cstreet

We were running v21 before and needed to update the drivers for newer panels so went for latest, why not! Confirming that to resolve the issue on this post, we rolled back to v24. This meant sending an uninstall of v25 to SCCM deployment, then setting up a new v24 deployment and pushing at the same time. SCCM seems to process the uninstall first luckily and then the v24 can install. A little messy but worked for our teachers who confirm that the issue is gone in v24 and everything else seems to work. When a working version of v25 is release later, we'll plan to update to v25. Probably not until next year now so as not to upset our teaching staff any more!

+1 !! We've just pushed Notebook v25.0 to one of our schools and multiple teachers have reported the opening with Chrome thing. We have Windows 10 + Sophos + Smoothwall Webfilter Appliance + Classroom.Cloud + Microsoft Office 365 Apps It's intermittent for us. On a fresh reboot of a laptop, the program functions fine as expected. Teacher showed me that they could trigger the issue on purpose at the end of the day - laptop been on for a while - then try opening Notebook documents until it triggers. After about 3-4 docs open, SMART threw an error up and then started opening with Chrome then downloading a copy of the document. Sometimes happens on a fresh reboot too apparently but we couldn't replicate this at the time. On a refresh reboot of a modern laptop recently deployed with fresh Windows, the issue doesn't occur and Smart Notebooks open fine. We opened about 12 docs and it kept going! It seems to occur after the laptops have been on for a while, or something else triggering it in the background. Another app open perhaps. Not worked it out fully yet but we're looking at if we can just jump back to v24 anyway until it's solved. Workaround suggested at the moment it that when we close all other Notebook documents, wait 30 seconds, then start again, they open fine. (shrug)

Senso DEV team are currently working with one of our machines to see if they can fix the backwards compatibility or provide some sort of working setup. Our school environments are all the same with: - Sophos Enterprise Cloud installed on all Windows clients with HTTPS inspection enabled - Smoothwall Appliance on Leeds 73 (latest) - Smoothwall Proxy configured on clients with HTTPS inspection (full decrypt and inspect of sites unless whitelisted in Smoothwall) - Many common sites that are whitelisted in Smoothwall also whitelisted in Senso monitoring (by domain/URL in a massive uncategorised list) - No smoothwall software or drivers are installed on Windows client (upstream proxy only) - Senso Cloud client installed on every Windows client (currently with filter drivers disabled and features lost) Before the Senso driver update on Monday everything was working together.

I can confirm that this has impacted all of our schools - and it's a Senso change/update that initiated the problem, not Smoothwall. Senso have updated the Senso WFP filter drivers on Monday 17th April. These drivers are using TLS 1.3 - claiming to be backward compatible however aren't working with Smoothwall TLS 1.2. We noticed that YouTube stopped loading yesterday morning on some clients, getting worse as the day went on (as more and more Senso clients updated). While Smoothwall should be working with TLS 1.3 by now, they are probably holding fire until their new release, which will be properly tested before launching into the wild. No point asking Smoothwall for support here, it's caused by Senso. We have a temporary work around by disabling the Senso filter drivers. This removes some features of Senso but allows the basics and also all HTTPS inspection now working. Please seek support from Senso to ask if you need this temp fix for your environment. Senso on the released an impactful driver update that clearly hasn't been tested with Smoothwall customers. I'm disappointed, for the second time. We've had this before when it was clashing with Sophos. Not impressed but happy that Senso are working on it with us directly.

Note: Just tried running the Task as a user, Administrator on the server, same result I'm afraid. CleanMgr fails to end/close which stalls the task as well. Closing the CleanMgr.exe process in task manager works and the task can also be ended by simple right click and end (or by setting the task to end after x minutes). It's just not a clean end! Ironic? If you're using a PowerShell script action started by a task, ending the task does NOT close CleanMgr.exe. You must start CleanMgr.exe as a direct action of the task in order for it to be terminated by the task controls.

This is also happening for us, same setup. Running the task on Server 2019 and Server 2022 has same result. Seems to be doing the job but not returning the completion result to the task. For us, CleanMgr.exe is left running and idle. If we run the task in PowerShell a CleanMgr window appears and runs the sagerun process as expected in about 2 minutes (as it's already clean). But running from a scheduled task results in CleanMgr.exe being orphaned idle and task never ends cleanly. Did some work today and have tried adding the command as a Task action directly, as well as having a PowerShell script (.ps1) running with CleanMgr command in there. No joy, same result for both. I also tried excluding Windows Updates and Microsoft Defender targets as those take the longest to run when we do it with GUI visible. Manually run command with GUI popup works: Task with hidden GUI does not end properly though. Our PowerShell manual command runs as a user, the task runs as system. Any solutions or other suggestions welcomed

SDS does not remove the data from Azure when a contact is excluded, this is the whole point of trying to overwrite the existing with a false one. I know it's not tidy, but neither is the guardian email data! Update: Sadly however, it seems SDS doesn't overwrite the email and instead adds another duplicate parent instead Still working on a solution.

Hi, It seems that uploading the new email address is adding an extra record for the same parent rather than overwriting it! Annoying! Salamander can exclude parents with a UDF which be needed to prevent them uploading, however I was trying to automate the process by overwriting the existing email instead. It seems I am foiled by Microsoft SDS once again as it just adds another duplicate record! I will raise a ticket with MS support and see if they think it's a bug with the sync as I'm sure this worked in testing a month ago. Please note: Microsoft do not remove addresses when they fall out of sync. You can exclude them to stop them going back in, but you have to run a powershell script to delete parent data. This is what I was trying to avoid! The script is here... https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Reset-Guardians.ps1 You have to add a custom App Registration in Azure to get an API ClientID and ClientSecret for the script. The data is in Graph and special permissions need granting for editing that. The permissions are below... The script can remove all parents from one student, or all parents from ALL students. It does not remove one parent from one student as it is. Here is how I currently call it: # Set common params $TenantDomain = "mydomain.uk" $ClientID = "7jief9ej42-dfht-4444-5555-123456787tth" $ClientSecret = "2Afrgh755gyh6PfgthuyfrthjuJLAM446hhr" # Remove all guardians from one user $student= Get-AzureADUser -ObjectId [email protected] .\Reset-Guardians.ps1 -OutFolder . -clientId $ClientID -clientSecret $ClientSecret -tenantDomain $TenantDomain -studentAadObjectId $student.ObjectID # Remove guardians from all users in the tenant .\Reset-Guardians.ps1 -OutFolder . -clientId $ClientID -clientSecret $ClientSecret -tenantDomain $TenantDomain You can strip out the data manually with the script and then use Salamander with a UDF so you can exclude the parent from the CSV uploads in SDS. Perhaps there is a way to automate the script as well. I have one idea where we ask Salamander to write an extra CSV with any of the opted out parents in it. We could then run the Reset-Guardians script against the contents of the opt out csv on a scheduled task. If I figure this out I will update again. Sorry! Chris

Hello, I've been working to find a way to opt out an email address from Teams weekly digest and have finally come up with a manageable solution that I thought I'd share. We have SIMS for our MIS and Salamander Active Directory provisioning Teams Classes and Parent data via the Microsoft SDS sync. Salamander creates nightly uploads of the SDS csv file set and they offer this for free using their tool here... https://www.salamandersoft.co.uk/free-utilities/salamander-for-school-data-sync/ This fix is for those that have an automated SDS sync upload rather than the free run-once option. The problem: A parent contacts the school to say that they do not want to receive the Microsoft Teams weekly digest email. You need to keep the email in the MIS for other systems. The Microsoft SDS already has the parent email address and it's only possible to remove the email from the Azure Active Directory by using the reset_guardians.ps1 script provided here: https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Reset-Guardians.ps1 Once you reset the guardian contacts for a student, all of the contacts are removed from the student, not just the one that wish to opt out. The other contacts for the student do not automatically reappear on the next csv file upload and it's only possible to get the contact data back again if you run a Full Sync reset on the SDS profile - something that cannot be automated (at the time of writing this). Removing an individual is possible via PowerShell if you read into the script. You can adjust the contact array on the student object in the graph data to contain what you want manually or via a script. However that's not so easy for your admin/data/pastoral teams to manage themselves and would be an administrative headache for any IT Support Team. A simple solution: Rather than thinking about removing the parent from the student contacts on the Azure object, we can simply update the email address to a new value instead. The SDS sync process will push changes to values and add new values but will not remove them. So all we need to do is flag the contact in the MIS and have the process replace the email with a non existent one that will bounce. Simple! For our setup we added a User Defined Field in SIMS in the Contacts data set. I called ours "NoTeamsEmail" and set it as a True/False type value. I then asked Salamander to add the new "NoTeamsEmail" UDF to the parent data extract, and use the value of the field to determine what the email address will be in the users.csv file creation workflow for SDS. The logic is that if the value of "NoTeamsEmail" field in SIMS is set to True (ticked) by the school's staff, Salamander will use a fixed value of "[email protected]" instead of the actual parent email address. SDS will then process this change when the files upload and the parent will no longer be receive the weekly email. Note: The email address you choose should be at your own school domain or a domain that you control to ensure that it is never going to exist. This works in any automation on SDS if you can identify the parent/guardian users somehow and just replace their email in the process if they are flagged. Thank you to Salamander who have implemented this for us - developers changed their SDS process to accommodate it. Top marks Thanks, Chris

You can fix the DNS hijacking by setting the DNS suffix search order in windows. For some reason Windows appends the domain on all requests when on a domain joined PC. On Virgin, try doing nslookup for google.com and you get google com.mydomain.org. Try nslookup mydomain.org and you get mydomain.org.mydomain.org. If you set the append suffix search order in windows networking to... . (Dot on it's own) Mydomain.org ...then it fixes the problem. The dot on it's own means - don't append any suffix. The reason the default DNS suffix behaviour doesn't work with many remote access methods is because the connection attempts to resolve... Myservice.mydomain.org.mydomain.org. ...which on Virgin will resolve to their bogus DNS intercept IP.

I've been pulling my hair out also. We have used Direct Access and it does not work on some ISPs, and here is the reason! DNS service "helpers"! Virgin consumer market routers always return a success record for any bogus DNS lookup you make. I think the idea is to offer a fancy DNS error page or a list of search results. Windows default DNS lookup behaviour on a domain joined PC is to append the domain suffix. If it's a toplevel domain the expectation is for the initial lookup to fail and then it resolves what you want. I saw that when doing an nslookup for google.com on virgin that it would return a result for... google.com.ourdomain.org Windows added our domain suffix and Virgin DNS servers resolved it! What a pain. Of course when you lookup... DAServer.mydomain.org.mydomain.org It fails to resolve the correct IP address and instead tries to connect your device tunnel to their bogus DNS intercept. This causes DA to fail to connect. The fix is pretty simple and can be delivered with Group Policy I believe. We just set the DNS suffix search order manually to append in this order... . (Dot on it's own) Ourdomain.org The dot on it's own signifies - no suffix. Reboot after applying and DA connected just fine! Hope that helps some folks keep their hair for a little longer. Thanks, Chris

https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Reset-Guardians.ps1 I booked a call with MS support to help me register an application API in Azure AD for the script. It includes adding the required permissions on the API registration for the script to run with.

I've dealt with our parent emails this week and this may be of interest... I'm using salamander AD to create the csv files. They are pushed up automatically every day early hours. Be mindful for your user provisioning flow with SDS uploads: check that any new student/teacher accounts ilare created in 365, and have a licence applied, BEFORE your SDS csv upload includes them. Otherwise SDS will have validation errors if new accounts included in the csv don't actually exist in 365 yet. Next, check that Salamander filter which parents are included. In SIMS we have priority 1/2/5 for parent contacts. Our P5 are normally grand parents or god parents who won't want extra emails! Or contacts that are related but have no access to students for safeguarding. Queue GDPR complaints. We include only P1 and P2 parents in our csv now. Finally, I can tell you that parent emails do not get removed automatically. If you stop uploading them, they still remain in SDS. You can see the parent emails in SDS if you go to the People list and open up a student. The guardians and emails appear at the bottom of the student fly out details pane. There is a way to remove parent emails using a graph API script provided by Microsoft support. Once set up you can reset parents for a single student, or for all students. When your csv uploads again it will put only the parent you need back in again. I am in the process of installing the script as a scheduled task on our server to run on a Friday evening, removing all parents. The next csv upload would be Sat early hours and contain the correct parents for the weekend summary to build. The parent emails are processed by Microsoft from Saturday afternoon. Please appreciate the scale of this task! The entire world's parents all getting an email. It is for this reason that there are no controls over exactly when your tenant is processed. It just happens whenever Microsoft get to your tenant as quick as their servers can process it. I feel like I have got to grips with SDS and parent emails now so if anyone would like a hand, drop me a PM! Hope this helps someone

Hi, the legal text registry settings are applied via group policy. You need to use Group Policy to apply the registry settings with the Item Level Targeting as per my instructions. Before you apply the registry settings you should check that the legal text is NOT applied anywhere else. Please remove your legal text from everywhere and attempt to build a machine with MDT. This will make sure that MDT is working in your environment. When MDT is tested working you can then try adding the legal text as I explained in my post.

Hi namarjeet, MDT gets stuck after the workstation is added to the domain if the legal notice is configured before it's finished. I'm guessing that if you're having this issue you have a legal notice already configured. How are you configuring the legal notice text? A) Are you using the native Group Policy for that computer? Check in the policies for... "Interactive logon: Message text for users attempting to log on" "Interactive logon: Message title for users attempting to log on" Located here... Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options ...and remove this from your policy. Set it to Not Configured. B) Is it in the registry of the build image? Check the registry of the computer before you capture it. Look for... "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticetext" "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticecaption" ...and remove them. C) Are you using my suggestion to deploy the registry items using Group Policy?

OK, we were in the same boat in 2013! A 3rd party contractor delivered a shitty config and we basically educated ourselves using Google and started again with the profile mechanism redirected in AD. In fact, every single server that the company deployed had bad configs which we slowly had to re-build. That aside, we were grateful for something to start with. If you had Windows 7 clients I could share our Default Profile folder with you so you could use them or at least have a starting point. I'd happily allow you some time to walk you through some tricks of how to manipulate the Default Registry Hive and things like that. You really should be giving Staff users a profile it makes life easy when it's done right. Some more tips for you then... Tip #1 Once configured correctly, if a staff profile does goes wrong (blame Microsoft!) you can simply log them off, delete or rename the server copy and the next time they log on they've get a new shiny default one. Don't forget the local profile copy on their computer. Tip #2 Local copies of user profiles are a bind, even if windows is configured to delete them after 1 days or whatever (it just doesn't work!). In order for the roaming profiles to get deleted efficiently we use a free utility called delprof2.exe. Simply run this as a start up script every time the computers boot and it deletes all local user profiles, for sure this time! E.g. [TABLE=class: info] [TR] [TD]"DelProf2.exe[/TD] [TD] /q"[/TD] [/TR] [/TABLE] If you need to "reset" a user profile get them to reboot which clears the local copy Tip #3 Buy Salamander Active Directory! By far the best £999 we every did spend. It provisions your users for you directly out of SIMS (other MIS are available overnight. S So HR puts someone new on SIMS and the next day they programmatically get an Active Directory account, Email address (O365 compatible) and a whole host of other benefits such as putting all your SIMS groups and timetables into O365 so everyone can use them in Outlook address and calendar.

CHiLL, Microsoft uses the network shortcuts folder as a default when it can't bring up the expected path. This path might be coming from the registry in a bad default local profile. We redirect profiles using only Active Directory "Profile Path" (not GPO) in the user object on the profile tab. The GPO for Folder Redirect on AppData we set to "not configured". Windows 7 loads the user's profile from the path we set in AD. If the profile isn't on the server it copies the default user profile first attempt from the domain NETLOGON folder, and if not then the local machine. We created and copied a Default User profile to our Domain here... "\\\NETLOGON\Default User.V2" ...and have made no changes to the local Windows 7 default user profile at all (straight off the install disk In our "Default User.V2" folder is a set of default AppData folders as well as an NTUSER.dat registry hive in which we've tweaked the "User Shell Folders" to point to sensible places. Have a look on a client computer registry here... HLCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Some important ones for profiles to work with Office are below... Name: AppData Type: REG_EXPAND_SZ Data: %USERPROFILE%\AppData\Roaming Name: NetHood Type: REG_EXPAND_SZ Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Network Shortcuts Name: Personal Type: REG_EXPAND_SZ Data: %HOMEDRIVE%\Documents Name: Recent Type: REG_EXPAND_SZ Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent Name: Templates Type: REG_EXPAND_SZ Data: %HOMEDRIVE%\Documents\Custom Office Templates If you would like to see the full list we have let me know and I'll PM it you. I'm not saying I've done it perfectly right though it seems to work for Office! haha When Windows 7 logs off the user it copies the local profile to the server and next time it logs on again the user's profile is available from it's server location. Permission for the User's data and profile network locations need to be perfect or it won't work! You need to make sure that the user can traverse the entire path on the server, not just access the SMB share. I added "CREATOR OWNER" to the root of my profiles path with Full perms. I then made sure our users group (e.g. Staff) can "create folder" in the root folder only. Similar set up for the data folders/home drives. If you need anything more let me know! I can PM you a phone number if it's easier for you.

Hi, I've just solved my problem with MDT breaking after legal notice text / logon message. There is a very simple way to delay the legal message based upon the presence of C:\_SMSTaskSequence. If you are using the GPO for "Interactive logon: Message text for users attempting to log on" and "Interactive logon: Message title for users attempting to log on" it's simple: DON'T!!!!! Instead of using the Interactive Logon Policy items, create registry items for the below... "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticetext" "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticecaption" You can then apply "Item Level Targeting" on these and only apply is folder C:\_SMSTaskSequence does NOT exist. It's as simple as adding a new "File Match" item and then right click on it, go to "Item Options", then choose "Is Not". Then change "Match Type" to "Folder" and enter "C:\_SMSTaskSequence" in the "Path". Bob's your uncle, MDT delayed Legal Notice Text which will apply after the MDT has finished (folder disappears)

Hi, I had the same issue with Folder Redirection and Profiles on Server 2012 and I've got some answers for you! I've been tearing my hair out trying to work this one out for two days now but here we go... The default "Recent Folders" in Office 2013's Save As menu contains the two options as you explained, Desktop and Documents. When you are clicking these they take you to the "Network Shortcuts" folder in the local roaming profile. The reason it is doing this seems to be user permissions. I realised this because our Technician users work properly and the staff do not. Giving staff our "Technicians" Security Group made Office work again (obviously not the solution we want)! OUR SETUP... We've Redirected the user profiles using the Active Directory ("Profile" tab on the user object) and pointed them at a hidden server share. \\Server\Profiles$\%USERNAME% When the user logs for the first time it creates a folder for the user (%USERNAME%.V2). \\Server\Profiles$\aUser.V2 The local computer has got Registry entries in the "User Shell Folders" Key within .DEFAULT that point to %USERPROFILE%/Roaming/. The user gets a copy of this and one of the entries is "Nethood" which directs to the "Network Shortcuts" folder in the profile. When the user logs off it synchronises the local profile up to the user's profile Share on the server (normal Windows process). Our GPO for Staff restricts access to local drives and folders. The user is logged on to the computer with a LOCAL COPY of the server profile. C:\Users\%USERNAME%\AppData\Roaming\ Thus the user's LIVE profile is restricted by Domain Policy. Because the user's profile is restricted in whatever way it fails to validate/make a network shortcut to the "Desktop" and so Office 2013 fails to open the folder and ends up presenting the "Network Shortcuts" folder instead (this folder is writable by our users it seems). THE SOLUTION... As you requested that you don't want the Desktop option I'll share this finding with you first. I don't know how to hide the desktop option but we had some accidental success when our Network Manager tried deleting the "Network Shortcuts" folder from a user's profile. After deleting the folder, Office 2013 directs the users to "Documents" for whichever Recent Folders option they choose. The better solution is to use your Folder Redirection GPO to redirect the AppData folder to the same server share as Active Directory does. Basic - Redirect everyone to this folder - \\Server\Profiles$\%USERNAME%.V2\AppData Note the ".V2" after %USERNAME%. This is important. After you save the setting go back into it and you will see it has changed to "Create a subfolder within" and shows an example of \\SERVER\Profiles$\Claire.V2\AppData. If you choose this option straight off you don't get the .V2! Also go to the "Settings" tab on the Folder redirection and be sure to CLEAR the "Grant user full permission" tick box. Otherwise you won't be able to browse the folders as an administrator (it'll prompt for "Get Access to this folder"). I've also cleared the "Move contents to new location" too. The Active directory profile thing will create the folder on first log in and the GPO Folder redirection of AppData will direct the computer directly to the server copy making it LIVE. This fixes any permission problems as the user has explicit "Full" permissions and ownership of the profile folder, and therefore the LIVE profile as well. Now our Office 2013 behaves properly when Saving new files (or Save As). We've also got a HomeDrives$ share for the User's Documents, Pictures, and all of the other personal data containers. It's also set on the "Profile" tab in AD. Map Home Drive H: to \\Server\HomeDrives$\%USERNAME% We also has a GPO for the folder redirections to this UNC path (don't use the Drive Mapping anywhere in case you decide to change the Drive letter later on). Same things apply to Folder redirection "Settings" Tab, CLEAR the "Grant user Full Perms" tick box or you won't be able to browse it as an Administrator. Choose to Direct everyone's folder to the following paths... \\Server\HomeDrives$\%USERNAME%\Documents (for Documents redirection) \\Server\HomeDrives$\%USERNAME%\Pictures (for Pictures redirection) ...and again notice that going back into it shows "Create a folder for each user" option with an example for Claire. When you set up your Profiles$ and HomeDrives$ shares be careful what permissions you have (Security Tab). You shouldn't give your Staff Security Group Full access to this, they only need Special Perms to Create a Folder, and only within "This Folder Only" not sub folders or files (have a google for other permissions on profile folders such as adding Creator Owner). I found that giving Ownership of the Profiles folder to "Creator Owner" meant that when AD creates a new User's profile it gives Full Ownership to that particular User on the .V2 folder which is what we wanted. I wrote a PowerShell script that is for the Personal Data shares that grants each user's home folder the correct permissions and ownership. This is possible with the HomeDrives because Active Directory creates these folders immediately when you update the setting. We also used PowerShell to pull the Old user data from our Old server as part of the big Migration. Please ask if you would like help making such scripts! Hope all of that info helps you understand what's going on with your Office 2013, Profile Redirection and Folder Redirection too. Sorry I didn't figure it out sooner to give you more time to implement it before Start of Term