ADMaster

I've found my self in a catch 22. I hope someone here has a fix, or a least something preventive so it doesn't happen next summer. Last year I enabled credential guard which requires certificate authentication to the wifi. I got NPS setup to accept certificates and setup AD CS. All is well certs are issued / renewed everyone can connect. Users have taken laptops home over the summer and the cert expired while off campus. They can't connect because the cert is expired, but they can't renew the cert as they are not connected. The quick fix as folks come in has been to connect via ethernet and reboot to get a new cert. This is fine for a few, but when everyone returns first day of term it will be a nightmare. Suggestions for fixing the current problem and if not, once the cert is renewed how to prevent in future? Thank you

Well if anyone else has this issue, you need to add updates to your wim. I have no idea what updates did the job but here is what I did. I had started with the March release of the wim and attempted to update it through SCCM, it failed. I then used the OSBuilder script to update the wim, it pulled down several updates and was successful at updating the wim. I imported the updated wim into SCCM as a new OS. I was able to image a Hyper-V VM and the Dell is on the last step, well beyond where it was failing previously.

Another strange update on this. I found a few posts on other sites that said not to try and remove packages that are not present. My current script is just a list of apps I want removed. I just add to it each version and don't remove for the old versions. It attempts to remove apps that are not part of that version, but it is backwards compatible. This is the script that post recommended. https://github.com/SCConfigMgr/ConfigMgr/blob/master/Operating%20System%20Deployment/Invoke-RemoveBuiltinApps.ps1 It also worked on the laptops, but failed on the Dell and Hyper-V. Ideas?

Quick update, it appears Hyper-V is hanging, but a Lenovo Laptop imaged without error. The only changes I've made are importing the dell drivers and updated the boot image with the Dell nic drivers. I also forgot to say this is 1809 using the updated wim from March.

Hello all, I've been a Lenovo shop for years, but was talked into some Dells this year. They look very nice, but I'm having trouble imaging them. First I had driver issues because I missed the win pe section of the drivers. After getting network and storage drivers it started to image. The next day it was still on the remove modern apps step. If I reboot at this point I can log in and run the remove modern apps script and it works fine without error. The same task sequence worked on Lenovo and Hyper-V 2 weeks ago. I'm doing a test image now to verify it still does. I set a timeout / continue on error on the step and the rest of the steps worked. It appears to get stuck on an app and hang, but I'm not sure. Here is the list of apps removed after a reboot, so is the identity provider an issue. It doesn't hang for the other models. Also any Dell tips in general. I've found the Dell command update and configure. The only thing I've done with them is create a bios settings package. I only have one machine unboxed at this point so that hasn't been fully tested yet. Thanks, Removing Appx Package: Microsoft.XboxIdentityProviderRemoving Appx Provisioned Package: Microsoft.XboxIdentityProviderRemoving Appx Package: Microsoft.XboxSpeechToTextOverlayRemoving Appx Provisioned Package: Microsoft.XboxSpeechToTextOverlayRemoving Appx Package: Microsoft.WalletRemoving Appx Provisioned Package: Microsoft.WalletRemoving Appx Package: Microsoft.Microsoft3DViewerRemoving Appx Provisioned Package: Microsoft.Microsoft3DViewerRemoving Appx Package: Microsoft.MSPaintRemoving Appx Provisioned Package: Microsoft.MSPaintRemoving Appx Package: Microsoft.MixedReality.PortalRemoving Appx Provisioned Package: Microsoft.MixedReality.PortalRemoving Appx Package: Microsoft.XboxGamingOverlayRemoving Appx Provisioned Package: Microsoft.XboxGamingOverlayRemoving Appx Package: Microsoft.YourPhoneRemoving Appx Provisioned Package: Microsoft.YourPhone

Hello, TL;DR Does a blank classroom materials field in a gam report mean there is no content and safe to delete? I'm looking at a new classroom management tool, chrome tools. It relies on google classrooms for the list of students. In the past I've just let teachers manage their own classes. Many would prefer one large class for multiple sections of the same course. This doesn't pair well when that class is used as a list of who is present in that physical classroom for computer monitoring. I found @rogerdnixon 's info on syncing SIMS to google classroom. I did this with a few test classrooms in the spring. Now it is time to clean up and create classes for this fall. I have about 200 classes that have been created by teachers over the years. Only 3 of them have a url in the course materials field. Does this mean only 3 classes have been used as a classroom and the rest blank slates? I can take the safe route and just archive everything. However since I'm going to be creating hundreds of classrooms a year now, I'd like to delete them if they were never used for anything more than a roster. Some of the teachers I had testing in the spring said they might use the classes I create for monitoring, but create their own classes for materials with all students of that course. Thank you

I did a quick test by setting the reg value on one machine and it appears to have done it. What 2012 R2 issues did you have? I'd like to just add this to my security GPO for all machines. I could also just set the reg value as a step in the TS.

I've stuck with 1709 this last year. I plan to test 19h1 this summer after it hits vlsc. I read in another thread it sped up logon times. I also think part of my problem was modifying the default ntuser.dat file. There are some changes in programs / GPOs that may mean I don't need to do that to achieve the same result.

One step forward two steps back. This is pre 2008 again with no fine grained password policies.

@gshaw thanks didn't know about the 15 to 1 license thing for students. That does mean I'll be able to cover everyone. There are solutions that work directly with the data from haveibeenpwned I've wrote about somewhere in another thread. However as @localzuk says they're next to useless because of younger students.

Azure AD Password Protection is now generally available. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-faq https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Password-Protection-is-now-generally-available/ba-p/377487 https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad Has anyone set this up, the documentation is contradictory? The FAQ states it does not discriminate against what users it is applied to, but the eliminate bad passwords article says you need a P1 or P2 license. I'd like to apply this to only staff and if only staff have P1 in theory I'm applying it only to a subset of users. Now that this is out of preview, can anyone confirm my use case idea?

It really is the SQL causing all the problems. I tried and tried today to get it working on the new machine SQL 2017 reporting services was giving me trouble. The documentation also says it will allow you to move the DB during upgrade, this isn’t really true. I’d tried to upgrade it, but SQL was not supported, and install SQL 2016 said the DB files didn’t exist. I also tried backing up and restoring the DB from the SQL 2014 to 2016 with no luck. Here is what I’ve done in the end. Take a snapshot of my DPM VM before any upgrades. Install SQL 2016 with a new instance name. Stop both instances and copy the DB files over to 2016. Start SQL server Attach the newly copied files. Run the DPM install wizard pointing it to the new instance. It found the files and appears to have upgraded. The DPM console opened and I had all my protection groups. I updated the agents and everything is doing a consistency check now. Now that the DB is updated for DPM 2019, I should be able to migrate it to that fresh VM, but that is for another time.

I'm struggling to get it installed. I've setup a fresh VM and plan to backup / restore the DB. The DB is currently on 2014 which is not compatible with 2019. I installed sql 2017 but didn't see the reporting services check box so dpm failed to install. I figured out it was a separate download and it is now installed. Now I'm getting some errors on the checks that say to look at the logs and this is what I have in the log. This is a fresh install of server 2019, fresh install of sql 2017, reporting services 2017 and the dpm database is restored from the other server. Ideas? [4/25/2019 3:39:48 PM] *** Error : Initialize the SQLSetUpHelper Object [4/25/2019 3:41:59 PM] *** Error : Can not access properties of the WMI class. [4/25/2019 3:41:59 PM] * Exception : Failed to perform the check => System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> Microsoft.Internal.EnterpriseStorage.Dls.Setup.Exceptions.ReportingConfigurationAccessException: Can not access properties of Reporting configuration class at Microsoft.Internal.EnterpriseStorage.Dls.Setup.Inspect.InspectHelper.GetReportServerVirtualDirectoryName(String reportServerMachineName, String reportServerInstanceName, ConnectionOptions wmiConnectionOptions, String ReportingNameSpace) at Microsoft.Internal.EnterpriseStorage.Dls.Setup.Inspect.InspectHelper.CheckIfReportServerURLIsAccessible(String reportingMachineName, String reportingInstanceName, ConnectionOptions connOptions, String reportingNamespace) at Microsoft.Internal.EnterpriseStorage.Dls.Setup.Inspect.InspectPrerequisites.CheckIfReportServerURLIsAccessible(InspectContext context) --- End of inner exception stack trace --- at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor) at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at Microsoft.Internal.EnterpriseStorage.Dls.Setup.Inspect.Inspect.RunCheck(String checkId)

I’ve been running Securly on chromebooks for a month or two now. It is great for those devices with the extension installed. The reports are very easy to read and get a users history when needed. I’ve not implemented DNS filtering yet because I’d have to do it for my whole network and not just one OU, subnet or vlan. The biggest issue I see with the DNS filtering is lack of granular control. Everything is based off of Google OU or public IP address. With an onsite filtering solution I can add a single IP, subnet, user etc and give it a policy. Securly DNS would require me to reach out to my ISP and map a public IP to that internal IP or subnet. I’d like to see Securly develop some sort of onsite / hybrid solution that would allow me to create policies for local IP addresses.

A few more obvious things to check since you removed the role and added it back. I'm not sure if that keeps all the configuration or not. 1. Is the dhcp service running? 2. Is the scope properly configured and active? To eliminate any other networking / switch issues, connect a pc to the same switch / vlan as the server. If you have vlans, ip helper addresses? You don't have allow list only, or the network access protections to drop packets do you?

You can manually run any dedupe job with start-dedupejob You want to run garbage collection, by default it runs weekly, so you may want to start if yourself it you need the disk space. Start-Dedupe Job Types

Thanks, I was misreading the name as domain name to join, not new username.

I know since windows 8 the create local user option keeps getting harder and harder to find. MS really want you to use an online account. I'm not finding the create local user option on LTSC 2019. I have online account or domain join. This is being installed via bootable usb no xml etc. Am I just overlooking some hidden button? Alternatively advice on this scenario. The track is getting a product / system called finish lynx and need a computer setup for it. My first thought is to just create a dedicated domain account on the standard image. However they want wifi turned off, firewall turned off and static IPs set etc. So I thought a stand alone setup on ltsc would be better suited as it sounds like it will never connect to the network for updates or anything. Thanks,

I wrote the script on windows 10 / powershell 5.1 This may be what you need, but if you have access to a W10 box use it. https://www.microsoft.com/en-us/download/details.aspx?id=54616

You could just add it as a column in the csv. Adding it at the top of the file messes with the filter sort functions if you had a larger data set. Doing it this way keeps columns and rows lined up. If you keep the append on, you will have a record with time stamp of before and after in the same file. Also the start-process isn't needed for function, its just a quick way to open the resulting file. If there were a silent / scheduled script I wouldn't include it. However it sounds like you are running this interactively. You could also use variables within the path to be drives-pcname-date.csv or something of the like. [color=#000000][font=Consolas][color=#001080]$ComputerName[/color] = [color=#a31515]"pcname"[/color] [color=#001080]$path[/color] = [color=#a31515]"[/color][color=#001080]$PSScriptRoot[/color][color=#a31515]\drives.csv"[/color] [color=#001080]$Date[/color] = [color=#795e26]Get-Date[/color] [color=#001080]$drives[/color] = [color=#795e26]Get-WmiObject[/color] Win32_MappedLogicalDisk -ComputerName [color=#001080]$ComputerName[/color] | [color=#795e26]Select-Object[/color] SystemName,Name,ProviderName,SessionID | [color=#795e26]ForEach-object[/color] { [color=#001080]$disk[/color] = $_ [color=#001080]$user[/color] = [color=#795e26]Get-WMIObject[/color] Win32_LoggedOnUser -ComputerName [color=#001080]$ComputerName[/color] | [color=#795e26]Where-object[/color] {($_[color=#001080].Dependent.split[/color]([color=#a31515]"="[/color])[[color=#09885a]-1[/color]] -replace [color=#a31515]'"'[/color]) -eq [color=#001080]$disk.SessionID[/color]} | [color=#795e26]ForEach-object[/color] {$_[color=#001080].Antecedent.split[/color]([color=#a31515]"="[/color])[[color=#09885a]-1[/color]] -replace [color=#a31515]'"'[/color]} [color=#001080]$disk[/color] | [color=#795e26]Select-object[/color] SystemName,[color=#0000ff]@[/color]{[color=#001080]n[/color]=[color=#a31515]"MappedTo"[/color];[color=#001080]e[/color]={[color=#001080]$user[/color]}},Name,ProviderName,[color=#0000ff]@[/color]{[color=#001080]n[/color]=[color=#a31515]"Date Checked"[/color];[color=#001080]e[/color]={[color=#001080]$Date[/color]}} } [color=#001080]$drives[/color] | [color=#795e26]Export-Csv[/color] [color=#001080]$path[/color] -NoTypeInformation -Append [color=#795e26]Start-Process[/color] [color=#001080]$path[/color] [/font][/color]

I thought I tried adding one, but I guess not. Your script is very inconsistent. The only client I was able to get it working on was mine. Every other client returned no drives. However a few servers did return results remotely. It will put the results in a csv file and open it after running now. The csv is placed in the directory the script is run from. This can be changed with the path variable. [color=#001080][font=Consolas]$ComputerName[/font][/color][color=#000000][font=Consolas] = [/font][/color][color=#A31515][font=Consolas]"name" [/font][/color][color=#000000][font=Consolas][color=#001080]$path[/color] = [color=#a31515]"[/color][color=#001080]$PSScriptRoot[/color][color=#a31515]\drives.csv"[/color] [color=#001080]$drives[/color] = [color=#795e26]Get-WmiObject[/color] Win32_MappedLogicalDisk -ComputerName [color=#001080]$ComputerName[/color] | [color=#795e26]Select-Object[/color] SystemName,Name,ProviderName,SessionID | [color=#795e26]ForEach-object[/color] { [color=#001080]$disk[/color] = $_ [color=#001080]$user[/color] = [color=#795e26]Get-WMIObject[/color] Win32_LoggedOnUser -ComputerName [color=#001080]$ComputerName[/color] | [color=#795e26]Where-object[/color] {($_[color=#001080].Dependent.split[/color]([color=#a31515]"="[/color])[[color=#09885a]-1[/color]] -replace [color=#a31515]'"'[/color]) -eq [color=#001080]$disk.SessionID[/color]} | [color=#795e26]ForEach-object[/color] {$_[color=#001080].Antecedent.split[/color]([color=#a31515]"="[/color])[[color=#09885a]-1[/color]] -replace [color=#a31515]'"'[/color]} [color=#001080]$disk[/color] | [color=#795e26]Select-object[/color] SystemName,[color=#0000ff]@[/color]{[color=#001080]n[/color]=[color=#a31515]"MappedTo"[/color];[color=#001080]e[/color]={[color=#001080]$user[/color]}},Name,ProviderName } [color=#001080]$drives[/color] | [color=#795e26]Export-Csv[/color] [color=#001080]$path[/color] -NoTypeInformation [/font][/color] [color=#795E26][font=Consolas]Start-Process [/font][/color][color=#001080][font=Consolas]$path[/font][/color]

Updates were the bandwidth killer for me. But they are manageable. 1. If you can get one I highly recommend a cachebox. 2. If you have some other appliance firewall / filter that can do bandwidth control / qos, throttle dl.google.com and of course give high priority to voip. 3. As others say, scatter updates.

The script you posted doesn't work for me. I need to figure out where the line breaks are etc to successfully run it. Try posting it in code block. To answer the question though, you should be able to pipe the results into export-csv.

Yes I want ax if it is within budget. I do have a budget, just the erate program is funding a large part of it. The vendors bidding can go lookup how much erate money I have so they have a rough estimate on my budget. It is based on school site / student numbers. Our BM is very good with money. Most local vendors I've talked to are sure it can all be done in budget, but I'm awaiting official bids. Thanks for the foritnet feedback, that is the kind of thing I'm looking for other manufacturers. I want this thread to focus more on the overall experience / best product with cost being a minor factor / relative to to each other not absolute. Meraki is more expensive then Unifi, good relative info. Meraki has high ongoing costs compared to others, good info too. Meraki cost $X says nothing as there are discounts and without bids I have no basis for comparison yet. If I get two bids similar in price, I want to know who has the better technology / value long term.

I know this won't be cheap, but its Erate money. I'll get volume / EDU / Erate discounts. I thought Fortinet was firewall, do they do switches and APs? Forget total cost, the government is giving me money. I want to spend it wisely and get the best value I can with it. Ruckus vs HPE / Aurbua vs Extreme vs Cisco. Who has the best kit, support, recurring costs etc? If I get a bid that is way to much, I'll pick second best etc. Perhaps I should change the question. Those of you with above $kit, what is your experience, pros cons etc? Would you recommend it to someone else? Do you wish you had something different. Any gotchas? TIA