free780

I'm in the middle of a 1809 rollout 230 to go! I'm using SCCM SUP and the update has not expired. The comment where 1909 has caused a headache sounds like the group policy settings aren't correct.

Anyone seen ADMX's yet or do we need to wait for the US to wake up?

I have a mixture of 1607 LTSC SAC 1607/1703/1709/1803/1809 I use SCCM and not had an issue. The SUP deletes and superceded and expired updates.

Has it been superceded?

LTSC is the same as LTSB. Microsoft changed the name. The education version is the SAC version (Semi Annual Channel). There is a fair amount of debate in edugeek about which is best. I think SAC as its widely tested and applications are tested/supported on it. LTSC doesn't have the feature updates but doesn't have the Store apps or Edge legacy. Some applications Adobe, Visual Studio do not support LTSC. Microsoft believe its use case is only for power stations etc. The SAC feature updates take longer that the normal Windows Updates. Righr now version 1903 is the latest with 1909 due to come out soon. This is the complete list of SAC releases: 1507 1511 1607 1703 1709 1803 1809 1903. If your just relying on Windows Updates out to Microsoft at the moment Windows 10 will go to 1903. If you have Pro/Education you can delay the feature updates if you need to.

Have you updated the SSU before the CU?

Yep upgraded/migrated over half our servers to 2019. No issues and Windows Update is fast. Had the odd server lose domain membership post upgrade but ghats easily fixed. I did the FRS to DFS migration using Ned Pyles blog post. The key thing was parience.

I had this with some software in the past. Make sure you are using the fqdn in your server name not the netbios name in the working directory.

Have you updated Photoshop with RUM. I'm assuming you've allowed the Adobe domains through your filtering unauthenticated. I'm of the view say no to LTSC as Adobe don't support it and Visual Studio isn't supported. You could test on SAC and see if you get the same issues.

Well on the AzureAD side there is now an auto user creation tool. Other than that you have to use the user sync tool (on a server) . It's a python script that can do LDAP or import a CSV you can automate with a scheduled task.

Have you tried fiddler/smsnif/wireshark/windows firewall logging?

It's a shame you can't specify 1809 for example. You can get updates to happen out of hours. You can set the policies without the Azure part but you get no reporting.

If you have the bandwidth WUfB will work. If you don't WSUS is better but you do need to maintain it like any other server.

Or Deep Freeze or HDGuatd was in use.

I've been using Edge beta for the last few months. Hopefully it will be GA soon. Integrates with AzureAD very nicely.

Or get a maintaince windows working. Wake the PCs at night and trigger updates. I've also encountered the disable windows updates mantra. If you take GDPR and Cyber Essentials seriously you need to keep current. We are no longer in a world with a static IT environment for the academic year. Windows Updates need a fast ring and a slow ring. Also a medium ring for servers. I recommend going to 1809 not 1903 yet.

Movie maker is EOL and hasn't been updated since 2012. There are free alternatives.

The powershell method will only show the Photos app for new users. You have to run the command in the user context for existing profiles. Its best to set the Microsoft Store for Education. https://educationstore.microsoft.com/en-gb/store Then tie it in to SCCM and deploy to devices. https://docs.microsoft.com/en-us/sccm/apps/get-started/creating-windows-applications#bkmk_provision

Use Configmgr with Hybrid joined devices. It will keep it up to date as well.

I also deploy the latest monthly version. So new features are ready and security updates are complete. As a cloud platform I guess you need to keep current. I have a script that updates my source files to the latest monthly updates and updates the SCCM content.

If you really need to roam the whole profile. Use FSLogix. If it's just favorites then you can usually sync them via a folder or gsuite/azuread account. Roaming Profiles have continually had issues as the user profile service doesn't release them properly. Local profiles are much better. Of course ideally you have 1:1 for students and staff then roaming profiles becomes a non issue, but that isn't going to happen.

1st login is always slower as there are a lot of one time operations. It was similar in Win7 but can be worse in Win10. You can try using a shared mode ppkg.

Click Once is fine for 1:1 devices or if the vendor actually signs the exes. You can allow the exes if signed without allowing all click Once applications. However users will have to launch it themselves or push a GPP shortcut to the start menu to the URL. I only have an older (2016) version of sage. It took a couple days of powershell scripting to get it to silent install. PSF also seemed surprised our finance staff don't have admin rights so maybe it's just something with finance software. If they want it to auto update, just do what chrome does and whitelist the domains needed.

Local profiles with FSLogix but you'll need a fair bit of storage.

I ended up deleting the user account for the device when it was working for us. I'm currently trying the new method on about 100 PCs. The main issue is getting the Hybrid Join and Co management correct. This is a lot better on 1809 but if it fails for any reason you have to delete the device from AzureAD and wait for it to rejoin on the device level which is now supported in SCCM and GPO.