ChrisMiles

Did you add the registry settings to enable the fixes? The Windows Server patch doesn't do anything unless you specifically enable it. Theres a thread on here somewhere to the microsoft page about it, looking for it...

Check free disk space on the volumes in the server running the document store. Maybe they've run out?

Honestly I've never tried approving a channel, maybe have to approve individual videos?

Yes that's normal unfortunately, the search is limited to restricted mode videos only, but links will work ONLY if the student is logged in with their G Suite account.

You allow students to log into YouTube by enabling it for their OU in G Suite. (or by restoring the default option of On for everyone): The DNS mods are hard to do with windows, if not impossible, so we have a tiny little ubuntu server running BIND with a response policy configured and the domain dns servers use it as the forwarder. The policy looks like this: $ORIGIN rpz. $TTL 1H @ IN SOA dns01.ad.domain.org. root.ad.domain.org. ( 7 1H 15m 30d 2h ) NS LOCALHOST. www.youtube.com IN CNAME restrict.youtube.com. m.youtube.com IN CNAME restrict.youtube.com. youtube.googleapis.com IN CNAME restrict.youtube.com. youtubei.googleapis.com IN CNAME restrict.youtube.com. It looks complicated but I'm no linux expert and managed to set it up easily using a couple of Google searches. You can use this to force Google SafeSearch too. The GPOs only work for Chrome (we remove all other browsers from our images).

G Suite allows you to configure teachers as content reviewers that can approve specific videos. That way, students can log into youtube using their school google account and then view the video even when in restricted mode. It even keeps a list of who approved what. We enforce YouTube Restricted Mode using a combination of DNS and GPO (so that non-logged in users all get restricted mode), then set G Suite permissions to allow staff access to everything and students access to everything in restricted mode + what has been allowed. You get a blue bar on every video page that says if it's accessible and a button to approve it if not. Here's where you set the initial settings: The the top-level permissions to force restricted by default: And finally the staff OU level permissions to allow approval of videos:

I would most definitely steer clear of in-place upgrades to windows, but that's always been the case. Build and test new images before deploying them. Each new versions bring changes, but in my experience most issues have been caused by trying to hold on to depreciated concepts like roaming/mandatory profiles, login scripts and the like. Some stuff you can get working with enough effort and some stuff you really can't, better to embrace the changes for personal sanity's sake! Personally, we have 1703 purring like a kitten and will be skipping 1709 entirely and the next one too unless anything worth while gets added or SCCM can't hold off the updates anymore.

Hmmmm, I have an idea, did you install the "Desktop Experience" extensions on the hosts? This caused us all sorts of issues on the old 2012 R2 servers, so I left it off this time. It doesn't allow truancy call to work properly though, but I hosted that on different servers.

You just need to add the path to pulsar in the Parameters section.

We use SSO here, sorry it didn't help I'd love to help more as I did have the same issues. So with the bootstrapper app, you can see the window now, but it's all white? Hmm, does the SIMS/Capita splash screen show OK prior to the main window opening? Also, do you use increased DPI settings in windows? What version of windows are the clients running? Is the RDS host a physical machine or a VM? What hypervisor? Any hardware graphics involved?

I had this issue too, and fixed it by wrapping the pulsar exe in a bootstapping executable with a hidden window. The issue seemed to revolve around the SIMS window being the first to open. You can try it if you want, I've attached it here. Set your remote app to open this exe instead of pulsar.exe and pass the path to pulsar.exe as an argument to this exe. Worked for us for years. Don't blame me if it blows up your computer and runs off with your car keys though! On a completely new Server 2016 build we didn't seem to need this anymore though, but you might as well try it! Also bear in mind that if SIMS goes non-responsive in RemoteApp it can stop windows coming up properly, you can increase the timeout for non-responsive apps with a registry setting on the host. Milesoft.SIMS.Bootstrap.zip

Why do people exclude internet banking sites from these kinds of things? Our AUP as I'd imagine most AUPs state that school equipment is for work use only. If people go on their internet banking in school they are violating school policy anyway. Whats the rational behind disabling inspection for these sites?

In my opinion ReFS isn't fit for many production uses yet, it's far too limited support wise. Even for Hyper-V we had to switch back to NTFS because using ReFS on cluster shared volumes means that they can only operate in the mode where all IO is sent to the controlling host rather than direct access which kills performance. It also severely limits your backup options, breaks DFS replication and data deduplication. I started off trying to use it for as much as possible in a brand new 2016 domain setup and ended up having to switch back to NTFS for everything including hyper-v, file hosts, sql hosts, etc, except for veeam data storage, due to some incompatibility or another. I strongly advise against using it on anything except s2d.

I'd have thought this would be much worse as you wouldn't be able to mount the vhd's to a new server if you needed to, or use any kind of item level restore in your backup solution?

I looked into it but Nimble state around 10% performance loss on ours which I don't like!

Well you can configure a PowerShell logon script and call the website in that: Invoke-WebRequest -Uri https://www.google.com -UseBasicParsing Or use a command line tool in a similar way.

Have you considered using a scripting language for this? It means it can be automated easily and customised at will. Here is something in powershell I through together, it provides full customisable and high quality resizes: There's probably room for improvement, logging, backup of original files and some error handling, but the hard work is done. [system.Reflection.Assembly]::LoadWithPartialName("System.Drawing") $searchRoot = "c:\test" $ignoreFilesSmallerThan = 1MB $maxImageWidth = 1920 $maxImageHeight = 1920 $maxResolution = 72 $saveQuality = 100 $encoder = [system.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() | Where-Object { $_.FormatID -eq [system.Drawing.Imaging.ImageFormat]::Jpeg.Guid } $encodingParams = New-Object System.Drawing.Imaging.EncoderParameters $encodingParams.Param = @(New-Object System.Drawing.Imaging.EncoderParameter -ArgumentList @([system.Drawing.Imaging.Encoder]::Quality, $saveQuality)) $files = Get-ChildItem -Path $searchRoot -Filter *.jpg -Recurse | Where-Object { $_.Length -gt $ignoreFilesSmallerThan } foreach ($file in $files) { $sourceBytes = [system.IO.File]::ReadAllBytes($file.FullName) $sourceStream = New-Object System.IO.MemoryStream $sourceStream.Write($sourceBytes, 0, $sourceBytes.Length) $sourceImage = [system.Drawing.Bitmap]::FromStream($sourceStream) if ($sourceImage.Width -gt $maxImageWidth) { $newWidth = $sourceImage.Width $newHeight = $sourceImage.Height $newResolution = $sourceImage.HorizontalResolution if ($newWidth -gt $maxImageWidth) { $newHeight = [Math]::Floor(($maxImageWidth / $sourceImage.Width) * $sourceImage.Height) $newWidth = $maxImageWidth } if ($newHeight -gt $maxImageHeight) { $newWidth = [Math]::Floor(($maxImageHeight / $sourceImage.Height) * $sourceImage.Width) $newHeight = $maxImageHeight } if ($sourceImage.HorizontalResolution -gt $maxResolution) { $newResolution = $maxResolution } Write-Output "$newWidth $newHeight" $destRect = New-Object -TypeName System.Drawing.Rectangle -ArgumentList @(0, 0, $newWidth, $newHeight) $destImage = New-Object -TypeName System.Drawing.Bitmap -ArgumentList @($destRect.Width, $destRect.Height) $destImage.SetResolution($newResolution, $newResolution); $wrapMode = New-Object -TypeName System.Drawing.Imaging.ImageAttributes $wrapMode.SetWrapMode([system.Drawing.Drawing2D.WrapMode]::TileFlipXY) $graphics = [system.Drawing.Graphics]::FromImage($destImage) $graphics.CompositingMode = [system.Drawing.Drawing2D.CompositingMode]::SourceCopy $graphics.CompositingQuality = [system.Drawing.Drawing2D.CompositingQuality]::HighQuality $graphics.InterpolationMode = [system.Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic $graphics.SmoothingMode = [system.Drawing.Drawing2D.SmoothingMode]::HighQuality $graphics.PixelOffsetMode = [system.Drawing.Drawing2D.PixelOffsetMode]::HighQuality $graphics.DrawImage($sourceImage, $destRect, 0, 0, $sourceImage.Width, $sourceImage.Height, [system.Drawing.GraphicsUnit]::Pixel, $wrapMode) $graphics.Dispose() $wrapmode.Dispose() $destImage.Save($file.FullName, $encoder, $encodingParams) $destImage.Dispose() } $sourceStream.Dispose() $sourceImage.Dispose() }

If I remember correctly, restarting the service didn't fix the machines that wouldn't expand their memory any more. They had to be shut off and restarted. I could see in the Hyper-V Manager that the memory demand exceeded the allocated memory but it would not allocate more without a reboot. I'm not 100% sure though, it's been a while. The log came from the Application event log on the host server.

Yes, we changed to a fixed amount of RAM per machine. The problem did often rear it's head when VMs tried to restart for updates but I think this is because the problem only shows symptoms when VMs try to change state during a restart and this is mostly the only time it happens, not because of the updates themselves. I did have the issue at other times too, for example when trying to shutdown servers myself. From what I've seen, the vmcompute process borking up doesn't affect running servers except that it prevents them being assigned additional memory when using dynamic memory. This is what lead me to trying without dynamic memory.

It may also help to know that for us the problem improved significantly ever since we stopped using dynamic memory.

I admit I gave up trying to restart the service, I just terminate it again from task manager. Never seen any evidence of problems related to this but if a proper restart works the 2nd time then I guess it's safer.

You can fix the catastrophic error by terminating the vmcompute service again once the machines are stopped. I still have this problem now. Nothing fixes it

ZeroHour is correct, Google Chrome cannot run on more than one machine when the Chrome data folder is held on a shared location, it must be seperate for each instance. I've seen posts from the chromium people where they have outright refused to fix this issue and instead say to use the syncing capabilities of Chrome using a Google account.

G Suite's management capabilities are attrocious, you'll want to download and configure GAM from here asap https://github.com/jay0lee/GAM to allow easy bulk or scripted updates to G Suite data. You can easily remove the password set flag using this tool:

Depending on how your web filter works, what you've done may be no use. If your filter looks at the domain controller for logon events then service logins will override each other and console logins will overwrite that. Basically, your filter can't keep track of who's logged in at that IP. If your filter uses a proxy server, the service may not be using it. Is there any reason you need to apply filtering to the SIMS server? I'd just exclude it.