MrMuppet

You're probably right, and here I thought I was being the muppet, as usual, but not this time it seems! Thanks again.

Turned UAC on, rebooted the server and all of a sudden we can now login! If anything I would have thought that UAC would be interfering in some way and that's why it was originally turned off. Perhaps it was just the reboot that sorted it? Who knows! Regardless, it appears to be working now. Thanks so much for your help and suggestions.

Both the Firewall and UAC are turned off on the server ESM is running on. The ESMServer application states that the server is running, but the Start, Browser and Upgrade buttons are greyed out (should this be the case?) As mentioned previously, we can get to the web interface of the server, it just doesn't recognise the user name and password for some reason.

The school doesn't use a proxy server (as far as I'm aware; there's nothing configured in the LAN Connections tab). There was an entry in the Proxy tab for ESM but I've just tried removing it but still the same issue. That said, they are an LGfL school so it wouldn't surprise me if LGfL have blocked something, somewhere down the line. It's been a while since they've used ESM.

Yeah...came across a few other threads about this software shortly after posting. None really seem to relate to the issues I'm having though, but I'll keep hunting. Cheers for the link though, may come in handy. However my issue now is that we can't log in to ESM.

Well, it connects to the web interface okay, however the login credentials we have don't appear to work any more. We've contacted Pearson and they say they've reset the password again and everything is okay their end so it must be on our end (I'm not entirely convinced but there ya go). The only thing I can see that might cause this is that when the ESM application is started on the server, it complains about not being able to communicate on port 8080 and 443 then says to make sure IIS isn't running. Well IIS isn't currently running but it still displays this message. Any thoughts?

The instructions I was sent from Pearson are for installing it on the client. This is my first time dealing with this software so I'm kinda fumbling through it at the moment. This is also on a network we've inherited from another company and the way it's been setup is absolutley dire; inconsistent server names, folders being re-directed left, right and centre, and don't even get me started on AD. Suffice to say it's a mess. Anyway, I've found the ESM is installed on one of the servers and after a bit of digging through user profiles I've also found a shortcut to the web interface which appears to work (as far as I can tell). Just waiting back to hear from the client to confirm it's working. Thanks for responding though, I'll update when\if I hear back.

I'm having a rather irritating problem with installing the Enterprise Site Manager software on a teacher's laptop. The installer keeps telling me that Adobe Reader\Acrobat version 6 or above needs to be installed. The laptop already had Reader DC installed so I tried uninstalling that and installing version 11 but it keeps giving me the same error. I remember a similar issue with another piece of software (years ago, can't remember what it was) but I needed to give users permissions on the ProgramData folder as there was a bug in Reader Version 9 I believe. Anyway, thought it was a long shot but tried anyway and still gives the error. Just wondering if anyone else has come across this or could shed some light on what might be the issue. I've tried contacting Pearson but they are being rather unhelpful.

Glad to hear you got it working! And thanks for posting that link as well, might help with troubleshooting my own App Locker problems.

+1 for mapping home drives via GP instead of login script, much more reliable. In fact for our Windows 10 deployment, we got rid of the policy for mapping home drives and let AD handle it by setting it in the profile tab in the user's AD properties. However that doesn't solve your issues running scripts. I had a similar issue where students were prevented from running their Visual Studio projects from their home drive despite there being a rule explicitly allowing students to run exe's from their home drive. I assume in your 'Allow Domain Admins' script rule, you've got the path to the Netlogon folder. As it's a batch script you've got, it's calling cmd.exe to process the commands so you may need to add an executable rule to allow domain admins to run all files as well (perhaps it's not picking up the fact that Domain Admins are a part of the Builtin Administrators group?). If you manually run the scripts on a Win 10 machine, does it produce that same error in the App Locker event log?

Yeah that was one of the first things I tried I'm afraid. However I do think that what that article describes is basically what issue is, just not as simple a fix. I can stop and start the App Locker service no problem, but if I try and make any changes to it's settings (setting from Manual to Automatic for example) I get an access denied error. Correct me if I'm wrong I think where it's falling over is the App Locker service isn't being started when the PC boots up so isn't applying any of the new settings. Also, manually starting the service then running gpupdate doesn't make a difference.

*Bump* Anyone have any ideas?

Aye 'tis a real pain. My advice, if you're using Applocker, don't remove any of the default rules . Either that or move away from Applocker entirely and use the registry to deny specific exe's; however that won't work for packaged apps like the windows store but at least it's easily reversible.

Yeah it seems Windows 10 isn't yet free this either. I'd like to avoid a re-build if at all possible but I may just have to accept we need to re-build half of the college...again.

I've been battling with Applocker for a while now and figure it's time I ask for some help. Background: So I created an applocker policy for Windows 10 (LTSB) to prevent students from running internet browsers on their exam accounts (I also set the security filtering of the GPO to only apply to students on the exam security group, but it decided to apply across the board for some reason). I setup the policy with the default rules and included deny rules for Internet Explorer and Firefox. This worked all fine and dandy, however a short while later I get a call from our ICT department saying none of the students can open their visual studio programs (they could open the project but not the exe's they created). I tried including the path to their home folders (where all the project files are created) as an allow rule but didn't work. As it's unlikely the students signed their exe's I figured I'd remove the default rule about only allowing signed Microsoft exe's and this got them working again (feel free to slap me up-side the head on this one, turns out by default Applocker denies all programs and packed apps unless you have these default rules, who'd-a thunk it!). As you can probably guess, the next day disaster strikes and no one can login. Disabling this policy and re-booting the machines got them logging in again, however here's where the real issue beings. The Problem: The Start Menu, Notification bar, sound bar and Time & Date panel no longer work. Right click works to get the context menus up, but left click literally does nothing. What I've tried so far: - Enabling the Applocker policy, removing all entries and clearing out the policy, then gpupdate on the affected machines. This has fixed some but there are a few machines still unable to open the start menu and no amount of gpupdates and re-boots fixes it. - Removed a machine from the domain, removed all group policies from the registry and re-booted, still no dice. - Removed all the applocker files from C:\WINDOWS\System32\AppLocker and re-booted. - Took the applocker files and Start Menu tile database from a working machine and copied them to an affected machine, still nothing. - Removed all locally cached profiles and created new local admin account, still the same problem even on the new account. - Ran DISM and SFC multiple times, both report there's nothing wrong. - Checked the App Identity service, it wasn't running so I started it, did another gpupdate (laptop was back on domain at this point) and re-booted. - Checked again and the App ID service was set to manual but I couldn't change it, get access denied; so I set a policy to make it automatic start but it's still set to manual. In-fact, any change I try and make to this service gives me an access denied error. Can make changes to other services no problem. I've checked through event viewer and it shows under the "EXE and DLL" log that the Applocker policy is being applied. However under the Packaged App Deployment and Execution logs, the last entries were on the 18th Nov, shortly before I made this new Applocker policy, and these only say wether an app was allowed to run or not. There is another interesting entry in Event viewer, however it doesn't give me much actual information; in the "Microsoft-Windows-TWinUI/Operational" log there are many 105 entries that start with "The description for Event ID 105 from source Microsoft-Windows-Immersive-Shell cannot be found" and goes on to say the component could be corrupt. As I understand it the "Immersive-Shell" is basically the Metro UI. So it's clearly trying to tell me something, it just doesn't know what it's trying to tell me. My guess is that the Applocker service is being denied access when it tries to update whatever it needs to in order to fully remove this policy. So my question is: Without doing a repair install/re-image, how can I reset/restore the Applocker service to it's default state? Failing that, how can I get the Start Menu and Notification Centre working again?