Fazza

Can you post a screenshot of what you mean as when I disabled Cortana via GPO it went completely?

Not all your servers, but I'd strongly advise you to upgrade all your DCs to 2016 as the latest Server 2016 and Windows 10 1703 are part of the same 'family' of operating systems which is why you also need to get the 1703 version of the Group Policy files and install them on each server or place them in you centralised group policy storage folder. In our experience some Group Policy settings simply don't work or partially work. This is what we did to resolve that issue. Whether both things made them work or just one I don't know as we did them both at the same time. All I can say is if you upgrade your DCs to Server 2016 and the domain functional level to the same it works. It took around 40 minutes to upgrade each DC and then a few seconds to upgrade the functional level. So far, a lot of the 'issues' reported on EduGeek by people who have not done this have worked OK for us.

You need to be on Server 2016 with the domain functional level at 2016 else the Group Policies wont work - at least this is my experience/understanding. We upgraded our DCs to 2016, upped the functional level to the same and then the Group Policies work.

Just received this in the post this morning so thought I'd video it and share it with you! https://youtu.be/6y_tHjPK9mk

Sorry for the double-post but I've just created a new Group Policy with the following settings in it: A quick GPUPDATE/FORCE and 1 reboot later and Cortana has disappeared from the taskbar and cannot be found on the start menu either so I can confirm that the group policies do work. What server OS are you DC's? What is your domain functional level? Are you using the latest (1703) Windows 10 Group Policy files (admx files etc.)

We don't. There's a Windows 10 Group Policy for disabling/removing it (if I remember correctly from the other week when we downloaded the updated admx files) as we couldn't think of a reason to disable it so left it enabled.

I think that's the best way of describing the real purpose of LTSB is for that I've heard so far

I've just checked on my test student build and the icon isnt there so you need to look for a Group Policy settings to remove it. I've not personally added it to my new Windows 10 Group Policy so it's getting disabled by a previous group policy we already had in place as we remove the icon from Windows 8.x (and previously Windows 7) using this method.

There wont be very frequent updates of the LTSB versions as that was one of the ideas behind it. What bloat are you trying to remove? If you mean default windows apps you don't want to have in your build then you can use the following powershell script to remove the ones you want to remove: # Get a list of all apps $AppArrayList = Get-AppxPackage -PackageTypeFilter Bundle | Select-Object -Property Name, PackageFullName | Sort-Object -Property Name # Loop through the list of apps foreach ($App in $AppArrayList) { # Exclude essential Windows apps if (($App.Name -in "Microsoft.WindowsCalculator","Microsoft.WindowsStore","Microsoft.Appconnector","Microsoft.WindowsCommunicationsApps","Microsoft.WindowsSoundRecorder")) { Write-Output -InputObject "Skipping essential Windows app: $($App.Name)" } # Remove AppxPackage and AppxProvisioningPackage else { # Gather package names $AppPackageFullName = Get-AppxPackage -Name $App.Name | Select-Object -ExpandProperty PackageFullName $AppProvisioningPackageName = Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -like $App.Name } | Select-Object -ExpandProperty PackageName # Attempt to remove AppxPackage try { Write-Output -InputObject "Removing AppxPackage: $AppPackageFullName" Remove-AppxPackage -Package $AppPackageFullName -ErrorAction Stop } catch [system.Exception] { Write-Warning -Message $_.Exception.Message } # Attempt to remove AppxProvisioningPackage try { Write-Output -InputObject "Removing AppxProvisioningPackage: $AppProvisioningPackageName" Remove-AppxProvisionedPackage -PackageName $AppProvisioningPackageName -Online -ErrorAction Stop } catch [system.Exception] { Write-Warning -Message $_.Exception.Message } } } Add or remove the relavent apps in the # Exclude essential Windows apps sections and bobs your uncle! We run this as part of an SCCM task sequence when we deploy a new Golden Image and it works a treat

You can contact HP Support here I believe: https://support.hp.com/gb-en/contact-hp

Like others have said, SCCM is a very clever bit of software and there are some prerequisite checks you could do but to be honest, I dont bother with that. I just silently deploy software out to the relevant computers and if it's already installed then the silent install will simply overwrite it etc. The clever thing is that once pushed out to a computer via SCCM, it wont do it again as it will have recorded that it's been installed. It's the same if you use the Software Center, once you've installed something via the center then it's listed in the installed section so you can't install the same thing again.

I'll never understand the logic of this sort of thing. Children will be learning to use old antiquated software on new IT kit which doesn't make any sense to me. On old kit maybe, but on new kit the latest possible OS should be used so they can learn how to use the latest OS.

Have you in any way edited the .xml file? If so this could be your issue. I tested redirecting a W10 start screen the other day for the first time and found it worked perfectly until I tried to add/change anything in the .xml file and after removing my changes it reappeared.

They don't want our money as they ignore all emails and phone calls! Very strange company to do that.

This is a good start for you: https://www.systemcenterdudes.com/sccm-2012-version-numbers/ Not sure if you can still get the 2012R2 version of SCCM on the Volume Licensing site as that's quite old now. 1702 is the latest version that we're on so unless you have a specific reason to go to 2012R2 then I'd suggest going to this version instead. From what I understand to get to the latest version you need to get 2012 to at least the 1511 version first and then you can upgrade to 1702.

I guess that's the difference between having a backup line or a backup ISP. It's like having a spare mobile phone on the same network, if one phone breaks then great you can still make a call but if the 'line' goes down as both devices connect to the same place you'll be without a service. When we used to have a backup line we chose a completely different company to that of our main ISP so if the line and/or data centre went down we did have a workable (albeit slower) connection.

What did you do to try and make it just 3 tiles wide?

Just exported my first Student W10 Start Layout and created a new group policy and it worked first time so it sounds weird it's working in some places but not others as we all download the same ISO file and admx files. All I need to do now is see if there is a way of making the layout just 3 tiles wide rather than 2 lots of 3 as that looks messy...

I assume you've tried bunging your test PC in a test OU and blocked inheritance of Group Policies and then just applied a single GPO with just the lock screen configured?

Not got one myself, but I was looking at the 65” Benq RP653 the other day, I think they come in at around £1800.

https://www.meshcentral.com is where you get an installer from. You will need to read the instructions to understand how it works. After creating a log on for the website, you need to create a mesh for each site and then download the config file and save it with the installer and then when you install it, it will automatically join it to the mesh that the config file is for. You create your mesh (basically a group) via the MeshCentral website.

I think it's a perception thing as if we had 1 min 30 second logons on all our computers our end users would say "blimey these are fast" - to us 1 min and 30 second log on times are extremely fast and 10 minute log on times are slow. If you consider 1 min 30 secs to be slow what do you consider to be a fast logon?

Most .exe and certainly .msi files tend to have a silent install option so you can deploy via a logon script etc. or using something like SCCM where you can add them to a task sequence when deploying an OS. Some times it can be a bit of an art form as if a poorly written .exe has been used by some random software house it may not be obvious what the silent switches are.

If you just want to be able to Remote on to one from the other then use the Intel MeshCentral service. https://meshcentral.com/ It's free and we've been using it for years now and it works really well.

I'f I'm reading that right we've had a narrow escape! Sounds like the laptop was infected but because they had in effect turned their servers off it didn't get an encryption key to enable to encrypt the laptop.