PeterH

We have the same issue with Edge not signing in automatically on first launch. This happens with first login to a computer, i.e. new profile. We have our BrowserSignIn set to 2 (Force) which means users are having to manually sign in when they open the browser for the first time. I spent hours chasing this trying to figure out what had broken it. It seems that the problem was introduced in Edge v153.0.4234.32. However I have tested with 4234.46 and it seems to be fixed. So perhaps try updating to the new version.

If the DNS servers are unable to access the Internet then that's probably why the clients can't as well. On your DCs, first thing is to check that the default gateway is reachable. For example ping 192.168.0.1 should get replies from 192.168.0.1. If that doesn't work then check if your router is switched on, connected to the LAN, tried restarting it? It depends how you connect to the Internet, any firewall, Smoothwall or similar? If that works, then try ping an external ip address such as 8.8.8.8 which should always get a reply. If not then tracert 8.8.8.8 might show where the connection is failing. The DNS forwarders are configured in the DNS Management Console in the Server properties on the Forwarders tab. There may not be any listed. If not it is supposed to use the root hints (you should see a list of servers and ip addresses on that tab).

DC replication issues are unlikely to cause DNS errors but they may well be caused BY DNS errors. If DNS is not working properly on your domain then you will have issues with replication between the DCs First check the DNS server is running on all your DCs On a PC, check if you can resolve internet names e.g. by doing ping Google If it says it can't find host, then check what your DNS server is set to - ipconfig /all You can try querying a DNS sever directly, for example to check your internal DNS is able to resolve names you might do: nslookup google.com 192.168.0.9 Where 192.168.0.9 is the address of your DNS server....you should get a "non-authoritative answer" google.com and an address. If you get DNS request time out check if your DNS server is running OK If that doesn't work try nslookup google.com 8.8.8.8 If that works and the 192.168.0.9 one doesn't then you've got problem with DNS forwarders or root hints. Check your DNS server has Internet connectivity. If neither of those work then you've got basic internet connectivity problems DC replication errors are unlikely to cause problems accessing the Internet, but they WILL cause other major problems on your network so they need to be sorted urgently.

Another vote for using a script. We gave up connecting to printers with GPP long ago, it slowed down the login and often didn't connect to the printer first time. A total pain. Scripting it works much better. If you're into powershell then look at Add-Printer -AsJob -ConnectionName \\yourserver\yourprinter. -AsJob parameter should do it in the background so shouldn't slow login at all.

Yep on Smoothwall we went into Web Proxy / Settings / Advanced and added port 8443 to the list of additional ports, which fixed the issue. Very odd that they would choose to use a non-standard port like this. Makes me wonder if it is a dev system that went live and someone forgot to change the port number.

Try this powershell in a login script or a shortcut and see if it helps. We used it last year when we had lots of problems with OneDrive not signing in after switching tenants on Office 365. Obv test carefully in your environment. Remove-Item Registry::HKEY_CURRENT_USER\Software\Microsoft\OneDrive -Recurse -Force New-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "EnableADAL" -PropertyType "DWORD" -Value "1"

I assume you've got a space between -Install and -AcceptAll Have you tried Install-WindowsUpdate instead of Get-WindowsUpdate: Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot I've tried this in the past and it seemed to work OK, this was from Microsoft Update (no WSUS)

I don't think it's in the reg, but you should find it in c:\users\%username%\.idlerc\config-main.cfg [EditorWindow] line-numbers-default = True

You don't need to install SimsInfrastructureSetup. All it does is install .Net, and a bunch of other stuff you've probably already got. Not installed it on any of our Sims machines, haven't done for years.

No problems with InTouch on RDS here. Even seems to load reasonably quickly. Again server 2019 rds. Is the problem when you access InTouch remotely from offsite? If so then I would suggest trying the performance experience settings in the remote desktop client. It will usually automatically choose optimum settings based on the connection speed. But you can also manually tweak it. Try turning off font smoothing, desktop composition and visual styles for a start, and see if that makes any difference.

As far as I know, PP does not import email addresses from Sims even though they might well be in the report. The only way you can change an email address on PP is to contact them and ask them to do it for you. We've had to do that several times recently. They have always responded promptly and done it, but a shame there is no other way to do it.

We've had exactly the same issue with some of our forms. Incredibly annoying as the forms we need to use daily are now off-line and even wrose we can no longer access the responses that have been submitted. In the Office 365 Admin Messages Centre there is supposed to be a link to review and unblock the forms. But I can't find any relevant messages in ours. https://support.microsoft.com/en-us/office/review-and-unblock-forms-or-users-detected-and-blocked-for-potential-phishing-879a90d7-6ef9-4145-933a-fb53a430bced

Looking at this at the moment. I believe you can achieve this by setting a messaging policy with the "Chat" setting switched off and applying to your students. This will prevent them from chatting privately (removes the chat icon on the left-hand side of Teams) but they can still "Post" in channels. And they can still chat in meetings (if not muted). Assuming you don't apply this policy to teachers then they will be able to chat 1:1 still (but not to students with the messaging policy applied)

msiexec /i teams_windows_x64.msi OPTIONS="noAutoStart=true" ALLUSER=1 ALLUSERS=1 The reg key you need is HKLM\Software\Citrix\PortICA Works for us...Definitely installs and runs from c:\program files (x86)\microsoft\teams\current\teams.exe It does dump a load of stuff into appdata, but not the exe https://www.vcloudinfo.com/2020/01/microsoft-teams-cannot-install-vdi-environment-is-not-detected.html

OK the dreaded certificate template request attribute. We had this issue when we tried to get a new NLS cert last year. I can't remember exactly what caused the error, but this is what we did in the end to get the certificate: You need to identify which server hosts your enterprise CA and you need the Certification Authority Web Enrollment role service installed on it. If you don't know which server this is on, you can find out by doing this at the command prompt: certutil -config - -ping (note the extra hyphen between -config and -ping) Then we did this: Create the CSR with: Common Name: DA-server-name.domain Cryptographic service provider: Microsoft RSA SChannel Cryptographic Provider Bit Length: 2048 Then go to: http://ca-servername.domain/certsrv Request a certificate Advanced cert request Paste in the CSR Select Certificate Template: Web Server The certificate download should be offered. Download in DER format and save it somewhere Now on your DA server, run certlm.msc Personal/Certificates Import Browse for the cert that you saved It should import OK - go to the properties and give it a friendly name you can identify In the DA Setup/config, go step 3 - edit infrastructure servers Click Browse to select a new cert - the new cert you just imported should be available to select Couple of extra issues we had: 1. When requesting the cert, the web server template wasn't available to select. I think if you're not logged in as a Domain Admin, you don't get all the options. In the end we did it on the ca server itself and it was fine. 2. When we applied the configuration changes in DA, we got an error message saying the dns name was not available. After lots of faffing it turned out that the directaccess-nls.domain record in DNS did not exist. We re-created it, but every time we tried to apply the configuration changes in DA it got deleted again. I'm not sure if this is a known issue, but we ended up manually creating the directaccess-nls record, pointing it to the internal IP of the DA server. And then altered the permissions to remove Delete rights from Domain Admins and Authenticated Users. Then it worked OK. 3. Finally, on ours when we go into the DA dashboard, it still shows an error against Network Location Server, even though it is working fine. Even rebooting it hasn't cleared the error but it works fine so I've left it alone.

Taskbar settings, this is something that you would have thought UE-V should be able to do out of the box, but it doesn't seem able to. I do have a UE-V template that seems to roam start menu settings and taskbar ok. If you want to try, its here: https://1drv.ms/u/s!AjR2NEmk3H5hjeVoayByTPntm_6yRg?e=QRoPb0. It was adapted from this one on the TechNet: https://gallery.technet.microsoft.com/Start-Menu-UE-V-Template-b44ad773 For bookmarks it depends what browser you're using, we do it using Edge by setting the "Keep favorites in sync between Internet Explorer and Microsoft Edge" policy. You can then set a folder redirection policy to redirect Favorites,and that seems to work OK for us. For Chrome there's a group policy called "Roaming Profile Location" that I believe will allow you to roam bookmarks. The other solution may be to use FSLogix Profile Container to redirect the entire user profile. https://docs.microsoft.com/en-us/fslogix/configure-profile-container-tutorial

I think you might need to whitelist cc-propeller.com rather than cc-propeller.cloud, or maybe even both. We had this issue last week and we just added the following to Custom Allowed Content: cc-propeller.com codeacademy.com Check that the Custom Allowed Content category, or whatever yours is called, is whitelisted in web filter policies and included in a Do Not Inspect policy in HTTPS Inspection

It should log in completely automatically. Ours does. No sign in required. Check your Azure hybrid domain join is working: dsregcmd /status Should show AzureADJoined: YES If not check here: Troubleshoot Azure Hybrid Domain Join

Yes it does! Thanks for that. I gave it a try and if you turn on this policy, and then add a favourite in Edge, it will appear in your favourites folder a moment later. Very handy.

For syncing taskbar items, did you try importing the settings template here: https://gallery.technet.microsoft.com/Start-Menu-UE-V-Template-b44ad773 It does claim to be able to support roaming taskbar items. It have tested it briefly and it does seem to work but haven't used it much yet. I don't know why UEV settings would apply and then disappear. it sounds like they are getting overwritten by something. Is there anything in group policy, or anything in a login script that might cause that? Depending on how you have it set up, login scripts sometimes don't finish until after the desktop has appeared.

Yes it's because you have the "Prevent Access to Drives in My Computer" set somewhere in group policy. This will prevent access to C: which is why it won't display the OneDrive folder. And no, unfortunately you can't move it to a network share. The work around which isn't ideal, but will do the job, is to set the "Hide these specified drives in my computer" policy but NOT the "Prevent Access to Drives". This means that the C: drive won't show in file explorer, but can be accessed by typing C:\ into the address bar in File Explorer, or by creating a shortcut to it. That will make the OneDrive icon work as it should.

1. There is a UE-V settings template here: https://gallery.technet.microsoft.com/Start-Menu-UE-V-Template-b44ad773 which enables roaming of taskbar items and startmenu layout. We don't allow users to customise start menu, but I did try it and it does seem to work OK for the taskbar. You might need to set the WaitForSyncOnLogon and WaitForSyncOnApplicationStart registry keys in HLKM\Software\Microsoft\UEV\Agent\Configuration. 2. Yes as has been said previously, you will need to use the settings template generator for any 3rd party apps 3. No it doesn't! Because Edge doesn't support UE-V. Why would it, it's only a Microsoft product after all. There is something called EdgeSync which might do the job. I haven't tried it yet, but you can find here: Synchronize Edge Favorites 4. No we don't

Thanks I'll have a look at the INI files and see if I can spot any problems there.

I have a fairly big behaviour log report that always runs OK manually, but when run using CommandReporter it almost always times out. I assume CommandReporter is ignoring the CommandTimeOut in the Connect.Ini file. Is there any way to specify a CommandTimeout for use with CommandReporter?

Yes we use Outlook desktop, but most people who are likely to use signatures here are staff who mostly use the same computers, so I don't think it will be a huge problem for us. We are still testing UE-V and haven't rolled it out yet, so we will see! But we have found that the setting "Automatically configure profile based on Active Directory Primary SMTP address" in Outlook 2016 group policy helps with the non-roaming profile issue.