gshaw

We removed a lot of the cruft UWP apps because they affect initial login speeds (the more apps that have to be provisioned per-user at login, the slower that login becomes) Struck a balance between keeping the more useful ones (extending to the likes of Mixed Reality Viewer as we do run 3D modelling in our courses) but removed the garbage that has no place on any business network (Candy Crush, Xbox Games etc.) 1709 seems to be the most stable \ feature rich supported release from what I've seen. We benefit from the additional security features and OneDrive integration but avoided the 1803 \ 1809 show-stopper bugs. Glad MS brought out the longer support window for 1709 recently as that means we can keep it for another year or so before picking the next jump, which I guess will be the patched & fixed version of 1809.

There's an interesting counter-argument to this on The Register as well, along with an amusing anecode of how the Windows Vista shutdown menu ended up involving 40-odd people from multiple teams and took over a year to complete (!) https://www.theregister.co.uk/2018/10/23/microsoft_windows_10_crisis/ Personally I don't think an OS needs two updates per year, the stability is suffering too much for very small benefits. One main release aka the xx09 build as a yearly version with the xx03 being an "Insider" Beta i.e. you can install it and try some new features early but expect some bugs. Support the xx09 releases for 24-30 months as per the recent changes but the xx03 have no production support at all as it would be officially marked as beta software. Seems like MS have bitten off a bit more than they can chew with the current model, or alternatively you could look at it that they're deliberately reducing the reliability of on-prem installations in order to sell you their hosted VDI version... https://azure.microsoft.com/en-gb/services/virtual-desktop/ Also note this statement on O365 ProPlus support on 2019 RDS https://searchenterprisedesktop.techtarget.com/news/252451300/Windows-Server-2019-RDSH-drops-Office-365-ProPlus-support

I did tweak my GPP a bit and just had just the one group, BitLocker-Enforce which sets all the keys. The GPP is then as simple as one set of keys turning it on and another set turning it off, with the condition of whether the user is in BitLocker-Enforce or not. @fiza do you mean if you browse the registry from the UI when editing the GPP on the server? Quite possibly as I'm not sure if BitLocker client keys would be on Windows Server. Either do it remotely via RSAT tools or just copy \ paste the path from the quotes on page 2

Microsoft Whiteboard looks good, shame MS made the Store such a pain to work with we'd need to move our system management platform to SCCM to deploy it neatly

I think they'd have a much more stable product if they just released it once a year, with the 6-monthly "new features" Insider Beta. They've got something close to that with the various Slow \ Fast rings but having two finalised releases seems to end up with neither being particularly stable. It'll be interesting to see how MS manage this going forward with the extended support lifecycle, seems to leave quite a large possibility of fragmentation as organisations standardise on one particular build for as long as possible. In my case it's 1709 and until there's something worthwhile in a newer build that makes as big a difference as, say Files on Demand (or Exploit Guard on the security front) I'll stick with it.

A couple of reasons... Local MIS apps may hold temporary data or exported reports (Desktop not redirected, Documents is) Local drives hold OneDrive cache for Files on Demand Yup, which I feel is basically pointless so if we're going to do encryption it should be done in a way that's actually effective.

Just need a quick sanity check on this... - staff PCs, old Stone kit (Intel and MSI motherboards) - no TPM on either motherboard - machines are shared between multiple users Although Bitlocker can in theory be deployed using the USB stick or boot password method is it reasonable to say that's not a feasible method for the scenario above? My thinking being either the USB would stay in the whole time (which defeats the object of it) and similar for password (plus the inevitable glut of helpdesk queries when it gets lost) and realistically for staff machines we simply need to replace the (5-7 year old) hardware with something with TPM support.

Depends how badly you want the in-page content scanning. If URL category-based filtering is enough there's loads but very few do dynamic page inspection. We're in a similar boat, want to move away from proxy-based filtering but category-based products aren't as intelligent (in theory anyway)

We use Quad9 https://www.quad9.net/ as it's free and backed by IBM. Quicker than Google too. Had one or two false positives but Quad9 support are quick at responding to them these days

The Chrome devices would be my preferred route too if buying hardware again, at present I've got a motley crew of Windows 10 LTSB devices as quite a few of our screens are old and don't have HDMI inputs (!)

Made a couple of blog posts a while back about getting started with MDT, may be worth a look https://gshaw0.wordpress.com/2017/09/11/mdt-imaging-megapost-part-1-our-first-server/ https://gshaw0.wordpress.com/2018/03/04/mdt-imaging-megapost-part-2-database-automation/

MDT set up nicely works like a charm. Task Sequence can be as easy or complex as you want to make it. Personally since Win10 came out I don't capture anymore and build off the base WIM and layer everything else on top. Makes it easy to switch out one version for another and avoids any sysprep issues.

That phrase sends shivers down my spine

A few things: Users need write access to C: (i.e. don't block drives via GPO) No restrictions on running from local appdata Registry keys in place for single sign-on (enable ADAL if you have any form of SSO) Allow downloads from Microsoft to get the auto updater file Here's how I got it running on 1709 https://gshaw0.wordpress.com/2017/11/08/onedrive-files-on-demand-first-steps/ For us at least it's miles better than that nasty WebDAV protocol and only brings down the files required. The only concern I have long-term is the local cache growing too large. Trying to figure out a script for that but MS doesn't have great support for analysing their own file system "space used on disk" via scripting

Have you both x64 and x86 Boot Images set up on WDS? Some older kit uses 32-bit UEFI despite having 64-bit CPU. Also check BIOS for a setting within Integrated Peripherals that the full PXE IPv4 stack is enabled (PXE itself will be on but not the network options) Check BIOS version, is there an update available if this only affects one particular brand of laptop. Can you boot from a standard desktop machine, especially so if you have any Dells etc. that tend to have better built BIOS than the white box OEMs such as Clevo. Sent from my VFD 610 using EduGeek mobile app

Files on Demand was the big one for us, basically 1TB per user now accessible from File Explorer without having to sync the whole thing locally Not sure whether MS have ported that into LTSB 2019 but it wasn't in the old one

I can't even get into VLSC let alone a download

1809 also meant to have the redesigned faster update mechanism isn't it? That'll be the one to start testing with for next round of deployment I think, should have the full 30-month support too

Just modified our GPO to schedule WSUS updates for Windows 10 (used to be set to install on shutdown for Windows 7 but that no longer works with 10) The settings are based off some templates I've seen on here (and elsewhere), nothing too exotic but left a machine on last night, no updates installed. Also just tried it again here manually changing the time to 15:59 and again nothing happens once clock ticks over to 16:00. There's a thread on Spiceworks with exactly the same issue and no resolution, has something borked? Edit: may be a false alarm, test machine has just kicked in 15 minutes later and started installing https://community.spiceworks.com/topic/2142073-gpo-force-windows-10-to-install-updates-at-scheduled-time?page=2

When I made a new project whilst testing the other day it asked where to put the files, we have large HDDs installed in our games development workstations for that reason and also OneDrive Files on Demand which may help going forward as the files for that sit in the C:\Users folder

Indeed, got an alert for one of our users recently. Have just had my request for AAD Premium approved so should be able to have the Bad Password feature up and running soon

Microsoft of course will sell you Azure AD Password Protection, which is yet-another add-on product requiring Azure AD Premium https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises The whole of Office 365 feels like trial-ware these days. You get spam filtering but effective anti-phishing costs extra. Users can self-reset passwords but only with Premium. MFA can be enabled but can't be granularly controlled without Conditional Access, which is... you guessed it... Premium. We're lucky we get the core subscription for free in Edu yet these add-ons still look expensive but imagine seeing this as a commercial customer paying full-price for the base O365 license

Our firewall recognises application traffic so we can tell which one it's from. Also the destination IP often matches up to Microsoft's list at https://docs.microsoft.com/en-gb/office365/enterprise/urls-and-ip-address-ranges?redirectSourcePath=%252farticle%252fOffice-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2

A mix - desktops for staff and in rooms where we can physically get enough machines in for size of class. Once that number goes above 20 most rooms won't take that many students so for those we've gone to laptops.

Maybe but right now they're teasing us with a fix we can't actually apply