v01d

Make heavy use of AppLocker's 'audit' policy so that you can test thoroughly before implementing it and when making changes going forward. That should provide you with enough of an idea if issues suddenly crop up along the way.

Just confirming your issues that I have also had issues with VLC not playing DVDs in Windows 10. I've transitioned to PotPlayer now which just works.

Glad I'm not the only one that has been combing each update's release notes for a fix to this ridiculous issue that should've been well and truly fixed by now.

Are you using MDT?

Yeah, this. Not that I've ever really needed it, but out of habit I always take one of each new device we get and use MDT to capture an OEM image, using the model as a name, which I then store for safe-keepings.

Thanks for your effort and communication Raisin! One less thing to have to stress about whether it'll ever be resolved or not.

If they are going to require us to keep a shorter life-cycle for the OS build before we need to move to the next release, then they really need to get their act together, get all of it together, put it in a box and make sure that basic things like start layouts actually continue to work consistently across the builds. My end-users having to deal with regression issues because the QA at Microsoft is a joke genuinely makes me angry.

May 2017+ updates will be listed as... YYYY-MM Security Update for Adobe Flash Player for Windows for x-based Systems (KB<#>) Older pre-May 2017 updates are listed as... Update for Adobe Flash Player for Windows for x-based Systems (KB<#>) If you click on "Search" on the right-hand side of the WSUS console you can type in "Update for Adobe Flash" to see all the updates (approved/unapproved/declined etc...) visible on your WSUS server currently.

To go along with the above tips, I would also recommend using the following maintenance script to keep things nice and clean. https://community.spiceworks.com/scripts/show/2998-adamj-clean-wsus

Create a registry entry under Computer Config -> Preferences -> Windows Settings -> Registry Keypath: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced Value name: LaunchTo Value type: REG_DWORD Value data: 1

Same problem here. 1. Log in with a new domain user (local profiles, not roaming) and the calculator UWP app works fine. 2. Log out and log in as an admin user and delete local profiles. 3. Log back in again as the first user and trying to run the calculator app comes up with the dreaded "You’ll need a new app to open this calculator" message. If I right-click the calculator tile in the start menu and run it as an administrator it'll actually start working again. Still, this problem affects all deleted profiles, whether limited or local/domain administrator. I hope there's a fix soon.

This made me laugh way too much, way too loudly and for way too long than it should've.

I noticed this issue when doing a client upgrade task sequence from 1703 to 1709. While yet to test my theory, I wonder if it is the winapp removal script I'm running after performing the OS upgrade causing the issue. It's not entirely consistent who it chooses to impact, which is always nice. To resolve the issue, I run the below command in a powershell script ...

That. Not even a question. Thats the whole point of taking a snapshot pre-sysprep command.

This is how I picture you when reading your nightmare dealings with Win 10 and the prospect of more nightmares to come with every new build http://2.bp.blogspot.com/-1cOmrnB2bDo/UF9P0q1yZvI/AAAAAAAADIw/4jwAmABdj6g/s320/Vince-McMahon-distraught.gif Having to finally delve into Win 10 deployment myself. Fingers crossed I don't end up the same!

Have you moved away from ZENWorks entirely or just for your image deployment?

'Lovingly' referred to as Bring Your Own Disaster here.

If its of any use to anyone, I've quickly knocked up a console app that will disable selective suspend on the currently active power plan when run. I've attached the Visual Studio project which includes a compiled binary in the "Disable Selective Suspend\bin\Release" folder. Wouldn't be hard to convert the code to VBScript and its easy enough to accomplish in powershell as well. Disable USB Selective Suspend.zip

Without knowing the sheer amount of custom power plans you have created, you could just opt for a kludge method of setting those powercfg attributes for each of the custom power plan GUIDs you have in a startup/logon script. Unless, of course, you are able to target specific groups/OUs of machines that have a common custom power plan. Outside of that I'm afraid I can't offer an easier alternative in your case. Edit: Since I'm on holidays at the moment (yay!) I'll do some tinkering in Visual Studio to see if I can knock up something to handle this scenario of various GUIDs.

You can use Windows' inbuilt powercfg tool to disable it as an alternative. Typing powercfg /L into a console will list all the power plans available on your device, as well as highlighting which one is in use. The default power plans and their corrosponding GUIDs are: GUID: 381b4222-f694-41f0-9685-ff5bb260df2e (Balanced) GUID: 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c (High performance) * GUID: a1841308-3541-4fab-bc81-f71556f20b4a (Power saver) The asterisk indicates the currently selected power plan. With your active power plan GUID in hand you can then run the following command(s) to disable selective suspend. To disable selective suspend on plugged in laptops/desktops: Powercfg.exe -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0 To disable selective suspend on laptops running on their battery: Powercfg.exe -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0 ███ -- AC = device is plugged into mains, DC = device is running on battery ███ -- Specifies the power plan GUID you found via powercfg /L ███ -- Specifies the USB settings GUID within the power plan ███ -- Specifies the USB selective suspend options within the power plan ███ -- Specifies the boolean value to disable selective suspend (1 is to enable selective suspend) Hope that helps as an alternative.

I'll reply again once I get to work in roughly a bit over an hour with more H3C/HP web gui pictures giving a (hopefully!) clearer breakdown of what to do, unless of course someone replies before me. EDIT: OK, I'm not sure which version of the interface you have on your switches, so I've used one of our H3C switches. If its a HP web gui I can also do one for that as well if the need is there. Firstly DON'T enable Edged Port on trunk ports connecting your switches. STEP 1 Back up your switch configuration! and perform these steps when any potential loss of workstation connectivity won't cause knuckles at the door/screaming on the phone. STEP 2 Enable MSTP on your switch if it isn't already enabled by logging into your web gui and going to Device -> MSTP -> Device Setup tab Change STP to Enable Change Mode to MSTP Click Apply STEP 3 Enable Edged Port on your switch access ports connected to desktop PCs by going to Port -> MSTP -> Port Setup tab Select all access ports connected to your desktop PCs in the selectable port diagram, making sure not to erroneously select any trunk ports Change the Protection for the selected access ports to Edged Port Click Apply Reboot a workstation connected to one of those ports and see if your IP address issues persist. There is more to MSTP, but that is a pretty basic set up for now. Essentially what setting Edged Port does for you, if you don't know, is allows the port to go straight into forwarding mode, which circumvents the 30-odd second listening period ports would otherwise observe before being able to process normal network traffic, which is a cause for workstation IP address issues on boot-up.

With regards to end devices, make sure to set ports connected to end devices (essentially any device that isn't part of your spanning tree switch topology) to Edge Port. This will remove the delay in PCs getting an IP address on boot-up. http://h20565.www2.hp.com/hpsc/doc/public/imageServlet?DOCID=mmr_kc-0118675-5/MMA01_0131739.JPG

This is controlled by the setting under Internet Options -> Advanced tab -> Security sub-section -> Warn if changing between secure and not secure mode Un-ticking that will prevent those pop-ups globally. That can be pushed out with a GPO through User Configuration -> Preferences -> Control Panel Settings -> Internet Settings as an Internet Explorer 10 profile.

To update my last post I have finally got the global HTTP proxy working. There seems to be an issue when I configure both the global HTTP proxy as well as a Wi-Fi profile with the same proxy username and password within Apple Configurator. As soon as I remove the Wi-Fi profile, but keep the global HTTP proxy username and password filled in and connect to our Wi-Fi manually the global HTTP proxy takes effect and I am not bothered with authentication pop-ups even after rebooting the iPad. Whereas with the Wi-Fi profile configured the proxy password would vanish each time the iPad was rebooted and I would be asked to authenticate to our proxy server continuously.

Sorry to bump an old thread, but has anyone come up with a solution for this? I've been using static IPs on our iPads in order to get them online through our proxy, but it would be nice to have the proxy username/password working again.