jthompson

Did you also restart WDS after importing the newly generated boot image? That might have a bearing on it, IDK.

I think that's expected behaviour for UAC when it comes to built-in security groups such as the local adminstrators group. Something to do with explorer not running as an elevated process. You'll find that if you create a custom security group, add your user to it and then give that group suitable privileges on the files/folders in question you'll find that it works as expected.

Perhaps check for any AD replication issues. IIRC the 'trust relationship' error is down the the machine password not lining up with what the DC is expecting from it. That wouldn't necessarily explain the error being seen only after imaging certain machines, though. Does restarting an affected machine (ideally with an ethernet cable connected) clear the error?

I found this list really helpful when rebuilding our domain a few years ago. The first 6 items in the list are relevant here (although the info about LAPS is now out of date as there's a newer, more built-in implementation of it). https://activedirectorypro.com/active-directory-security-best-practices/#limit-domain-admins "domain admin" privileges should only be in play once in a blue moon, for things like promoting or demoting a domain controller. For day-to-day admin stuff like using ADUC, DHCP and Hyper-V consoles, you should be able to not actually need your account to have domain admin privileges. The browse-down model mentioned earlier is interesting, but how well does that fit with wanting/needing access to admin tools when away from your desk or offsite?

I would second the Google Sites suggestion, particularly if your staff have Google Workspace accounts already. That's about as simple as content management is going to get. If you have managed Chrome devices, you could use those in kiosk mode to present it in a nicely locked down way, too.

Whenever we buy a new mattress we seem to go through about 2 or 3 purchase/returns before settling on one. It takes a good few nights for my OH to determine whether it's going to play nicely with her back. Trying stuff in a shop basically tells us nothing more than whether it's worth trying at home or not. Getting a mattress delivered is easy these days, and even the IKEA hybrid things are vacuum packaged so that you can put them into the boot of your car, but getting a mattress returned and out of your house is less easy!

Not using the intl eng Windows ISO is usually the mistake I make.

Menus are often problematic to parse. For instance, "charred red pepper and spinach puree": is the charred red pepper puréed?

It really blew away the existing options at the time. Most of its USPs were the flip-side of Google wanting you to keep all of your messages in perpetuity, which was perhaps why it was so different from the competition. Don't delete any of your messages, but instead use labels, archive, search and virtually infinite storage. I still think it stands to represent the value of allowing employees the flexibility to explore using thier own initiative. IIRC Gmail began life as a Googler's "20% time" project.

Pure speculation this, but I'm imagining the most straightforward explaination is that more than one class/group photo was taken, perhaps owing to some SEND-based logistics on the day, but that has translated really badly into this worst-case-PR disaster.

Oh wow. Yes, I still remember getting an invite. Conversation view, and labels rather than folders, were a revelation. I'm still puzzled by people who don't see those things as 'better' even now.

It's important to distinguish between Microsoft's support of a particular OS version (i.e. how long they will continue to provide updates to it for) and whether Windows is 'officially' supported on particular hardware (e.g. https://www.microsoft.com/en-gb/windows/windows-11-specifications?r=1 and https://learn.microsoft.com/en-gb/windows-hardware/design/minimum/windows-processor-requirements). Although it may well run on older hardware and receive updates (I've had Windows 10 happiy installing monthly updates on machines that don't meet it's stated requirements), Microsoft have been more vocal around Windows 11 not necessarily continuing to receive updates indefinitely if the hardware spec doesn't meet the mark. You're also unlikely to get any driver updates for older hardware, which could have secuirty implications.

It's not so much the deployment of Windows 11 to unsupported hardware, as much as whether those computers will continue to receive updates. At the moment, our oldest models (which are non-UEFI) will install Windows 11 and do receive updates, but I'm assuming that at some point those updates could just quietly stop working, so it's a case of should we rather than can we.

If you're looking into MDT, then I'd recommend using this approach for drivers - https://community.spiceworks.com/t/add-drivers-to-mdt-all-versions-total-control-method/1010345. If you're running both Win10 and Win11, then have a separate MDT deployment share for each, with the Win10 or Win11 drivers imported into their respective deployment share.

https://www.canva.com/newsroom/news/affinity/ Canva has followed up with a pledge to honour Affinity perpetual licensing. https://www.canva.com/newsroom/news/affinity-canva-pledge/ -- EDIT -- Oh, and are also pledging to include Affinity as a free option for schools:

I also have this in my notes too. Later Windows ADKs don't properly detect BIOS, resulting in imaging failures on BIOS-based devices (yes, we still have a few). This hotfix replaces the relevant DLL to fix the issue: https://support.microsoft.com/en-us/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7

These are the tweaks I made after instlling the Windows 11 22H2 ADK (10.1.2200.1) Ensure that deployment shares have x86 disabled in their properties. Create the folder "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs". This prevents MDT crashing out when attempting to create boot images. To fix the scripting failures, modify "C:\Program Files\Microsoft Deployment Toolkit\Templates\Unattend_PE_x64.xml" as per https://github.com/MicrosoftDocs/memdocs/blob/main/memdocs/configmgr/mdt/known-issues.md#hta-applications-report-script-error-after-upgrading-to-adk-for-windows-11-version-22h2. An important thing to not miss here is to update the existing Order value from 1 to 2. After that, you should be able to successfully recreate boot images when updating your deployment share(s). I found that when using earlier ADKs, MDT clients couldn't connect to our MDT database without TLS 1.0 being enabled on the server. We have TLS 1.0 and 1.1 disabled on our servers. The later ADKs, like this one, support TLS 1.2 whereas the earlier ones didn't.

If you're yet to explore a Windows 11 rollout, I'd start on that. That will then tell you whether you have computers that aren't officially supported. At which point you can build a Windows 10 image for them, perhaps based on LTSC to squeeze the maximum support life out of it. We used to use just WDS for deploying our Windows+Office image, with apps and config deployed afterwards via GPO as much as possible. We then switched out WDS for WDS+MDT. MDT allowed us to completely automate the build & capture process (pretty much zero-touch apart from network booting a VM and supplying some network creds and a desired capture filename), which it sounds like is still an involved manual job for you at present. As for best practice, it doesn't seem like MDT has too much life left, so MECM would be the best choice for an on-prem solution. InTune and AutoPilot are obviously what MS want everyone using, but that's a big departure from WDS. Lots of commenters will say to not build a Windows+Office thick image, but instead just use MDT/MECM task sequences to deploy the latest vanilla Windows image and install Office and Windows updates on the fly during deployment. IME that makes a deployment take about 3 or 4 times longer, so we still have a 'thick' image with Office and updates baked in during capture. Automating the build+capture takes a lot of the pain away though, and allows you to deploy the latest Windows version just as easily whilst minimising the time it takes to image a machine.

I believe so. I've got it to deploy Win11 23H2 successfuly though, using the Win11 22H2 ADK (v10.1.2200.1) with a few tweaks to fix things. Happy to share my notes on that.

I do feel that this is entirely the right approach. In support of this, perhaps a mail flow rule that when an unwanted reply-all is detected, the message content is simply replaced with "I am a dork. I have now been fired. Good bye.". Their account can then be immediately deleted?

I agree with both @Rob_D and @simpsonj that exam stuff needs good solid prep well ahead of time, and that exams are a priority for IT support (and seen/felt to be so). IME you can never do enough testing and prep for exams IT, and you will often need to work with the EO quite closely to make sure that you're exacting in the details. Stuff like making sure laptop users in exams will be seated near enough to power sockets, computers have longer sleep timeouts applied, etc. Those are the sorts of details that it pays off to be on top of before exam day arrives, to avoid stress and running about.

I seem to remember punching down two cables onto a single ethernet module as another quick and dirty way to extend a cable.

I've never used it, so this might be a duff suggestion, but could Clonezilla do this for you, for free?

I noticed the other day that Google Gemini is now available for Workspace accounts.

I'm assuming that you've left enough time from a video being uploaded before attmepting to play it? Google servers will need to do the requisite transcoding to make a video streamable via its web app(s). Obviously that's only going to be a matter of minutes rather than days.