free780

I though all the 3rd party mappers were webdav reliant. FOD seems to work it's just you really need to be 1:1.

Anybody tried applocker? Probably the same result. I supposed you could not block powershell.exe and powershell_ise.exe but sign all your scripts and lock down the execution policy to signed scripts. Not ideal but better than the current situation.

You can't 100% automate (unless you have intune and hybrid Azure as joined PCs) the install but the Windows store has itunes which won't overtake Windows. You may be able to find the driver's as a MSI that you could push out.

I would use the sync client but mapped drives as webdav is a poor experience. If you only use Office you can save directly to SharePoint Online without the sync client..You really need EMS to protect the data. You can lock your tenant to a particular external IP but you'll get pushback as people expect email on the go.

Authentication is part of the design. I think you can create a AIP account using a work account even if your org doesn't use office 365. You can authenticate with Google accounts I believe

Have you checked c:\windows\temp\mprun.log you can see if it's checking against SCCM.

Didn't they change it so the store downloads a Lang pack per user?

You can run powershell scripts but they have to targeted at users. They only run once. In theory you could download aexe from http/s and install via powershell. Microsoft have pitched intune at 1:1 devices primarily and with the idea the user logs in, settings and apps get installed. Rather than IT doing lots of hand holding, per user registry settings etc.

Back to OP. Can you get to https://macserver.org.com from the outside?

It seems more unreliable behind a proxy even if domains are whitelisted. Microsoft do say it's a poor experience for the user behind a proxy. The trouble is we need firewalls to talk to the REST API to keep up to date with the Office 365 ranges and let the IP ranges straight out.

Just asking. Those redirecting to OneDrive is it only on 1:1 devices? The time it takes for the sync client takes a while on 1st login.

Make sure you are using SYSTEM from AD not the server/client that you are running the Group Policy MMC on. Failing that turn on GPP logging.

Android 7+ won't trusted user installed certificates which breaks interception. There was a large thread a few months on the Smoothwall section. If Apple go the same way maybe interception will be a thing of the past unless legislation is passed to add a system root for filters to these devices.

I think you just update the content. Then test a TS.

You may need to update your boot images if the TS is running from WinPE. If from normal Windows you need certificate enrolment setup via group policy.

I used to work at a school which had 1:1 laptops for teachers. Which encountered all the issues above. In colleges however 1:1 laptops seems appealing as 1:1 seems to be the expectation from Microsoft. You also seem to end up with 2:1 as satff need staff room PCs/thin clients (which now become 'my' PC) and the classroom PCs (large amount of profiles). The biggest issue seems to be staff being confident with IT but usb 3 docking stations could make life easier.

Make sure the update source GPO/SCCM config is set correctly. Set a test PC that won't go out to Microsoft for updates. Have you set the client settings?

If you fully invested in Microsoft 365 it's focused on 1:1 devices. You could also get to the point t where you don't need a VPN. Getting the budget for 1:1 will be the hard part. Though you do find 2:1 happening which seems more expensive.

Move away from paper to email etc.

Also check your trusted sites, local intranet zone if using IE.

In a few years all the workbooks will be in gsuite/ofiice365. Then you get encryption and authentication. But yes the risk is fairly low.

Modern apps create a per user, per app firewall rule. After a while on a shared PC there can be quite a lot. I cant see why modern apps need inbound or outbound rules #MSlogic. Create a new GPO. Turn off local merge on all scopes for the Firewall. On a Win10 PC with no GPO applied capture the default policy and export then import into the GPO. Keep the defaults on Inbound Block unless allowed. Leave Outbound not to block. You may want to allow ping file sharing etc. Go through your applications that may need rules. Impero,ABTutor,Exams Software,Skype for Business etc. Some will try and put in a firewall rule. You can copy these blocked rules and import into your policy. Create scheduled task On user logon Runas :NT AUTHORITY\System powershell.exe Remove-NetFirewallRule Any new software that requires inbound rules will need to be in the policy. Obviously test this before putting into production. Be aware theat if you supress Windows Firewall warig the user that its blocked something you may not find out if something is working or not.

Just in case anyone else gets this issue. We have 14 RDS Hosts. This issue has been intermittent. It seemed to be resolved pre spectre patches and then returned. I beleive its when a user changes which host they are on. User profile disks also contribute to this issue. It occured with 1 user with administrator rights logged on so I dont believe its a performance/load issue. When it does happen %localappdata%\Packages only has 1 or 2 folders present. It should have 15. I wrote this script This should correct he issue it needs to run in the user context. Please reply/thank if this resolves the issue for you. I seem to remember roaming profiles on 1607 suffered the same issue.

Win10/Server 2016 creates inbound and outbound rules per user per modern app that is provisioned.

Well.im deep into Office 365/AzureAD now. Probably go for co-management. Still need a maintenance window somehow.