CHiLL

Ad Astra Kind of disappointed to be honest. It was quite long and slow, and not as Sci-Fi as I was expecting. It's more of a film about a guy with Father issues, set in space than a Sci-Fi film. For the most part I liked it, though it really did drag in places.

Ditto @RLR. I haven't used sysprep since Windows 8.1. I just download the ISO from VLSC, extract the WIM use that in SCCM with MDT. The SCCM MDT Task Sequence is clever enough that once the WIM is selected, it lists the specific versions within the WIM and you can select the variant you want, no need to extract the specific version. I don't know about just MDT on it's own though. I create a new SCCM MDT TS for each new version of Windows 10 I deploy and match it with the appropriate MDT Tookkit settings. For image specific settings, I configure those in either unattend.xml, within the TS itself, GP settings or SCCM deployments.

I've been testing Microsoft's Always-On VPN connection for months and generally it's been sucessful. However I noticed that when the VPN profile is installed on a machine, it is changing the DNS suffix on both the Ethernet and Wi-Fi adapter. The DNS suffix usually defaults to 'Append primary and connection specific DNS suffixes' and it's been working correctly for years. However when the VPN profile is installed, it is being set to 'Append these DNS suffixes (in order)' and shows our domain URL in the list (school.bham.sch.uk). This means that the client is trying to use the school.bham.sch.uk DNS suffix to make DNS queries instead of the normal school.local. This occurs immediately as the profile is installed and not even connected. Our profile is configured to not auto-connect when it detects it's connected to the company network ('Connection specific DNS - school.local). I'm using SCCM to deploy out the VPN profile and can't fathom why this DNS suffix is being changed. The only thing that I can see that comes close is the server list on the Connection tab of the VPN profile in SCCM. This has been configured as the VPN's Internet address (vpn.school.bham.sch.uk). Do I need to specify my internal DNS FQDNs here too?

Yeah, though that's not what was breaking it, because all my other applications were pinning, just not File Explorer. If I browse to find that shortcut on the target desktop, it's located in Windows System and the System Tools folder doesn't exist. However File Explorer does not pin. But if I change the XML to use System Tools, despite not appearing to be present on the system...it works. Don't ask me how!

Available means it will appear in Software Center and the user can choose to install it, but it won't install itself. Required means it will be forced to install when the installation deadline is met. For app deployment, I set all almost all apps to install whether a user is logged on or not. For all non-instrusive applications/app that don't require a restart - I tend to set the installation deadline to as soon as possible and check the box for Software Installation under 'When installation deadline reached'. That way it will install that app as soon as possible, even if the user is on the machine. I also specify that the user notifications are set to 'Display in Software Center, and only show notifications for computer restarts'. The default option tends to be 'Display in Software Center and show all notifications', which means that the user gets a bunch of toast notifications that an app is installing. With it only showing restarts, it doesn't bother the user and they barely realise it's installing something whilst they're using it. When I update an app like Chrome, Office or other apps that are used frequently by staff, I'll specify that the app isn't available until after the school day, so maybe 15.30. That way it doesn't force close an app that's in use to upgrade it during the day.

That's weird. Because I have secure boot enabled, I can't configure the UEFI/Legacy section as it's greyed out. If I turn off Secure Boot, I can then configure it. I haven't changed these BIOS settings in a couple of years and I re-imaged both of them via PXE boot over the summer.

Using the link @Arthur provided (our 11e come up as ThinkPad Yoga 11e (20D9 20DA) in that list) and I compared the settings to what our 11e is actually configured with and attached the settings here. [ATTACH=CONFIG]55028[/ATTACH] [ATTACH=CONFIG]55029[/ATTACH] [ATTACH=CONFIG]55030[/ATTACH] [ATTACH=CONFIG]55031[/ATTACH] What happens when you press F12 at boot? Do you see the NIC?

I skimmed through an email last week, maybe I misread some stuff. Though thinking about it, I now think I remember it mentioning that Link2ICT will remain under Capita whilst BCC brings some services back in-house, away from Capita.

We have two Lenovo Yoga 11E devices, but neither are on-site. I don't think I did anything special to them when we migrated to Windows 10 a few years ago and they've been PXE booting for SCCM fine. I'll try and get hold of one and check the BIOS settings.

Do you have an active support agreement for your HP products? I'm not sure if you can get telephone support without one (though I've never tried). Also, didn't HPE buy out Aruba Networks and turn all of the ProCurve range into Aruba products? If so, then you could try call them? https://www.arubanetworks.com/support-services/contact-support/

Batman finds it amusing though.

Birmingham's Link2ICT have just announced the end of their partnership with Capita for certain services. If Link2ICT think they aren't up for the task, then God help them!

Not related to my last post: For those who don't modify the WIM/remove the AppX packages and use AppLocker to prevent the apps from being run - I've found that users are having 'This app has been blocked by your system administrator' messages for no apparent reason. Some of them are just browsing the web, typing in Word, etc. I used Impero to create a detect only block/warning to catch that popup and used that timestamp to check the AppLocker logs in EventViewer. It appears that it is the Xbox Gaming Overlay that is causing these, because the timestamp from Impero matches the time stamp for "Microsoft.XboxGamingOverlay was prevented from running." in the event log. I've enabled the following GPO and will keep an eye as to whether it makes any difference: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Game Recording and Broadcasting > Enables or disables Windows Game Recording and Broadcasts: Disabled

We only manage about 60 iPads and a couple of Macs, and previously used Apple Configurator/Profile Manager and had a bunch of issues with it (this is going back a few years now). We trialed both Jamf and ZuluDesk (before it was purchased by Jamf). We found that Jamf was overly complicated to manage and expensive. ZuluDesk was good and cost effective, but was limited on the configuration for iPads at the time. At this point, Microsoft had just relaunched inTune and we trialed that. Sure, it's limited in what it can do, but it covers most of what we need and the pricing was also very good, probably comprable to ZuluDesk. We plumped for inTune because the licensing covers more than just iOS/MacOS, so we have the option to manage Windows devices, should we go down that route in the future.

I'm not sure what I've done, but it's now working. :| I swear I didn't do anything I hadn't already tried. Anyway, here's a copy of my final working XML for 1903: xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1"> Note: "Microsoft.AutoGenerated.{131DBB25-036C-B479-43E2-3B8B02BB1F8D}" is SIMS in my case.

I believe we can use the free version of SMART Notebook 19.0 without being connected to a board, so like a member of staff using their school laptop at home. I thought you meant about using the interactivity on another touch device, like a Promethean board or something!

For the life of me, I cannot get pinned task bar items to work in 1903. They worked perfectly in 1809. However the Start Menu XML file I created for 1809 didn't work with 1903 and caused the start menu to crash, restart, crash, restart, etc. So I remade the XML file. The Start Menu tiles work and display correctly, to how I've configured them, but it's just the pinned taskbar items causing me issues now. It's just showing me Microsoft Edge as the only pinned item and I can't stop it. I've even removed all taskbar entries and left it as: taskbar: DesktopApp DesktopApplicationLinkPath="leaveempty", as from Microsoft's examples, yet Edge is still displayed. Each time I make a modification to the Start Layout, I delete the profile of my test user from my test machine with DelProf2. Here's a copy of my XML file: xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1" > Anyone see anything glaringly obvious that I'm missing?

I believe this is the full comparison list between free and paid: https://www.smarttech.com/en/Products/Education-Software/SMART-Learning-Suite/Pricing

SMART Notebook 19 can be used for free (with some features disabled, unless you license it). I upgraded our site from a perpetually licensed SMART Notebook 11.4 over the summer to 19.0. I could have paid to upgrade the license to unlock all the features, but it seems that we don't use most of the features that are locked. Most of our staff use SMART Notebook to simply annotate/draw on the board. A small handful may actually use Notebook to plan lessons and create Notebook files, which is still available in the free version of 19.0. I'm keeping an eye out for any users who want to use the locked features. However I believe that at least the free version of SMART Notebook will only work on SMART boards/TVs and would need licensing to work on other devices (don't quote me on that though).

I've deployed Python 3.7.2 (admittedly with SCCM) by only using the exe and a silent switch. phython-3.7.2.exe /silent If you can't deploy exe files with switches, I guess it could be deployed with a batch file and a basic if file exists detection to avoid constant reinstallation.

Update: Root cause found. It appears that it's the Always-On VPN profile that has been causing the DNS suffix to change. I noticed that the DNS suffix was only being changed after a user logs on - it would remain the correct suffix for hours if the machine was turned on and not used. We haven't made any sigificant changes to GP that would cause such an issue, however we did apply the VPN profile to all staff. This was after many months of sucessful testing with about 20 users. The profile was being pushed by SCCM, targetting users in a specific security group. Once a user was removed from that group - the DNS suffix remained correct at logon. I've now removed all users from the group and it appears to have stopped the issue completely. Now I need to try and figure out how to get VPN working without it changing the DNS suffix. That was one hell of an issue to have within he first two weeks of term!

I think our card reader was manufactured in around 2008 and was supplied with our door system in about 2010. It certainly pre-dates me, I've been here for about 5 years. We'll do maybe about 50 cards a year.

Update: The issue appears to be related to the DNS suffix on the network adapters of the clients. I have no idea how it's changed, but it has. ncpa.cpl > Network adapter > Properties > IPv4 > Properties > Advanced > DNS Instead of the default option Append primary and connection specific DNS suffixes being selected, the option Append these DNS suffixes (in order) was selected, and that had our website domain suffix only in the list. As soon as that was changed to our domain suffix, or changed to th Append primary and connection specific DNS suffixes option, running a ipconfig /flushdns...I was able to start pinging things by the NetBIOS name. So the issue isn't NetBIOS related, it's DNS suffix related. However I have no idea how this has happened, because as far as we're aware, no changes have been made to the DNS suffix on clients.

We've been having an issue that has gotten worse over time, where we cannot ping or contact devices via the NetBIOS name. This is causing issues with clients accessing server resources and the likes of SIMS (via SOLUS3). It started with the odd server or client not responding to NetBIOS pings or nslookup. Now almost all of our servers aren't responding. However they do respond when using the FQDN of the server, but still not for the FQDN. This to me suggests I have an issue with my Forward DNS, but I'm at a loss at the moment. I also think we've been having DNS replication issues for a while. We have two Domain Cotrollers on site and they both host our DNS roles. Scavenging is set as automatic and to a period of 7 days. The network adapters on the DCs have the primary DNS configured as the other DC, however it was previously configured that the primary DNS was itself - and the problem also existed there. IP forwarders are set as 8.8.8.8 and 8.8.4.4 (both Google DNS). DNS Zone Data is already stored in AD DS. Things I've tried: - Swapped the primary DNS for the DC network adapters (as described above) - Cleared the DNS cache - ipconfig /flushdns on both servers - ipconfig /registerdns on both servers - Update server data files on both servers - Restarted the DNS Server services on both servers - Both servers restarted nslookup results from my machine: Staff server DC1 (domain controller) My own workstation: DC1 dcdiag results: DC2 dcdiag results: Despite both servers showing DFS repliaction issues, we don't have the DFS Namespace or DFS Replication roles installed on either DC (though I believe domain controllers do use DFS for the SYSVOL shares, despite the role not being installed) the event log states that DFS replication failed because it cannot contact the other server. I suspect that's because DNS is failing. DC1 repadmin /showreps results: DC2 repadmin /showreps results: We do find that when a client is restarted - DNS then works on that client, for about an hour and it then fails. Can anyone help me on this?

I guess it's just like other previous versions of Windows 10, where they drop updates for that version of the OS. I decided to migrate to 1903 because I've read that Microsoft are not officially releasing a 1909 equivilant. Instead 1903 will be patched up to 1909 via standard Windows Updates. I believe it was because of the issues they had with 1809, which caused extra testing of 1903, which in turn kept pushing testing time back. To counter this, there'll be no major Windows release at the end of this year. I believe it goes back to normal next year.