PeterH

If the DNS servers are unable to access the Internet then that's probably why the clients can't as well. On your DCs, first thing is to check that the default gateway is reachable. For example ping 192.168.0.1 should get replies from 192.168.0.1. If that doesn't work then check if your router is switched on, connected to the LAN, tried restarting it? It depends how you connect to the Internet, any firewall, Smoothwall or similar? If that works, then try ping an external ip address such as 8.8.8.8 which should always get a reply. If not then tracert 8.8.8.8 might show where the connection is failing. The DNS forwarders are configured in the DNS Management Console in the Server properties on the Forwarders tab. There may not be any listed. If not it is supposed to use the root hints (you should see a list of servers and ip addresses on that tab).

DC replication issues are unlikely to cause DNS errors but they may well be caused BY DNS errors. If DNS is not working properly on your domain then you will have issues with replication between the DCs First check the DNS server is running on all your DCs On a PC, check if you can resolve internet names e.g. by doing ping Google If it says it can't find host, then check what your DNS server is set to - ipconfig /all You can try querying a DNS sever directly, for example to check your internal DNS is able to resolve names you might do: nslookup google.com 192.168.0.9 Where 192.168.0.9 is the address of your DNS server....you should get a "non-authoritative answer" google.com and an address. If you get DNS request time out check if your DNS server is running OK If that doesn't work try nslookup google.com 8.8.8.8 If that works and the 192.168.0.9 one doesn't then you've got problem with DNS forwarders or root hints. Check your DNS server has Internet connectivity. If neither of those work then you've got basic internet connectivity problems DC replication errors are unlikely to cause problems accessing the Internet, but they WILL cause other major problems on your network so they need to be sorted urgently.

Another vote for using a script. We gave up connecting to printers with GPP long ago, it slowed down the login and often didn't connect to the printer first time. A total pain. Scripting it works much better. If you're into powershell then look at Add-Printer -AsJob -ConnectionName \\yourserver\yourprinter. -AsJob parameter should do it in the background so shouldn't slow login at all.

Yep on Smoothwall we went into Web Proxy / Settings / Advanced and added port 8443 to the list of additional ports, which fixed the issue. Very odd that they would choose to use a non-standard port like this. Makes me wonder if it is a dev system that went live and someone forgot to change the port number.

Try this powershell in a login script or a shortcut and see if it helps. We used it last year when we had lots of problems with OneDrive not signing in after switching tenants on Office 365. Obv test carefully in your environment. Remove-Item Registry::HKEY_CURRENT_USER\Software\Microsoft\OneDrive -Recurse -Force New-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "EnableADAL" -PropertyType "DWORD" -Value "1"

I assume you've got a space between -Install and -AcceptAll Have you tried Install-WindowsUpdate instead of Get-WindowsUpdate: Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot I've tried this in the past and it seemed to work OK, this was from Microsoft Update (no WSUS)

I don't think it's in the reg, but you should find it in c:\users\%username%\.idlerc\config-main.cfg [EditorWindow] line-numbers-default = True

You don't need to install SimsInfrastructureSetup. All it does is install .Net, and a bunch of other stuff you've probably already got. Not installed it on any of our Sims machines, haven't done for years.

No problems with InTouch on RDS here. Even seems to load reasonably quickly. Again server 2019 rds. Is the problem when you access InTouch remotely from offsite? If so then I would suggest trying the performance experience settings in the remote desktop client. It will usually automatically choose optimum settings based on the connection speed. But you can also manually tweak it. Try turning off font smoothing, desktop composition and visual styles for a start, and see if that makes any difference.

As far as I know, PP does not import email addresses from Sims even though they might well be in the report. The only way you can change an email address on PP is to contact them and ask them to do it for you. We've had to do that several times recently. They have always responded promptly and done it, but a shame there is no other way to do it.

We've had exactly the same issue with some of our forms. Incredibly annoying as the forms we need to use daily are now off-line and even wrose we can no longer access the responses that have been submitted. In the Office 365 Admin Messages Centre there is supposed to be a link to review and unblock the forms. But I can't find any relevant messages in ours. https://support.microsoft.com/en-us/office/review-and-unblock-forms-or-users-detected-and-blocked-for-potential-phishing-879a90d7-6ef9-4145-933a-fb53a430bced

Looking at this at the moment. I believe you can achieve this by setting a messaging policy with the "Chat" setting switched off and applying to your students. This will prevent them from chatting privately (removes the chat icon on the left-hand side of Teams) but they can still "Post" in channels. And they can still chat in meetings (if not muted). Assuming you don't apply this policy to teachers then they will be able to chat 1:1 still (but not to students with the messaging policy applied)

msiexec /i teams_windows_x64.msi OPTIONS="noAutoStart=true" ALLUSER=1 ALLUSERS=1 The reg key you need is HKLM\Software\Citrix\PortICA Works for us...Definitely installs and runs from c:\program files (x86)\microsoft\teams\current\teams.exe It does dump a load of stuff into appdata, but not the exe https://www.vcloudinfo.com/2020/01/microsoft-teams-cannot-install-vdi-environment-is-not-detected.html

OK the dreaded certificate template request attribute. We had this issue when we tried to get a new NLS cert last year. I can't remember exactly what caused the error, but this is what we did in the end to get the certificate: You need to identify which server hosts your enterprise CA and you need the Certification Authority Web Enrollment role service installed on it. If you don't know which server this is on, you can find out by doing this at the command prompt: certutil -config - -ping (note the extra hyphen between -config and -ping) Then we did this: Create the CSR with: Common Name: DA-server-name.domain Cryptographic service provider: Microsoft RSA SChannel Cryptographic Provider Bit Length: 2048 Then go to: http://ca-servername.domain/certsrv Request a certificate Advanced cert request Paste in the CSR Select Certificate Template: Web Server The certificate download should be offered. Download in DER format and save it somewhere Now on your DA server, run certlm.msc Personal/Certificates Import Browse for the cert that you saved It should import OK - go to the properties and give it a friendly name you can identify In the DA Setup/config, go step 3 - edit infrastructure servers Click Browse to select a new cert - the new cert you just imported should be available to select Couple of extra issues we had: 1. When requesting the cert, the web server template wasn't available to select. I think if you're not logged in as a Domain Admin, you don't get all the options. In the end we did it on the ca server itself and it was fine. 2. When we applied the configuration changes in DA, we got an error message saying the dns name was not available. After lots of faffing it turned out that the directaccess-nls.domain record in DNS did not exist. We re-created it, but every time we tried to apply the configuration changes in DA it got deleted again. I'm not sure if this is a known issue, but we ended up manually creating the directaccess-nls record, pointing it to the internal IP of the DA server. And then altered the permissions to remove Delete rights from Domain Admins and Authenticated Users. Then it worked OK. 3. Finally, on ours when we go into the DA dashboard, it still shows an error against Network Location Server, even though it is working fine. Even rebooting it hasn't cleared the error but it works fine so I've left it alone.

Taskbar settings, this is something that you would have thought UE-V should be able to do out of the box, but it doesn't seem able to. I do have a UE-V template that seems to roam start menu settings and taskbar ok. If you want to try, its here: https://1drv.ms/u/s!AjR2NEmk3H5hjeVoayByTPntm_6yRg?e=QRoPb0. It was adapted from this one on the TechNet: https://gallery.technet.microsoft.com/Start-Menu-UE-V-Template-b44ad773 For bookmarks it depends what browser you're using, we do it using Edge by setting the "Keep favorites in sync between Internet Explorer and Microsoft Edge" policy. You can then set a folder redirection policy to redirect Favorites,and that seems to work OK for us. For Chrome there's a group policy called "Roaming Profile Location" that I believe will allow you to roam bookmarks. The other solution may be to use FSLogix Profile Container to redirect the entire user profile. https://docs.microsoft.com/en-us/fslogix/configure-profile-container-tutorial

I think you might need to whitelist cc-propeller.com rather than cc-propeller.cloud, or maybe even both. We had this issue last week and we just added the following to Custom Allowed Content: cc-propeller.com codeacademy.com Check that the Custom Allowed Content category, or whatever yours is called, is whitelisted in web filter policies and included in a Do Not Inspect policy in HTTPS Inspection

It should log in completely automatically. Ours does. No sign in required. Check your Azure hybrid domain join is working: dsregcmd /status Should show AzureADJoined: YES If not check here: Troubleshoot Azure Hybrid Domain Join

Yes it does! Thanks for that. I gave it a try and if you turn on this policy, and then add a favourite in Edge, it will appear in your favourites folder a moment later. Very handy.

For syncing taskbar items, did you try importing the settings template here: https://gallery.technet.microsoft.com/Start-Menu-UE-V-Template-b44ad773 It does claim to be able to support roaming taskbar items. It have tested it briefly and it does seem to work but haven't used it much yet. I don't know why UEV settings would apply and then disappear. it sounds like they are getting overwritten by something. Is there anything in group policy, or anything in a login script that might cause that? Depending on how you have it set up, login scripts sometimes don't finish until after the desktop has appeared.

Yes it's because you have the "Prevent Access to Drives in My Computer" set somewhere in group policy. This will prevent access to C: which is why it won't display the OneDrive folder. And no, unfortunately you can't move it to a network share. The work around which isn't ideal, but will do the job, is to set the "Hide these specified drives in my computer" policy but NOT the "Prevent Access to Drives". This means that the C: drive won't show in file explorer, but can be accessed by typing C:\ into the address bar in File Explorer, or by creating a shortcut to it. That will make the OneDrive icon work as it should.

1. There is a UE-V settings template here: https://gallery.technet.microsoft.com/Start-Menu-UE-V-Template-b44ad773 which enables roaming of taskbar items and startmenu layout. We don't allow users to customise start menu, but I did try it and it does seem to work OK for the taskbar. You might need to set the WaitForSyncOnLogon and WaitForSyncOnApplicationStart registry keys in HLKM\Software\Microsoft\UEV\Agent\Configuration. 2. Yes as has been said previously, you will need to use the settings template generator for any 3rd party apps 3. No it doesn't! Because Edge doesn't support UE-V. Why would it, it's only a Microsoft product after all. There is something called EdgeSync which might do the job. I haven't tried it yet, but you can find here: Synchronize Edge Favorites 4. No we don't

Thanks I'll have a look at the INI files and see if I can spot any problems there.

I have a fairly big behaviour log report that always runs OK manually, but when run using CommandReporter it almost always times out. I assume CommandReporter is ignoring the CommandTimeOut in the Connect.Ini file. Is there any way to specify a CommandTimeout for use with CommandReporter?

Yes we use Outlook desktop, but most people who are likely to use signatures here are staff who mostly use the same computers, so I don't think it will be a huge problem for us. We are still testing UE-V and haven't rolled it out yet, so we will see! But we have found that the setting "Automatically configure profile based on Active Directory Primary SMTP address" in Outlook 2016 group policy helps with the non-roaming profile issue.

OK I have just spent the best part of the last week battling with UE-V on Windows 10. There are a number of caveats and in our experience it is less than perfect, but the general configuration outlined below seems to work for us. So to start with, UE-V is part of the latest builds of Windows 10. There is no agent to install - it is already there and simply needs switching on. To configure UE-V, it is best done with group policy. Again, if you are using the latest Windows 10 ADMX templates, the UE-V configuration items will be there already. Firstly to configure UE-V, you will will need two network shares on a server somewhere. The first one is the Settings Storage Location, which is where each user's UE-V settings packages will be stored. The second is the Settings Template Catalogue, which contains the settings templates. These tell UE-V where each application stores is settings, so it knows which file / registry locations to sync. You can find a guide to creating these and the permissions you need here: https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/uev-v2/security-considerations-for-ue-v-2x-both-uevv2. However the permissions specified in that document did not work for us! So this is what we used to get it working: Settings Storage Location (e.g. \\server1\uev-settings) Share Permissons Domain Admins: Full Control Domain Users: Full Control NTFS Permissions Domain Admins: Full Control: This folder, subfolders and files Domain Users: List folder / Read Data, Create Folders / Append Data: This folder only Creator Owner: Full Control: Subfolders and Files Only Settings Template Catalogue (e.g. \\server1\uev-templates) Share Permissions Domain Admins: Full Control Domain Computers: Full Control NTFS Permissions Domain Admins: Full Control: This folder, subfolders and files Domain Computers: Modify: This folder, subfolders and files Once you have created your shares, you can configure UE-V using group policy. UE-V is configured in both Computer Configuration and User Configuration. There are a number of settings you will find in Administrative Templates / Windows Components / Microsoft User Experience Virtualization. The settings we made are as follows. Some things can be configured both in Computer and User configuration, so I'm not sure which is best practise, but the following works for us: Computer Configuration Sync Method: None (note that this actually disables the UE_V Sync provider and establishes a direct file connection to the settings storage path. In testing, we found this to be much more reliable) Enable UEV: Enabled (note the auto-register inbox templates option doesn’t seem to work on Windows 10 1709, some searching online suggested this is no longer supported) First Use Notification: Disabled Settings Template Catalog Path: e.g. \\server1\uev-templates Sync unlisted Windows apps: Enabled Synchroinze Windows Settings: Enable all Tray Icon: Disabled Use user Experience Virtualisation: Enabled User Configuration Do not synchronise Windows Apps: Disabled Settings Storage Path: e.g. \\server1\uev-settings\%username% (note you need %username% to create a folder for each user in the settings storage location) Synchronise Windows Settings: Enabled Use User Experience Virtualisation: Enabled Having created all of the above, you need to copy the Microsoft UEV settings templates from a Windows 10 computer into your settings template catalogue share. On 1709, these may be found in C:\ProgramData\microsoft\uev\inboxtemplates - just copy the files over. If you need any additional settings templates, there is a settings location template gallery here: https://go.microsoft.com/fwlink/p/?LinkID=246589. There are some templates to help with roaming desktop settings and pinned items on the taskbar and so on. Reboot one of your workstations and you should find UE-V is working. You can use Powershell to test it, the following commands may be useful: Get-UevConfiguration: This should show that SyncEnabled is True and it should show the settings storage path and the settings template catalog path that you configured in GPO Get-UevTemplate: This should display a list of imported UEV templates and will confirm that your settings template catalog path is working correctly. Finally, as each user logs in, it should create a folder for that user in your UEV Settings Location, containing the settings packages for that account (note that these are in hidden folders so you will not see them unless you are showing hidden files/folders in explorer) There are a few additional items you can set in the registry to configure the UE-V agent. These are all in HLKM\Software\Microsoft\UEV\Agent\Configuration: RepositoryOwnerCheckEnabled:REG_DWORD=1 (see https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/uev-v2/security-considerations-for-ue-v-2x-both-uevv2) WaitForSyncOnLogon: REG_DWORD: 1 and WaitForSyncOnApplicationStart: REG_DWORD: 1 (we found setting these seemed to make syncing of pinned taskbar items more reliable) There are a few issues we have discovered and there will be other things I'm sure that crop up: Roaming Outlook profiles with UE-V is not supported (see https://support.microsoft.com/en-gb/help/2850989/migrating-mapi-profiles-with-microsoft-ue-v-is-not-supported). You may have issues with roaming Outlook signatures also, because the default signature is referenced in the Outlook profile. Roaming IE Favorites with UE-V works OK, but Edge Favorites don't roam and is not supported and neither do any other Edge settings. Thanks Microsoft. No wonder people are switching to Chrome. We still have a few issues roaming Office 2016 toolbar settings, which don't seem to work very reliably.