technodan

Interesting. We've actually already got the wait for network stuff in our policies, as I thought it might be related to that. When we first deployed Windows 10 we had a lot of trouble getting machine policies applied consistently - we solved that by disabling fast startup in the registry (as Group Policy only seems to let you force it on, not off) Set the registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power\HiberbootEnabled to DWORD 0 Be warned though that on HDD-based systems especially it really is quite a lot slower!

Running Get-GPO on that GUID tells me that it's the Default Domain Policy. You would think that if THAT was broken, every machine would whinge surely? I'll have a dig through it and see if there's anything amiss. Thanks for the tip - we will do some testing this half term!

Every now and then one of our PCs will completely fail to apply any group policies. In the event viewer Windows\System log we get the following: When logging in the user doesn't get any mapped drives etc (we first noticed it when users reported SIMS didn't work). The machine then won't apply policies for any users until I do a gpupdate /sync and restart. What's odd is the gpt.ini link in the error message is clickable - and when I click it, the file opens, so there is obviously communication occurring. I can also ping both DCs and browse to NETLOGON and SYSVOL. We have the same Windows 10 image (1703 Education) on everywhere, and the issue has cropped up on a couple of different models of machine. It's not reliably happening on the same machines either.

Hmm, that's a new one. What if you use Group Policy Preferences to make a new Open With preference (in User > Control Panel > Folder Options) just for .url files?

"New" logins (i.e. people who haven't logged onto that machine before) shouldn't have the apps present. Existing ones will need to be cleared off, via Delprof2 or similar. I'm not sure how that will work if you're using mandatory/roaming profiles - we've just stuck with local profiles for now (with group policy preferences to configure a few settings, hide some "first run" splash screens etc).

"New" logins (i.e. people who haven't logged onto that machine before) shouldn't have the apps present. Existing ones will need to be cleared off, via Delprof2 or similar. I'm not sure how that will work if you're using mandatory/roaming profiles - we've just stuck with local profiles for now (with group policy preferences to configure a few settings, hide some "first run" splash screens etc).

Is the Application Identity service running? What shows up in your event logs? Also (and I credit this to me setting it up on a Monday morning!) make sure AppLocker rules are actually marked as configured and enforced...was wondering why on Earth it wasn't working in production (after it working fine in my testing environment) before I remembered to tick that!

Do you want to use Photos at all? You can completely get rid of it by using Remove-AppxProvisionedPackage in Powershell. This will uninstall it for all users. As for the other apps, you can create an AppLocker packaged app policy (Computer Policies > Windows Settings > Application Control Policies > Applocker) to deny running them. Any new logins will simply not have them in the Start menu at all. Existing logins will still have the apps present, but users will get a message saying "This app has been blocked by your Administrator." You can block/allow apps by user group so if you wanted e.g. staff to use Edge but not students, you can do that. Make sure to have an "Allow All" rule in there somewhere though or certain built-in functions (e.g. Domain joining) will break! In the screenshot below I'm blocking Edge, Contact Support and the Connect app, but allowing everything else.

We stumbled across this issue recently. Do you set about:blank as your homepage as part of an MDT task when imaging? We eventually fixed it by going to User Configuration\Administrative templates\Windows Component\Internet Explorer and setting Disable External Branding of Internet Explorer to Enabled.