free780

I find it frustrating that they don't allow federation via Saml (AzureAD/Gsuite/Adfs). It would make it much simpler.

Yep the roles seem to be knowledge worker and kiosks. Roaming Profiles, User Profile Disks, UEV exist but seem to be an after thought, depreciated in some cases. I think MS are still headed to a store based model which means 1:1 following the ipad model.

The danger is that education won't prepare students for the real world where Windows 10 1:1 will be the norm. RDS/VDI seem to be 2nd class citizens in terms of Microsoft 365 integration. I can see more on prem moving to the cloud. It feels like IT will be dishing out devices and managing them rather than a heavy administrative role on shared devices. Not ideal in primary/secondary.

What in Windows 10 can't you lock down? Managing Windows is far easier than macs generally speaking.

They get installed into %localappdata%\microsoft\packages if provisioned it is in the Windows Apps folder.

I fixed this today. There's a domain it uses which ends in bing.com. It needs allowing through your proxy with no authentication or https inspection. I'll try and get it tomorrow.

This has been a problem on Semi Annual Channel since 1703 some report using the SkipOOBE in the answer file can skip it according to some. I could never trace the issue.

You'd have to do a Powershell script that provisions the app for all users. But given how the store works I think your asking for trouble hacking about with Store apps. It could get messy unprovisioning and uninstalling (per user) for all users. It would be better to let the store handle the updates.

Policy is a bit faster than a traditional joined PC depending on how much policy you have. Powershell scripts can be run against user/device.

Well according to MS. Imaging is dead. Using Intune is an MDM for Windows. It is heavily aimed at 1:1 devices. I'm testing pure AzureAD joined but more more desktops it doesn't make much sense as they only communicate with the onprem infrastructure. In terms of laptops/tablets which are 1:1 devices which you want to manage when offsite it makes sense. Things such as pushing win32 apps exe/msi were only added in the autumn and Administrative Templates were only added last month (only for AuzreAD joined not Hybrid joined). So at some point it may reach maturity but the notion of a shared device with multiple users seems far from the target use case. It seems to be Kiosk or 1st line workers.

http://www.edugeek.net/forums/windows-10/178589-roaming-profiles-microsoft-saying-bye.html

I like it as well but. It is pitched as a 1:1 OS and at some point that will start to happen in education. Most of the issues are to do with devices being shared which means roaming profiles, fast 1st login etc. I do think with so many edu orgs leaning to Google it could become an issue in terms of preparing students for the real world where G-Suite isn't used as wisely.

You can set the command line for Visual Studio 2017 to the full UNC path and clear the content location. This gets around the cache size issue. However if you have clients that rely on https for content download aka Internet clients they won't be able to download content. You also hit the issue of applications in task sequences with no content requiring variables.

Try looking at execmgr.log I think on the client. Check command lines.

Do you mean you get no display as Unity is launched? There was a bug where it launched but didn't display. Check %localappdata%\Unity\Editor\Editor.log in cmtrace (https://www.microsoft.com/en-us/download/details.aspx?id=50012) You can try using batch mode to apply an offline activation (https://docs.unity3d.com/Manual/CommandLineArguments.html). Is it activated when there is a network connection? Check C:\Programdata\Unity for Unity_lic.ulf exists and file is tied to the VM/PC.

AppEnforce.log on the client is your friend. I know that Applciation with no content fail in the Task Sequence. You can use Variables to workaround this.

https://www.youtube.com/watch?v=Tiy__6ND-tQ&t=

On a PC where it not getting al the updates run this Get-WmiObject -Class "CCM_SoftwareUpdatesManager" -Namespace "ROOT\ccm\ClientSDK" -ErrorAction SilentlyContinue -Verbose Check no updates are pending. This helps if you've set updates to be hidden in the Software Center. Check which updates are installed. Get-WmiObject -Class Win32_QuickFixEngineering Check that for example on 1709 KB4477136 which is the SSU is installed. If not check that your deployment that is targeting the PCs has the SSU for 1607/1703/1709/1803/1809 . This gets updated quite regularly and if you remove updates from SCCM once they are superseded you must deploy the latest. They are classed as security updates. If the SSU is not installed the WU Agent will not install the CU. So you have to approved say the 2019-01 CU and SSU within 4 weeks of patch Tuesday/Wednesday otherwise you fall behind and risk older updates say from Nov/Dec being superseded. After the SSU is installed a full Software Updates Cycle must happen for the CU to installed. Looks like KB4049411 may have been pulled but it hasn't been superseded. TBH I'd move away from 1607 as support ends in April.

Sounds like the latest Servicing Stack Update hasn't been deployed or the Windows 10 updates have been superseded already.

JAMF=Large outlay for training Mostyle=Requires an inbound LDAP connection for ad authentication. Profile Manager=Should work but can't deal with large ad user groups. Intune=Very basic management. It's so hard compared to the Windows side as a mac aimed at users who are technical and a 1:1 device.

Basically an allow rule for Microsoft signed exes.

1:1 devices are the future and updates are more regular if not stopped by IT. That's the MS mentality anyway.

Hmm improving staff IT confidence would be a start and maintaining a culture of continous learning and doing would be a start. I don't want to hear "I'm not very good with technology" this year. It's 2019 adapt to the times.

That's weird 1709 has been rock solid where as 1803 seems to have all sorts of issues.

Yep it won't use the proxy configured for IE. You can force out the file VIA GPP.