Mujja

@cjef sent PM with the login details

The students and admins will still be able to logon with local accounts. If DfE delete from their Intune and AAD tenant, I think any applied policies will remain, but users will now be able to modify them. Just make sure you download the BIOS and localadmin passwords before the devices or access is removed from the DfE portal.

Have you tried F7?

Which model of the Geobook 1E, the 1909 or 114? I found the 109 works out of the box with most USB to Ethernet adapters. The 114 only worked with a couple. I didn't mess around with the BIOS trying to get the others to work, sometime to try for later.

A lot of the devices now show two IPv4 boot options, one for HTTP and the second for TFTP, always pick the second one What options were you changing in the BIOS? Did changing the same options again end with the same result?

I would avoid any tablet device, the current ones are all Dynabooks (Toshiba) with or without a keyboard. As much as MS would want you to believe, Windows isn't ready to be used on a tablet device. For Windows laptop you could end up with a Dell Latitude 3190, a HP 250/255 or the Tactus GeoBook 1E (GE109 or GE114). Some GeoBooks comes with a gloss display which look way better than the matte display.

What's preventing the desktop from PXE booting? Does the NIC have an incompatible PXE ROM? Try a USB to Ethernet adapter, one which you know PXE boots on other devices. A quick n dirty workaround, extract a Windows ISO to USB, delete USB:\sources\install.wim and replace with your WIM renaming to install.wim Create an autounattend.xml or unattend.xml and drop in to the root of the USB.

Is the desktop wallpaper on a remote share? If yes, modify the GPO to copy the image to the local computer and apply the wallpaper from the local disk. As for your DNS server IP config, it's what I do.

I'm going to be getting involved with Chromebooks from next week for remote learning. Started reading up on the guides yesterday, here is a good place to start. From the little research yesterday you can join the chromebooks to your domain allowing users to authenticate using the domain credentials and manage the devices using group policy. However, for remote users you would need to cloud management, Google Admin Centre. I already have a personal GSuite domain and will get some experience of policies on there. If you don't have access I believe you can signup for a free trial, if there isn't a trial it's only a few £/month for a single user.

Like you say, easier to switch to a EN-INTL ISO.

My unattend.xmlUnattend.txt

Just tested the en-intl ISO (SW_DVD9_Win_Pro_10_1903_64BIT_Eng_Intl_Pro_Ent_EDU_N_MLF_X22-02892) with and SCCM\MDT task sequence and the region settings are set correctly set to English UK. "prompted for admin credentials to install 'Optional Features'" I also don't see this. The last time I saw this was when I used a en-US ISO.

I posted the settings to disable Quick Access in this post

Do you have this reg value set to 0? HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DelayedDesktopSwitchTimeout We added the above to speed up login times, skips the preparing windows screen. Worked OK on our development computers which all have SSDs, but computers with mechanical disk displayed a black screen for a couple of mins like you described. We deleted the reg value which has replaced the black screen with the preparing windows screen and less calls logged to the service desk.

We've disabled "Quick access" on shared computers. If you disable "Quick access" in File Explorer you'll also need to make the default to open at "This PC" or you'll get an error when opening File Explorer. For non-shared devices where "Quick access" is enabled the folder redirection works as expected for the "Frequent folder". Libraries are hidden by default in File Explorer.

It's a user policy which will only apply to a domain user, how will it work for a local user account?

Currently use a powershell login script. A VBS script at logon which worked fine for years under Windows 7 was no longer reliable. Group policy wasn't any better either. The PS script at logon seems a more reliable but we've had to add a desktop shortcut to all student computers to run a DOS batch file to connect printer when missing.

Default apps worked the same way on 1809 as they did on 1709. We import an xml during the SCCM task sequence for Staff and import the xml using GPO for students. Staff are able to the change default apps and Students aren't.

The only issue I'm aware of is you need to stop provisioned apps from updating. If using MDT to build and capture you can add regkeys to disable and enable the updates in the TS. It's been a while since I created my MDT task sequence, there are more steps than I remember. At Postinstall Disable Store Reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore /v AutoDownload /t REG_DWORD /d 2 /f Disable Updates Reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v AuOptions /t REG_DWORD /d 2 /f Disable Defender AntiSpyware Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f Disable Defender Real-Time Protection Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f At Capture Image, before the last Create WIM step, reset all the values.

Use the same reg settings as in the attached zip. Imported in to a test computer and using the Registry Wizard in GPMC imported in to a GPO. Don't forget to change the file associations.

Do you modify the unattend.xml to add the reg key below? HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DelayedDesktopSwitchTimeout /d 0 We added this key as it was recommended to speed up login times, works great on computers with SSDs but no so good with a HDD. It skips the preparing windows screen and takes you straight to the Desktop. For new logons, with an SSD we noticed sometimes the taskbar wasn't populated or the Start menu didn't respond. With HDDs the user would get a black screen for a few mins, sometimes up to 8 mins (another issue). We've removed the reg key now, logon isn't any quicker but instead of a black screen user see preparing windows and complain less.

If you deploy the EN-US ISO and change the region to EN-GB on login the user will see notifications for "option features" where the English GB typing, text to speech etc packages are downloaded and installed. I don't remember if this was for every user who logged in or just the first user. In earlier versions the optional features could be installed as a standard user, in later versions the UAC prompt appears. You can test it yourself by going to Settings, Apps, Apps & Features. You now need elevated permissions to manage optional features whereas previously a standard user could browse and add features. I might be wrong as that was 2015/16 and we changed over to English-international as soon as the ISOs were available.

Almost exactly the way I deploy Windows 10. What issues do you have with file associations? How to you apply them? We found if applied using a script (e.g. task sequence) you need to apply every association, even if not changed, or you get the error notifications. If applying using GPO you only need a config file with the change associations. I'll post a link to the documents I followed when I find it.

"10.0.17763" will also filter W10 1809. Needs something extra like edition.

Have you tried DISM? It's what MS recommends for Windows 10. Run it against the exported driver pack you created for SCCM.