Warwick_Tech

This is the only thing that concerns me is the software restriction policies - we use them for GDPR to control USB sticks; Hopefully these won't be removed in future updates, but will anyone listen if we use the feedback hub?

We have mixed test users - some on 1709 and some on sharepoint drive mapping; We found the 1709 test users with FOD experienced the regular sync issues, files not updating, going live etc. so we moved them to drive mapping instead hoping it would be a lot smoother (It was apart from this security issue) I'm assuming there's a GPO to enable FOD by default, however this would only work for us with new users - old users still have everything synched and they never send the files back to the cloud manually....

Hi All, We're experimenting with Sharepoint drive mapping and I've gotten it working with the usual commands; But every so often it complains it's not in the site to zone assignment list - According to Microsoft this is a 'feature' https://support.microsoft.com/en-gb/help/2616712/how-to-configure-and-to-troubleshoot-mapped-network-drives-that-connec And the solution is to visit the site, which works great until they logoff or timeout. I've tried to add the sharepoint site to the zone list, but it's always an invalid entry, even with wildcards - I have https://DOMAIN.sharepoint.com as trusted, but this doesn't seem to filter down(?) Has anyone had any luck with bypassing the lockout?

If you 'lock' the apps via app locker they will not be uninstalled, but not load for new users either until 'unlocked' Blocking built-in apps in Windows 10 using Applocker – CCMEXEC.COM – Enterprise Mobility but 2 things to be aware of; you need to edit the policy on a PC that has the apps installed (Use RSAT if your server is below 2012) https://www.microsoft.com/en-gb/download/details.aspx?id=45520 and second when an app locker policy is in place, a lot of PC's will continue to block the apps unless specifically set to 'allow' - Even if the GPO is removed and updates forced.

Dear All, On our machines that have upgraded to 1709 by themselves (Thanks Microsoft) they work ok, but there are issues with Apps that have been removed via powershell now appearing back on the start menu, but with only their App ID and a blank box; Pending a google search which is next has anyone else discovered this 'feature'? If you run the removal script again the same occours. Regards,

The only issue with only whitelisting for WSUS is as I understand the Store doesn't get it's updates from there - Even if you turn store updates off they still download (??) Our solution was to release the updates via whitelist wholesite so store updates could install and still use WSUS and 'search windows update' for PC's The Store updates are now working across the site, so the theory is the pipe will slowly clear as all machines update their store apps, at which point we can turn off bandwidth limits and Smoothwall will have the HTTPS Range Requests implemented.

Ok, so here's what I've been informed by Smoothwall - The issue seems to be caused by the lack of support for HTTPS Range Requests on Smoothwall UTM's - This is being resolved in the next update, but there is no ETA for this. The 'fix' for now is to just whitelist all software updates to bypass the smoothwall, but we have yet to see if this works when you disable the policies put in place suggested by LemonEntry Long story short, smoothwall are working on a fix for something Microsoft have done - But if anyone has any solutions in the meantime make sure to mention them, but it may be difficult as we all have different configurations on our boxes.

Thanks for this - We have disabled all updates and will wait the 24/48 hours (we're seeing minor fluctuations in speed) On a side note we have also disabled the Windows Update Service and the MSStore - Turn off Automatic Download and install of Updates - Turn off the Store Application the only thing is we use device manager to download the latest drivers and I'm not sure that will now work - but it's a case of going through bit by bit until a balance is found.

Sounds like AppLocker is blocking the apps from launching, but not from being displayed - With the powershell script was it for all users or just admin, as there are different commands for each - For example (To remove 3D Builder app from current account only) Get-AppxPackage *Microsoft.3dbuilder* | Remove-AppxPackage (To remove 3D Builder app from all current accounts on PC) Get-appxpackage -allusers *3dbuilder* | Remove-AppxPackage (To only remove 3D Builder app from new accounts created afterwards) Get-appxprovisionedpackage –online | where-object {$_.packagename –like "*3dbuilder*"} | remove-appxprovisionedpackage –online Also be aware each update version comes with new apps and older apps are depreciated, so 3D builder was removed in 1709, but if you're upgrading from 1607 it will still need to be removed.

Hi LemonEntry - I've been tearing my hair out over this issue for a few weeks now http://www.edugeek.net/forums/windows-10/190764-windows-store-updates-stuck-cannot-install-apps-high-traffic.html do you have a breakdown of what you did to resolve this? I've turned off store updates and changed 'download modes' but with no joy - Do you have special rules setup on your smoothwall? thanks in advance

Metro apps like Edge, Photos, Maps etc. will all use Microsofts bespoke XPS driver to print, not the driver from the print server - We had the same issue where prints would dissapear but after an update they became jammed in the system and wouldn't delete until the print spooler was purged - I believe the solution was to disable the policy 'Always Render Print Jobs on the Server' Computer > Administrative Templates > Printers Knowledge article here: https://www.papercut.com/kb/Main/Windows10Printing

Smoothwall are escalating it to second line support - Isn't it always the case a fix is 'coming' I also forgot to mention above I've been experimenting with this GP to see if there's any difference

Dear All, Following a few threads on here and so far no luck - We are seeing a huge amount of traffic to; tlu.dl.delivery.mp.microsoft.com and windowsupdate.com, so we applied a bandwidth cap, but this only treated the symptom, not the cause; so after rooting around I've found every machine on our network has stuck windows store updates (at least 4-5 downloads in progress) When you bypass the Smoothwall they download fine, however no matter what I try, transparent, no authentication, they refuse to continue if directed to the smoothwall box. How the internet is setup - Staff take their devices home so we use a proxy.pac file and 'Automatically detect settings' on IE via Kerberos tickets. Students have store and updates deactivated by GP Things I've tried - Adding Microsoft addresses to the proxy.pac bypass Added all Microsoft addresses to HTTPS Bypass, No authentication etc. Prompt to transfer IE settings to windows (netsh winhttp import proxy source =ie) always reports as correct, or transparent Setting proxy in GPO for Metro Apps Symptoms - Store opens fine, with our custom store as an option, but any new App or update will grind to a halt and consume bandwidth I know there are a lot of options out there, but I'm not getting anywhere fast - I also know a lot more people are experiencing this. Wierdly I remember the store working before fine, but only in the last 6 months or so this has happened on 1607 and 1709

Microsoft have done it again! After waiting ages for files on demand it doesn't work the way we would all like it to - You still have to sync and it will automatically download files you click on, but you have to manually remember to send them back to the cloud with a right-click or they stay on the HDD - Not ideal for students and staff who are not all tech savvy. Come on Microsoft, just map them like old fashioned drive maps(!) https://support.office.com/en-us/article/Learn-about-OneDrive-Files-On-Demand-0e6860d3-d9f3-4971-b321-7092438fb38e

I've been told uninstalling .Net 3.5 then running the upgrade, then re-installing fixes some bombing issues - but again leads to not being able to install 3.5.....

So it seems 1709 has an issue with installing .Netframework 3.5, both from windows update via commandline and control panel - I have yet to try from SOURCES but as I use .WIM files exclusively I don't always have access to these. My usual line; does nada, returning 0x800f081f Anyone else experiencing issues with this on 1709?

we dropped Delprof2 when it didn't work consitently for our windows 10 machines, Instead we use a powershell script set to run on shutdown ; And it seems to work with corrupt profiles too.

Hi All, I've noticed something strange with our deployments, whenever a new machine is built it copies the folders (but not the contents) of the entire Scripts shared area to System32 This isn't a big issue as a few extra folders won't cause any harm, but does anyone have any insight as to why this is now happening? It's only a recent thing (last few months) but the timespan is too old to pinpoint a specific cause. I've been through group policy and task sequences/scripts but can't spot anything that could cause this behaviour.

Ironically the creators update has caused this issue on our machines, as well as a myriad of other problems, cosmetic mostly but still frustrating. I believe it is linked to the on-board apps, but how/why I'm unsure. I tried force deleting profiles to generate new one's each login to ensure no corruption, but it's still hit and miss.

This GPO will remove the shares, but beware you will no longer be able to browse via run command, e.g \\suitePC-001\c$

This GPO will remove the shares, but beware you will no longer be able to browse via run command, e.g \\suitePC-001\c$ [ATTACH=CONFIG]41908[/ATTACH]

The new login screen background is the 'lock screen' Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization. [ATTACH=CONFIG]41906[/ATTACH] Also worth noting you can't change the 'blue' colour unless you change the themes inside windows. This also only works on the anniversary update as previous versions of W10 force you to have the 'Hero image'

The new login screen background is the 'lock screen' Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization. Also worth noting you can't change the 'blue' colour unless you change the themes inside windows. This also only works on the anniversary update as previous versions of W10 force you to have the 'Hero image'

Hey All, I'm having the same issues here with our start menu on 1607 - I've got 'Remove common items' GPO turned on and I'm populating it through a script that copies the shortcuts to the %appdata% start menu folder; but I can't get rid of Windows Accessories, Administrative Tools etc. I've tried hiding the folders but it always seems to repopulate them automatically - Also I can't get the redirected Start Menu to work correctly(!) From what I gather from this thread, if we re-direct the start menu and apply the 'Hide all Apps' GPO this will resolve the issue - However I can't seem to get these two policies working together...

Hi Arthur, Yes - we run a powershell script that deletes the computer profiles on shutdown so it should be a fresh profile each time - I now have the issues of icons not being clickable(?!) on the start menu....