loosus456

Wow, seriously?

To answer the question: yes, it's absolutely good enough. In my opinion, you honestly don't need antivirus at all so long as three things are true: --You are using DeepFreeze AND --You have the machines scheduled to turn off every night AND --You have a note on the machines encouraging students to restart the machines before using them. If the machines don't have admin rights, that makes the decision even easier. However, we don't do this for one very simple reason: we have to follow State of North Carolina security policies, which state that all machines must have antivirus installed. It makes no mention of DeepFreeze as a mitigating agent, unfortunately. Otherwise, we'd use nothing on DeepFreeze machines, since important administrative work shouldn't be done on public machines, anyway.

We already use DeepFreeze, so we would not -- if we were using mandatory profiles -- use it for locking-down computers. In fact, we want just the opposite: we want users to do anything they want with these computers but have them reset when reboot. DeepFreeze accomplishes that. The problem is that profiles are wiped out each time the computer is rebooted, as well, which means that login times are always extremely slow. So, we essentially wanted to use mandatory profiles to speed-up login times, and they actually do accomplish that. But they are so broken that we gave up on them and just bought SSDs to get in the ballpark of what you can get with mandatory profiles. Such a a shame. In addition to the things you listed, Microsoft also does not allow mandatory profiles to use the Store in Windows 8.1 and Windows 10, which would be a problem for us as we have classes where the students have to do things in the store on occasion. Add up the problems with mandatory profiles, and it's just not worth the hassle.

Back in November, 2014, I reported to Microsoft that mandatory profiles were broken. Mandatory profiles were actually broken in Windows 8.1 as well if you used the official CopyProfile method, although the effects were slightly less noticeable. It still wasn't kosher to deploy in a production environment like that. I have reported these issues in Microsoft's Windows 10 Feedback app and in the Windows 10 UserVoice website. I have done this, again, since November, 2014. Nothing has changed. Microsoft gives not two damns about enterprise or education. If they'd acknowledge these issues, I might have less heartburn, but I'm not sure they are even on Microsoft's radar. Windows 8 had these issues for the entire time the operating system was mainstream, and Microsoft did not so much as wink to IT professionals that they were issues. I really wonder if mandatory profiles are even officially supported, anymore. Where is the (recent) documentation on how to properly, officially create them? Good luck finding it. I'd be surprised if current Microsoft programmers/engineers even know that mandatory profiles are a "thing." The folks that worked on mandatory profiles in Windows 7 are probably long gone.

Scenario: You freshly install Windows 10 RTM Build 10240. Before answering installation questions, you enter Audit Mode. In Audit Mode, you go into the Settings app to perform Windows updates, and you notice the next non-beta build is available. 1. Would you be able to install the new build in Audit Mode? 2. Even if you can install it, will you be able to perform Sysprep generalization after the update? I know this isn't possible to test because we have only one RTM build at the moment, but has Microsoft addressed this? Is Sysprep going to see new builds as "updates" (like Service Packs in the old days) or as "upgrades" (as if you were moving from Windows 8.1 to Windows 10)?