ADMaster

I don't use pfsense or squid, but the samaccountname is the username in AD. Try changing this line. ldap username DC Attribute: samaccountname ​It would also be good to move to ldaps but should function without it.

I've never done this, just an idea Create a csv matching account name to computer name. Write powershell to loop though the csv When it finds the match write the details to the auto log in reg keys write another script to remove the auto log in details when done.

Is it signed? I'd try a publisher rule if it is. This will also allow it to run from anywhere, and hopefully catching anything else in temp areas that are getting blocked.

active directory is automatic. as long as they are joined to the domain, they should be activated.

I setup a lab today with MDT and my app removal script worked as it should. I've not tested any of my other customizations. I'm not sure if you have said, what are you using for imaging?

I don't redirect start menu, the layout is copied local via the SCCM image process. My layout consists of Chrome, Calculator, Snipping tool and file explore. Those are installed on all PCs. I'd do a blank layout and leave that half of the start menu alone if it would let me, but since I I had to have something, I just chose a few basics. I never used start redirection in W7 either, just teach them to search start. This also has the benefit of only what is installed on that machine shows up.

Cool I've never seen that setupconfig.ini may have to look into that, but I use SCCM not really relevant. In my testing in the past, if the script was run on a machine with existing users it would not effect them, but would effect new users of the machine. I'd never deploy something out of the box anyway too much bloat, I'd do a fresh image. The in place upgrade can be addressed with SCCM as we have talked about before. I'll have to spin up a WDS / MDT lab to see how it compares to SCCM.

I found CSM to cause explorer hangs. I have not used it since 1511. It may have improved but worth removing as a test. There are several threads on here, some saying it causes the hangs and others using it just fine.

I've had the store blocked for several versions, so I don't think that is just a 1709 thing. Try installing the full set up 1709 templates. What errors did you get when trying to remove the apps? When do you try to remove them? I've found during OSD is best, after the fact gives mixed results. To answer the question though. If you are running ent/edu sku applocker will be able to block these store apps.

I can say that with that setting configured device driver updates will not happen. I just had an issue today looking for a print driver. It could not be downloaded from the manufacturer all searches pointed to using windows update. I had to revert the policy of do not allow internet locations to not configured.

All my suggestions here imply a bit of lock down but here goes. Deep freeze or some alternative. Windows 10 Kiosk mode. Any reason you can't put W10 on them with that new feature? There are GPO settings to disable the password manager and history. I think you can create a shortcut that launches directly into incognito as well. You can also use GPP to set the reg keys for auto log in. I've done this for a few machines such as xibo and papercut release stations.

Also are they older unpackaged drivers. They was a security update in July 2016 that broke older unpackaged drivers. https://social.technet.microsoft.com/Forums/en-US/030ee94a-047d-460a-bc39-52351a199364/kb3163912-breaks-point-and-print-restrictions-gpo-settings?forum=winserverGP

windows firewall on the kms server? also have you considered active directory based activation?

What OS are you running, do you have enterprise / education or are you running pro? If you are on ent/edu consider moving to applocker, its the successor to SRP and a bit more flexible. Here is an article on what variables are allowed in path rules for applicker. https://technet.microsoft.com/en-us/library/ee460944%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396 There is specific ones to cover all the removable storage so you don't have to list them out. I know appdata is not a supported one, but it is on my SRP policy. I cannot find a similar article for SRP, but wanted to put this out there if you make the move to applocker. Something you can check on your SRP, is exe still listed in the designated file types? If not add it back.

I had lightspeed through my LEA about 2 years ago. They also have had issues with it scaling. It also is not as granular on some settings. Some settings were global and had to be the same for all schools. Some of of those may have changed, as this was 2 years ago. I have no experience with Netsweeper.

Wow interesting thread so far, It sounds like you have made up your mind, but I’ll throw in my thoughts. To answer some of the questions asked of the other posters, no I don’t teach and Ilook after about 600-700 Windows Pcs. The majority of our student devices are now chromeOS. When I made the jump from 7 to 8.1 I told folks there isn’t one feature that jumps out and says that is the reason to upgrade, but a lot of little things that add up. Also several changes “under the hood” that make the system run better. I did try LTSB briefly, the 1511 version and decided on the CB/CBB instead. Mostly the lack of apps / new security features, like calculator notes and such. I also wanted to leave the option for apps in the future. In hind sight with what we use LTSB would be fine. However I also like to have the latest security features that you will not get with LTSB. One of those minor features that was part of the reason to upgrade is connections on the log in screen. In W7 a frequent call was no log on servers, now with W8/10 they can ensure connection before attempting the log in. Granted, the OS of the future isn’t here yet, but I believe in providing the latest stable system I can. It is very unlikely that folks have W7 at home. W8 was release in 2009, so that is an old home PC to still be running W7 or prior. Providing the latest helps to keep things familiar between home / school. This in turn should improve productivity / T&L. Now in the days of more mobile devices then PCs that’s not much of an argument, but was / is my thought process. To the question of how to manage it all, yes put in a system to build computers, not the traditional golden image. When I moved to W8 I must have spent a month or two off and on tweaking and testing. Then W10 another month. I don't recall my tweak / test time on XP to 7, but a good month I’m sure. The latest 1703 to 1709 I spent a day or two. That includes deploying to test machines and doing the other regular jobs. Weather it is SCCM /MDT or something else the basic process is; Find a way to script every tweak you want to make, several examples on here and Garry town blog. Drop the wim into a task sequence and apply all the tweaks. In place upgrades via WSUS will break a lot of those customizations. There is an upgrade task sequence in SCCM that will allow you to run these tweaks again during the upgrade. I have had fairly good success with the upgrade task sequences for staff, the student PCs just get a full reimage over the summer. I recently made my 1709 upgrade sequences available to staff and had two folks jump on it and upgrade that day. They have not reported any issues. When you decide to make the move plenty of help is available here on edugeek.

Thanks, I think I came across that when searching the forum for movie maker.

Thanks for that, our filter allowed it, but checked another and it was malware too. I uploaded to virus total and it is adware / hoax by a few but the rest report it clean. https://www.virustotal.com/#/file/5313624fe47a38cd065079fe465f8ce763949b02213c14a04c2e7146f1039644/detection

What do folks think of this Windows Movie Maker Free Download - For Windows 7/8/10/Xp/Vista It was just sent to me by a teacher asking for it to be installed. It looks like a repackaged Movie maker 2012. My first test run seamed to work, I used the verysilent switch, but need to try the reg keys listed in the other thread. It also looks to need .net 3.5 which I do not deploy by default anymore.

And you can do that with GPP power options. I have found the enforcing the password on resume must be done in the power management section of administrative templates. However all of your timeouts / power plan options can be done nicely with GPP.

Sounds like a corrupt download. I'd download it again and validate the check sums.

I also pay $20-25 something a seat for the full suite, but had a minimum of 100 seats. Worked out to less then $2.5K But I'd also second gimp and inkscape.

We use clever here, the younger students can even log in with their badge (qr code)

Not the answer to the current problem, but to prevent it in the future... I created a DP group even though it only has one DP in it, then deploy all content to that DP Group. If I ever need to add another DP I'll add it to the group and it should pick up the content.

The if statement with oobe is basically saying if this folder does not exist create it. A few lines down from that a line to copy the background into the newly created folder. This may be a leftover from Windows 7, I'm not 100% it is still needed. The line to copy the theme.exe is to put it in a location anyone can run it. It is for the upgrade to change an existing users theme to the upgraded default. The exe is a compiled auto hot key script code for it posted in #6 The default wall paper / lock screen is the lines with img100.jpg, I've just updated the script in 1709 the lock screen is img103.png. The script moves / renames the default img out of the way and replaces it with my background image. I'm not sure why it isn't working for the default user, that was the easy part for me. I had trouble getting existing users to switch. Are you adding the reg entry install theme pointing at the .theme file copied from the previous step?