you then you should use the LTSB version of 10. It doesn't include any of the bloat that the OEM version does and doesn't require any of the script/tweaks to clean it up.

Office uses hardware acceleration for a lot of things. I've had a couple labs with on board Intel video that used the MS drivers that would cause Office to behave like that. Try updating the video drivers for whatever chipset the desktop has.

Is iexplorer.exe in the Task Manager list? If it is, does ending it allow IE to start working again?

Run "RSOP.MSC" and look at the User Configuration. If there is an exclamation point over the icon right-click it, select properties and look at the 'Error Information' tab. This will give you error codes and description pertaining to user GPO settings.

They probably did it this way on purpose. After what MS went through trying to get people to give up older versions of Windows I can see why they're doing this.

Windows 10 LTSB for sure, and the flavor of Office 2016 I would say depends on the curriculum being taught. If it's not curriculum dependent then 2016 Pro Plus will cover everything.

I build my images in a VM, use sysprep and capture using WinPE and DISM. Drop the image straight into WDS and off I go. If you start with the LTSB version of Win10 you'll save yourself a lot of headache as the bundled crapware isn't there (No xbox, Cortana, Windows Store, etc).

That is absolutely stunning.

UAC can be a royal PITA with specific software and deployment methods. I have a Win10 and Win7 base images and UAC is left on in 10, but disabled 7. It's been disabled in 7 since we switched over about six years ago. On a locked down machine there is no need for it, but like already noted you should leave it on if running 10.

You guys have a Google apps domain? You should be able to remove restrictions for certain logged in accounts. If not, then you'll have to toss staff over to another DNS that doesn't have the redirect in it for strict mode.

If I had to guess the cert it's complaining about uses SHA1 for its signature.

Can you disable the lower data rates? I have an older managed Cisco setup and this helped out dramatically. I think I turned off anything 18Mb and under (been a couple of years). It'll force the client to negotiate a higher rate.

How big is the environment? Check DHCP to get the machine's MAC address and start checking the switch tables on the switches. Start at the topmost switch in the environment and work your way down. Eventually you'll be able to find the individual switch port it is on.

Have you tried loading Adobe Flash rather than letting Chrome handle it? I just download the Pepper version from Adobe and push it out periodically.

Didn't get here in time to vote, but count me as a no. MS has been playing catchup with its rivals for years now and has a history of abandoning those projects not long after they debut. As if there wasn't enough disincentive to jump on now, I would put money down that this Win10S experiment of theirs ends up forgotten in a couple years. I would hate to be the poor guy holding onto a bunch of these devices when that happens.

I'm pretty sure the answer is is no, but I thought I would ask anyways. I have generic logons for my elementary buildings (year 1 through 5) that can be used to get the kids on netbooks without much fuss. They're simple with simple passwords and don't give access to anything but the computer and filtered Internet. We're transitioning over to Chromebooks now and the year 1 kids are going to have a rough time with signing themselves in. I was thinking of creating generic accounts in Google Apps, but I know it's frowned upon by Google and will most likely get locked automatically. How do you guys deal with this? Thanks.

Delegate the permission to your top level staff security group to reset passwords and lockouts to the root student OU in Active Directory. Then use a small VB .Net app that only searches for users from that OU with a couple of buttons for resetting passwords/lockouts. Share it somewhere accessible by staff and drop an icon on all staff computers using GPP. That is what we do here. The app that I wrote is a little more involved than that (displays student photos and gives access to home folders), but it can be pretty simple.

You don't need to move the user after creation. It can all be done when the user is created with the '-path' directive on the 'New-ADUser' commandlet. You just need to add some logic to determine the path and add it to a string. To check for existing users before attempting the add: Try {$UserExists = Get-ADUser -LDAPFilter "(sAMAccountName=$SAM)"} Catch { Continue } If(!$UserExists){ Try{ New-ADUser -Name $DisplayName -DisplayName $Displayname -SamAccountName $SAM -UserPrincipalName $UPN -GivenName $UserFirstname -Surname $UserLastname -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false -Path $OU -HomeDirectory $HomeFolder -HomeDrive $HomeDrive -ErrorAction Stop } Catch{ Continue } Else{ #User already exists, do nothing Continue } The above is a snippet from a PS script I wrote to automate student account creation based on exports from our SIS system.