Ephelyon

(Just to watch - if you're on 2012 or 2012 R2, the latter does things differently. I wouldn't recommend this method if you're not on R2 or 2016.)

This one has bugged me for years, so having today worked out a solution, I thought I'd share it. Tested on Server 2016 but I imagine it should work on 2012 R2 as well. I expect many of us will be familiar with this problem. Educating users on entering DOMAIN\username instead of just their username is not always successful, resulting in a second logon prompt where Web SSO has failed (i.e. on non-domain home computers) that then appears not to recognise their credentials because - for some totally bizarre reason - it defaults to authenticating against the local RDS server instead of against the domain. It turns out RemoteApp is much happier when using the UPN logon format instead of DOMAIN\username, to the extent that you can remove almost all prompts and avoid the second logon prompt entirely by using this format. Problem there? We've come back to the same old question of educating users... so here is a workaround! Let's assume the FQDN of our internal domain is "greenabbey.internal" by way of example... We are editing two files: %WinDir%\Web\RDWeb\Pages\en-US\Default.aspx %WinDir%\Web\RDWeb\Pages\webscripts-domain.js In Default.aspx, find the following: TSFormAuthTicketInfo objTSFormAuthTicketInfo = new TSFormAuthTicketInfo(HttpContext.Current); strUserIdentity = objTSFormAuthTicketInfo.UserIdentity; bPrivateMode = false; strDomainUserName = objTSFormAuthTicketInfo.DomainUserName; ... and replace "false" with "true". In webscripts-domain.js, find this: var strDomainName = ""; ... and this: var bPrivateMode = document.getElementById("rdoPrvt").checked; ... and alter as such: var strDomainName = "@greenabbey.internal"; var bPrivateMode = true; Now find this in the same file: strDomainUserName = objForm.elements["DomainUserName"].value; ... and insert the following lines after it: if ( -1 == strDomainUserName.indexOf("@") ) { strDomainUserName = strDomainUserName + strDomainName; objForm.elements["DomainUserName"].value = strDomainUserName; } With all of this done, all I got on a fresh installation of Windows 10 1607 in a VM with no customisations whatsoever (i.e. to simulate a home computer) was the single "are you sure you trust this provider" pop-up, which has a tickbox to never see it again. Magic! We are doing a couple of things here: 1) Setting Private Mode to work in such a way that it behaves like Public Mode in terms of not remembering the username or storing cookies, but acts like Private Mode when it comes to setting up the RDP connections (i.e. you can tick the box about trusting the provider); 2) Inserting the "@greenabbey.local" UPN tag after the username on submitting the form, so they don't have to do it themselves. The If statement in webscripts-domain.js just makes sure it doesn't insert the UPN tag if there is already an "@" character in the username, e.g. if the user had ticked Private Mode after all. So... only been banging my head against this one for the past 6-7 years!!! I think the edits given above were the only ones I ended up making (after reverting several other attempts). Would anyone with this problem and either Server 2012 R2 or 2016 like to try it out and report back? (Oh, and I've also found that if any educated users do use the DOMAIN\username format for the initial sign-in, they will be prompted a second time when initiating an RDP connection but this time it will accept their password, without the need to enter a domain this time!) EDIT: You may need to clear cookies on your testing workstation too!

Me too... we've gone for a more heavy-handed approach here since we passed the point of having more machines on Windows 10 than Windows 7. Essentially I keep the Windows Update service stopped and disabled through Group Policy for all Windows 10 workstations, then I download the .cab files for latest Cumulative Update (plus any random others like Servicing Stack updates) every month and deploy them via a startup script at some point when everyone's gone home. The script checks the UBR value in the Registry for the workstation's build number and exits if it's current, so whenever there are new updates I just drop them in the deployment folder (replacing the old ones) and update the minimum build value to check for in the script - five-minute job, then reboot all workstations via Impero. Makes things so much easier now we have Cumulative Updates and saves on bandwidth of individual workstations checking for them (even if not actually downloading them) and means I have total control over what build number we have around the school. I also slipstream them into the image every month for new deployments. That said, perhaps @timbo343's solution is more elegant...

Depends whether you mean students or staff, to an extent. Also depends how much you want to deploy on logon in terms of GPP Registry settings. Then there's whether you redirect AppData or not.

Ah, but of course M$ will tell you the answer to all this is ExpressRoute! So that'll be the recurring cost of another leased line plus about £750/annum for the service, then... plus around 2p/GB for all outbound traffic over that line (saving back ESR data, for instance)...

Our staff use Roaming, while students use Mandatory but both have their AppData redirected so they still get a fair bit of customisation. Profiles through Azure AD or anything OneDrive-related is still going to use bandwidth, though, that I'd rather not have to commit from the Internet connection when I've a perfectly good internal network and servers that could be taking that load. It just doesn't make sense to be constantly pulling and pushing that kind of data from the cloud when you've got hundreds of people essentially hot-desking around the site every hour...

Thanks for this useful cross-post. And now I am going to make a "cross" post. So here we are again. Six months ago it was "you WILL use the cloud, and it will be OUR cloud, and you will use it for EVERYTHING (and, psst, we will train you up to sell our products to your leadership teams)". Now we have more of the same with dumping locally-hosted RUP and trying to pull ESR settings down from the cloud all the time... every sixty minutes... for hundreds of people... this is madness! Oh, and the olive branch for locally-hosted is supposedly UE-V? So I'm going to waste hours packaging individual apps with settings when we could perhaps just not deprecate RUP because it works perfectly fine?!

Windows Update tends to offer you everything and then work selectively in terms of update dependency, obsolescence or incongruity the next time you check. I've often see it offer several security patches along with a cumulative security update that supersedes individual packages. Those packages are then reported as Failed but mysteriously don't reappear if you reboot and then check for updates again.

If it wants to put them all on, why not let it?

Permissions are a good shout - if it's a Unix-like OS, the user running Java may not have permission to perform socket I/O operations on those ports. Also, is the server actually listening on localhost? If you configured it to listen on the server's public (or private) IP address, it might not be listening on 127.0.0.1...

That's where refurb comes in, especially if it's mostly used for testing. We've just picked up a DL580 G7 with 32 cores and 256GB RAM for £1.5K!

We're experiencing this too.

@Mic_Impero It seems there's definitely something up with the way Impero interfaces with WinLogon. I've been having to reboot our new 2016 RDS host a lot lately, because after a while people just get a black screen when attempting to log on through RDP (this is before the user profile and etc is loaded though). I've attached a stack of events we get logged whenever it happens. WinLogon.zip

This is why I'm going to standardise on octacore processors for the time being - just means I'll need more sockets to get the number of cores required. Problem with that, if you're using VMware, is that hosts can have up to two sockets each on Essentials Plus, so you could find yourself facing a hefty bill to upgrade to vSphere Standard. That's why we went for Hyper-V in the end - they wanted about as much for the Standard licensing as I was about to spend on server hardware. Now, normally, as Network Manager 'n' shizzle, I clearly spend a great deal of time considering and weighing up different technical options. In this case, though, it was about ten seconds of staring at the VMware quote followed by, "That's it! We're moving to Hyper-V!" Currently running two hosts (on-site), both with four Opteron hexacores each and 128GB RAM. Will shortly be upgrading to hosts with four Xeon octacores each and 256GB RAM. That should sort us out in private cloud terms for the next few years, while making sure our Windows Server licensing remains simplified...

True. This also has to do with Software Assurance.

I'd ring up a few MIS providers and ask how they do it. We're thinking about moving to Bromcom. They have a module - e-Census - that specifically takes care of these things. They also have an e-Finance module to replace FMS, and an e-Timetable module to replace Nova-T. Interestingly, you can continue to use both FMS and Nova-T and import into Bromcom, and then move over to their own modules when you feel ready. Either way, e-Census will take care of the statutory requirements. I've had the same rumblings from my SLT about changing MIS: "... but we know SIMS will do what we need." *Ahem* NEWSFLASH, SLT!!! SIMS, CMIS, PARS, Progresso, E1, Arbor, iSAMS, DoubleFirst Engage, Bromcom... etc... they are all being sold into schools and all schools have similar statutory requirements. They will all "do what we need"... the question is how well and how cheaply!

... unless Single Status is involved, of course, or an Academy has TUPE'd people over from the LA and not bothered to review salary scales afterwards...

Redundant hosts - one on-site and one off-site. The on-site one runs the RDS server most of the time, so it's not sitting there doing nothing, plus that gives it gobs of juicy resource to work with, so our RDS experience is very smooth.

Well, to be honest, we're looking for typicality, and quite a lot of Technician roles are part-time. It's also useful in the context of the debate that Voice is raising around TTO TAs in Derbyshire and Durham. Lower-rate jobs are what I mainly go for, aside from the NJC payscales stuff, because they're the ones where the school isn't recruiting properly. Maybe Tony could share his spreadsheet so far with you so you could see which ones are being picked up? And, once again, thank you

It's also where Tony and I get a lot of our "jobs for the list" from (Y)

... which is what you'd expect to see for that role elsewhere (and should here too), yes. Then again, I think @GrumbleDook and I may disagree on this point...

Agreed - I think another issue is that technical knowledge and skills aren't really valued as something to pay well for in this sector. The pay only goes up when you take on more management responsibilities, which is appropriate in its own right but it shouldn't be restricted to that alone. It's often different in industry, where you pay more money to hire a better programmer, say, rather than only for a programming team leader.

We're finding performance is fine, but every update is breaking something else again. Lots of compiler errors showing up too. I continue to prefer PARS Connect over SIMS Lesson Monitor (as we never bought that to begin with), but I'm thinking of recommending that we dump the lot and move to Bromcom in terms of both pricing and feature integration (they also do a VLE, parent portal etc).

Might want to redact that Activation Code there... To be honest, I don't think Impero is the actual cause of this issue - I think it's a Microsoft bug that goes right back to Windows 8. I do think, though, that a number of different interactions could be exacerbating the problem, so eliminating factors like DLL hooks ought to reduce the instance of the problem, but probably won't actually eliminate it on their own. I think that's what this thread is evidencing. It's as though the shell tries to load, fails and then gives up, which ought to be a very simple programmatic fix along the lines of "continually retry"... and that's why this bug is so very frustrating! It should be child's play to have userinit.exe check if the shell is running after X seconds and relaunch the process again if it's not... :/

You should just be able to enter the filename.