gshaw

A bit of feedback on license deployment... The posts above are correct, you need quotes around the account (email address) and password for the batch commands to work Don't use funky characters in your Unity account password, I kept getting HTTP 400 errors in the log file with account login errors until I removed them Log file in %LOCALAPPDATA%\Unity\Editor\ is your friend watching the activation process for errors Activation direct connects to the IPs below, haven't experimented with the environment variables yet to see if it makes this process work correctly with proxy, have added an SSL firewall rule to allow these out for now 23.38.61.62 a23-38-61-62.deploy.static.akamaitechnologies.com 35.192.189.147 147.189.192.35.bc.googleusercontent.com 153.20.205.35.bc.googleusercontent.com 35.205.20.153 Just tried adding the environment variables, seem to make the "Resources" section work so looks to take effect. The strings below set a machine wide environment variable that should persist between reboots \ users setx /M HTTP_PROXY http://x.x.x.x:yyyy setx /M HTTPS_PROXY https://x.x.x.x:yyyy (replace x and y with your proxy address and port respectively) Upon testing the proxy seems to work in Unity itself for downloading resources but not for activation it seems

About time they sorted that Settings Page Visibility GPO, does that mean there should be a new ADMX released as well?

Just received our Educational Pro licenses, happy days

Agree with most of that but no problems with Start Menu \ Taskbar provided: a) you use local profiles not roaming b) you ensure that the XML headers for the layout file are formatted correctly (there's two schemas for Start Menu and Taskbar that both need to be there) I created a new GPO for Windows 10 customisations so we could test with just those running and layered on top of existing Windows 7 settings. Apart from removing my old Start Menu pin scripts not found any clashes but again it's all about how much you test it and what your old GPOs are doing. Wholeheartedly agree with the poster above about the OneDrive updater, absolutely stupid to have it running from AppData and not be managed by WSUS. However Files on Demand is awesome and effectively gives all our users 1TB Document folders

We got the E458s cheap this summer, look pretty solid so far, TPM included and better than the A-Series models, which actually have lasted well for us (A544). Proper driver pack support on the E-Series as well vs. roll-your-own method on the lower end kit. Much better than the Lenovo V110 garbage from a year or so back (ironic really given Lenovo recently bought out the Fujitsu desktop PC business) All that said if you can stick to Dell or HP Probook kit then do (avoid the cheapo consumer 250 G6 though, plastics were very brittle on that)

Thanks @Arthur have emailed her, fingers crossed as those 1080 cards need something to put them through their paces

Did anyone hear back from Unity after requesting an Educational Grant? Not had anything back from them either way so stuck in limbo at present.

Similar amount of testing here (initially 1703 but mainly 1709) with Education. OneDrive Files on Demand makes the switchover to 10 worthwhile so LTSB was never on the radar for us. About 2500 machines done now, couple of hundred left, mainly staff machines but people are actually requesting the upgrade so must be doing something right Lots of changes and new GPOs, scripts to remove the crud etc. We also rebuilt most of our software packages around the same time so pretty much everything is fresh. The main gripe I have with 10 at the moment is the removal of "Update and Shut Down" as that suited us in terms of how machines are used. Going to have to try scheduled installs again and see what happens...

Automatic Approval for Critical Updates, Security Updates, Definition Updates With the constant churn of security issues I remember reading guidance (possibly from MS themselves) to patch asap. Also need to look at a reset of the WSUS cache soon as it's hit the same 350GB from years of XP updates, Office 2010 etc. no longer in use but eating up space. At some point will run wsusutil.exe reset and let it repopulate with the legacy items unticked.

Cumulative seem to be the ones that are installing from WSUS (auto-approval for anything Security \ Critical so in theory could get either) The bigger problem is the lack of control of installing updates on Shutdown that I think may hurt us soon (used to have scheduled installs but took those off after issues during the day)

If it's direct IP traffic it won't go out via proxy, we get this with some parts of Office 365 and had to make a dynamic rule to allow it out directly.

@arjanver GPO Deployed Printers rather than Preferences, you can't set the default (I use a logon script for that) but it does the mapping at machine level and seems a bit more stable under 10 than GPP

Works on 1709 here but we do install the .NET 3.5 Role as part of the MDT imaging process

Are you mapping with GPP? Try the old-school GPO Deployed Printers route and see if it's more reliable - certainly was for us (on 1709)

For us it was Files on Demand in 1709 that was the game changer. We've been migrating users to OneDrive for a few years now and with 1709 gone from clunky browser uploads and file management to the File Explorer based method we wanted all along (without having to use that horrible WebDAV mapping method or third party software) Also on the security side Exploit Guard (aka Win7 EMET) was also a nice addition. Our initial batch of pilot machines did have 1703 on when we first started testing but always knew 1709 would be the one for our full deployment. 1803 was too close to deployment time for my liking and heard that stuff like Start Menu layouts etc. didn't work without recreating them plus there's that weird Google Chrome browsing issue I've read about on here. Very little feature benefit to 1803 over 1709 so risk vs. reward didn't stack up. Will start looking at 1809 when it gets released and testing the update process with that. Will try a few machines via WSUS and others straight reimage (nice and easy as I use thin image build so just need to swap out the WIM once MDT / ADK gets updated)

That's no bad thing, testing for that long allowed us plenty time to find any oddities with 1709 (fortunately not too much) and get new features running smoothly (Files on Demand with SSO, Start Menu etc.) The monthly Cumulative Updates should be addressing the security threats. Some new security stuff does appear on the newer releases but unlikely to be urgent enough to require jumping versions. Have you seen how many threads there are with 1803 issues? I'm glad I resisted the urge to gamble on it this summer. Also just spent days troubleshooting the MDT Task Sequence I've been using all summer because something changed in the recent batch of updates which broke autologon (related to a client we install part-way through). Even when things don't appear to be changing much they still are underneath.

Yup exactly what I've found but ours are fully against the machine as printer mappings are location based (with a global Follow-me MFD printer for Papercut)

It's better to test for 6 months on the xx09 release and deploy that rather than chancing your arm with it as soon as it's released. So glad we stuck with 1709 having read of all the random 1803 issues people are experiencing.

False alarm on the Cumulative Update - testing with 2018-07 made no difference so went to the only other thing that had changed recently... Impero Client update It appears if there's a Restart step after the Impero Client is installed it sometimes breaks the login screen. Moved it to the end of the TS just before machine finishes the deployment and grounds for cautious optimism so far. Not sure what's changed in 7.1.32 installed (seemed to notice it on the earlier 7.x.xx as well) but beware if it's in your MDT Task Sequence.

The old adage still holds firm then... "it's usually DNS"

Noticed our MDT deployments have been hitting issues in the past week or so, which seems to coincide with the release of the 2018-09 Cumulative Update. The WSUS stage seems to install the update happily enough but upon reboot instead of automatically logging in as Administrator it gets stuck with a strange login screen showing: Administrator Email address or phone number (text field) Password (text field) No combination of entering password manually will get it back and only able to restart an MDT deployment by running diskpart > select disk 0 > clean and starting a new deployment. Have just Declined the 2018-08 update and running a few more images with only 2018-07 update enabled, which deployed fine to 2000+ machines over summer. Anyone else seen anything similar?

What is DNS configured to on the NIC?

There's plenty I would've been using for 2-3 years now but when your EES costs £20k and AAD Premium \ EMS was £10k on its own due to the per-user instead of FTE model it becomes very hard to justify. We've had to use a different password self-service instead and InTune has been on my wish list for a long time now. One day, one day...

@free780 you paid the MS tax for AAD Premium then? Came out silly expensive for us with the per-user pricing @abaxter2 what exactly did the Hybrid Join entail on clients, was it pretty much automatic? At the moment we're using a Centrify SaaS cloud-based ADFS-esque solution, which does SSO for everything apart from the Windows Store (which seems generally pretty shoddily implemented but we'd need to migrate to SCCM to be able to deploy the Modern Apps directly to clients). For the OneDrive client you need to make a couple of registry edits as per https://gshaw0.wordpress.com/2017/11/08/onedrive-files-on-demand-first-steps/

@kcutetea shared via print server i.e. UNC path