free780

I had this. Try not use the everyone group. Use students, staff or domain users.

Laptops are a pain. From.the MS perspective the user should initiate the upgrade. However most laptops are shared. The only way I can think of doing it is to make them go into standby and wake at night to upgrade.

I've automated deleting per user firewall rules and first login is 37secs (i3 SSD). Also have a firewall policy with nomerge which seems to speed it up.

Yep Device activation works but only officially supported in the US. Shared Activation works as well.

Time t move to Office 365 Proplus?

You can configure a password if no tpm is present.

I'd leave 1803 for a while. The autumn update usually has the new features.

You need SCCM. Test. Go slow get policies correct. Update admx, Make sure you have an image and task sequence for reimaging. Run compatibility scans using a Task Sequence. The first upgrade cycle is the hardest. You'll find software you need to deactivate/uninstall for sucessfull upgrades. Find a method for waking PCs out of hours and keep an eye on how many 1703,1709,1803 you have. Accept you'll never get to 100% 1709 etc.

SAC 1709. LTSC in a few places but starting to be pain especially server 2016 stuck on 1607. The main issue with upgrades is 3rd party software lagging behind.

Use 1709 use the sync client. Better performance.

Or wait until a school/college gets fined heavily. Then maybe it'll be taken seriously. A bit like keeping up to date with patching before and after wannacry.

It does seem like MS has clusters of servers for everything. They can update them in an automated fashion with no down time. They probably have automations to rebuild servers if an update breaks them Not so in the real world. Usually the client OS is patched first. Shame they couldn't have included the registry setting in the update and then switch it next month.

Microsoft need to make Edge great again.

So by default OneDrivesetup.exe runs as the user and checks for updates. If OneDrivesetup.exe is up to date it starts OneDrive.exe. On the first login for a user. So set the GPO options and test aslong as you have SSO configured, ADAL should kick in if the registry setting is present.

I've got a server downloading the latest client and copying to each PC in c:\windows\syswow64. You cant get away from the per user updating. Several enterpise folks want the updates adding to WSUS. Shared devices are an after throught for the sync client. Then for the client Use it in a scheduled task as SYSTEM. Of course test in your environmnet first. Your servers need 80,443 outbound no proxy.

Seems to be fine. I think the main issues are caused by not allowing all the Office 365 domains staright out. Proxying that amount of persitant connections is bound to cause issues.

It's a registry entry. Unless you have a always on VPN or intune etc you can't push out the registry key. I'm assuming you own the laptops and standard users. Reg key requires admin privileges. reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /f /v AllowEncryptionOracle /t REG_DWORD /d 2

Well this is where encrypted email is required.

If you have Windows Update for Business configured or co-management you can delay quality updates.

This is why you have a pilot/test/guinea pig groups of PCs.

https://docs.microsoft.com/en-us/windows/application-management/remove-provisioned-apps-during-update?WT.mc_id=twitter Glad I remove apps as part of the deployment TS.

The source shortcuts need to exist in the same place as PC1.

If it's recorded in registry or wmi it might be possible to powershell. Again it's doing lots of things to get around people not doing what they are told.

Put the password on a form and email it. I'm sure thats breaking some GDPR guidance.

Run the script as part of the Deploying task sequence.