Sheridan

How do your staff purchase paid for apps? We use the vpp account to purchase free and paid for, but if they then used their own itunes account for additional apps do they add personal/department credit cards or simply use vouchers?

The problem with that is things like Youtube are 17+ - trying telling a teacher they can't install youtube and they will have a fit.

So already we have a mixture of opinions I'm somewhere between the two of 'they're school devices so treated the same as desktops' and giving the staff freedom to try out new apps! Although I have a feeling a lot of the apps will relate to tv/holidays/games

We've currently using a mixture of ipads for students (updated and checked every so often with AC2) and a growing number of staff ipads (managed and updated by Meraki) We currently deploy apps and don't allow staff or students to add their own apps as we use a VPP account to 'push' them. However, we seem to have growing complaints from staff as they believe they should be able to install the apps they want. Which seems like a bit of a nightmare as they would all then be creating their own apple IDs etc, and probably adding vouchers for paid apps and so on. So how do you do it? Controlled centrally like we're currently doing, or open and unlocked, or somewhere in between?!

Not exactly a comprehensive list of policy settings is it! A handful more than the 1511 build though. We've got edge disabled at the moment and use IE11 and Chrome, although I'm tempted to force chrome as the default now as IE11 just doesn't seem to work wioth any video players, drag and drop pages etc.

I haven't tried the preview yet, but are the policies for Edge more comprehensive? Currently you get about 10 which are useless for management!

Sorry I should have been more specific - menu item redirection works but the start tile method (xml) never worked. It misses apps out randomly (especially 'core' apps like explorer or notepad!) and just made the whole tile thing look like an unfinished project. I know some people have had success but having tried multiple methods on Edu/Pro/Ent on all builds I decided it was time to give up!

I'm one of the one who falls into the other camp - I've never got the Start Tile redirection working reliably. So I ditched it for Classic Start Menu.

No mention of group policy templates for Edge then? The current ones are a joke. And will this edition improve the management of the start menu at all?

Yes, that's exactly what I have done (for the likes of regedit) but I was curious to know if other people were doing the same sort of thing . I.e If you use the default whitelist rule for %WINDIR% what do you then block (or add an exception)?

Yeah they still have to authenticate to commit any changes, but without checking every executable in the %WINDIR% folder (and subfolders) I wasn't sure whether they will all require elevation!

I've switched to Applocker for our W10 installs and replicated the Block and Whitelist setup we used to have with SRP. However I'm curious to know what anyone else has done with this. We've got the Default rules enabled, one of which is to Allow Everyone to run executables in the Windows folder. If you don't have this they can't login, but if you do have this you can run any executable (bcdedit.exe etc) in the Windows folder by creating hyperlinks in Word etc. Thats not exactly what I'd like! Whitelisting everything needed in the Windows folder would be a nightmare - so how do you deal with this?

Problem is, people still use it - and it should work! People here just think I'm making excuses when I say 'try it in Chrome'!

I've had the old problem of videos not playing in IE11 since Windows 7 - never got around it to be honest and Chrome works OK. Testing in our trial W10 suite has also shown that the videos don't work in IE11 on W10 either! Its getting rather frustrating now as a lot of people default to IE - Edge seems to work (oh the irony!) and Chrome still works but ideally I'd like the default browser to work properly. I've checked all of the policies and preferences and everything is enabled or set to prompt (the usual stuff like Enable alternative codecs, Play animation in webpages etc). Its not a filtering issue or policy issue as far as I can see as it affects all staff, students and administrators. Has anyone else had these sort of problems with IE11 in W10 and found a solution? We still can't use Gmail in this room as that still pops up with 'Invalid Request' At this rate I'll have to remove IE11 completely!

We're testing the waters with one main room and so far its been 'meh'. Lots of niggles (some still unresolved such as the start menu tiles can't be deployed reliably) and generally 10 has offered no advantages over 7. We will probably continue the upgrades but only when the PCs are due replacement or upgrade anyway. I still feel like what windows 10 turned out to be is a missed opportunity, I was hoping for a step up from 7 but what we seem to have is a cludged up Windows 8.

Chrome does work fine, but IE11 has never worked with gmail here but only on the Windows 10 machines. IE11 is still working fine on the Windows 7 ones. Very odd.

Damn! Must be something to do with our W10 image then, the GPO's were stripped down and rebuilt to make sure they had the minimum settings needed. Weird really, as all the others (docs,calendar etc ) all work, as does the google Admin console - its only gmail that generates that useless message.

Another day, another thing that doesn't work in W10 for no apparent reason When users try to access their GAFE/Gmail account in IE11 (we use that on Windows 7 and 10 PCs) they get the login page, but then get that stupid robot with the 'Invalid Request' message Works fine with Chrome though, and IE11 and Gmail work fine on every Windows 7 PC so its just IE11 on Windows 10. Is this a google push to forcing chrome on us I wonder!

Right, those registry fixes have had an effect - there seems to have also been an issue with these W10 PCs not picking up GPOs, or picking them up erractically. Running gpupdate sometimes gets an error about not being able to acces \\sysvol\policies\{policy guid} which seems to be a fairly common bug with 10. The ones that work, pick up the registry fix and Install as Administrator appears and works! Now to fix the next bug... Cheers for all the info folks!

Hmm I'm still missing Install as Administrator even with the registry changes. I'll double check they've applied tomorrow. It does look like its UAC causing the problems rather than applocker. Having said that I'm not convinced applocker is doing exactly what I want, unlike SRP which worked very reliably.

I can't get the 'Run as administrator' prompt to appear for the msi, only the batch file. I tried the registry fixes above and that seems to now allow the batch file to work, which simply runs "msiexec /i install.msi /quiet" I've got UAC configured as per Microsofts recommended defaults, although I'd probably be better off disabling it completely but this breaks a few apps!

This is getting weirder now! Our install package is on a server share - the msi is called by a batch file with a couple of parameters (\quiet etc) If you run the batch file as Administrator, you get two messages logged in the event viewer. 1) \\SERVER\SHARE\INSTALL.BAT was allowed to run. 2) \\SERVER\SHARE\INSTALL.MSI was allowed to run. But what happens is the batch file open and closes a command prompt very quickly. If you try to run the msi directly (its not designed for that, but just for testing) you get the event logged: \\SERVER\SHARE\INSTALL.MSI was prevented from running. Now, if you disable UAC (or set it as low as you can in the gui) and then run the batch file (As Administrator) then it seems to work! So is it Applocker or that infernal UAC thats causing this! I've got UAC set to the MS defaults recommended.

I've checked everything I can think of so far. The PCs are all the same, in the same OU with only one Applocker policy applied to them. In all of the Applocker sections there is no Deny for anything other than Staff/Student groups, and then various Allows for Staff/Students for whitelisted apps & paths, and for domain admins as well. One of the installers I try to run is a batch file that calls an msiexec installation with an MST file, this fails as soon as the msi tries to install. I've tried the reg patches above (and rebooted as well) and its still the same. I've never found applocker consistent in the way deny is supposed to override allow, in the case of powershell even though it was set to Deny for Staff/Students the allow rule for the Windows\System folder overrode it, until I put an exception in the Allow rule!

In the msi rules I don't even have a deny, the deny rules are only on executables. I do have allow rules for msi and scripts to whitelist. Basically for the msi and script rules I generated the default set and then added a rule for admins to allow everything!

I tried both registry settings but both result in the same message. I wish applocker worked as reliably as SRP used to!