Trevelyan

Ok so the original guy at TV Licensing hadn't told me to enquire about "Multi licensing" - the next guy gave me a number for them. They've then discussed it, have no idea, passed it back to the guy who I think passed me to them. He now says "you've got a valid license so.. I'm not sure what to do. You've got a valid license".. I was then passed to another dude, probably more senior, who said there's no problem, just have to skip the signin part and we don't have to register. I said you do, he said no you don't, I was looking at iPlayer last night. I asked him to try it himself. His reply: "Oh yeah" Looks like this is something that has changed this morning, really. But odd we are the first education place to have contacted them about it. JISC are also on the case now I think, after we've been in touch with them about it. I imagine they would surely change this later so that, for example, JISC IPs are excluded from having to signin or whatnot. At least, I hope so!

TV Licensing were useless when I called; they said you need one license per room you're broadcasting in. And all students will have to share one account. Lovely. JISC time!

We already have a license but we have about 2800 students/1500 PCs. They can't all use the same email address!

Where I work, it looks like users now have to sign in to be able to access content on iPlayer - has anyone had any experience in how to get around this or is the strategy for everyone to register their own account in order to do this?

Overall, this sounds like a real pain to do. It clearly isn't something that Microsoft have given support for and it seems that theres a lot of scope for mess. I think we will stick to fixed layouts or partial layouts. Unless it all changes later!

Unfortunately, if users make changes they wont travel with the user when they move, right?

(For clarity - this is about the start layout and not the start menu. Start menu is not going to be redirected and we want to just do what we do with that anyway) We're looking at deploying a custom start layout for users. Exporting a layout and deploying it via GPO looks like it works well, albeit a few programs not showing up, but of course people can't then customise the menu by unpinning and moving things about. We really want to be able to give them a default menu that they can then customise if they want, but the partial start layout would probably be that bit too unintuitive for most users. The key thing is, however; has anyone got a nice way to actually make the start layout roam with users? Is it stored in somewhere nice that folder redirection would be able to help with? Customising their tiles would be completely useless if they don't keep that layout when moving anywhere else! One idea I had was a logoff script that exports their start menu to \\server\%username%\layout.xml and then have the Start Layout apply that file at login - but then they can't customise that in the first place.. seems a bit of a rubbish way to do it really. If anyone has any ideas or tips for how to make a default layout that people can change work, that'd be ace. Or at least, one that roams with them! Many thanks!

Right, solution within Windows (without externally blocking anything) is to disable (set to 4) the Appxsvc in HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services\Appsvc Any apps already installed then cannot be uninstalled, however, but combined with blocking the store, it then blocks Edge's ability to install stuff itself. Seems like a really messy and horrible fix but it really does but a definitive spanner in these works for app installation. (I think It's also worth changing the homepage in Edge and making new tabs have a blank screen. But that has to be done through a machine GPO for some bizarre reason)

I just read your thread from November on it.. insanity. You can't Applocker the store or anything else to counter it, but I asked about this on Technet too and someone acknowledged it there. It looks like the suggestion is to disable the AppXSvc but I haven't figured out how to do that. Even via GPO that service doesn't want to be disabled. If I can't fix this by our mass rollout date then yeah, it'll have to be blockerised.

Well you can still technically navigate there by going to both https://www.msn.com/spartan/dhp and https://www.msn.com/spartan/ntp They don't seem to have the same behaviour in Chrome or IE as they do in Edge, so it might be a built-in library that provides this functionality. I could just GPO block all links to ms-windows-store, though..

1703 and no, I can't - but it seems to just be the intial start page for Edge. If you follow the links to get to the store on the web, those will always try to access the store app. I'm wondering if this perhaps wasn't intentional; it sort of bypasses everything else and just allows installation of an App without having to go through the store (well, I have the Store blocked by end users so it clearly isn't using the store).

A bit dirty but a good idea - removing TrustedInstaller worked and now it hangs at 0% in the browser. You also get a notification saying that it had troubles installing it but it'll try again later. Will see how that works out.. I tried to block everything else in Applocker that *wasnt* Edge, but it didn't stop it. Edge just seems to have diplomatic immunity from any system policies for things like, you know, app installation..

So you actually have to block Edge itself, you can't just block its app-installing behaviour?

Looks like the SCCM installation was a bit broken. CCMExec.exe was corrupted and even the site reset wasn't helping. I restored a backup of the installation disk from a few months ago and all works fine now!

Nope to both unfortunately, no easy fix! I've tried https://www.windows-noob.com/forums/topic/6447-sccm-2012-pxe-point-reinstall/ - followed all steps, same issues persist. Thinking to try MS support!

We've had an issue that has persisted for about 10 days now, which has gone unnoticed by myself because we haven't imaged a whole lot of PCs lately. Essentially, we get the "E53 - No boot filename received" error when trying to boot clients. Wireshark shows that the distribution points receive BOOTP traffic, so I am inclined to think that this is not a network issue (and nothing else has changed) Moving on - both our WDS enabled hosts that we have seem to be functioning fine. No changes have been made, there's no errors on the servers and the event logs show that PXE services start up fine, although two days ago, both have had the following entries spam up 8 times at once in their WDS logs every 15-25 minutes: I then tried to look at the PXE logs on the distribution points, but they only go back a day. I'll post those in a second, but here's what we usually see in smsdpusage.log when everything works OK: What we started seeing 10 days ago, was the following: I have no idea what the code of 3 means, but here's what our SMSPXE.log looks like continually, repeated over and over again.. We've tried restarting services and systems but no luck so far. My predecessor set our SCCM site up before I arrived, so although I am happy to try and troubleshoot this more myself, I could spends hours tangling myself up in this with no real direction of where I should go to next! Any help is very much appreciated!

Cheers for that, will give it a poke around!

We're rolling out Windows 10 to a few machines and someone spotted a seriously annoying feature in Edge. It seems that normal users, even with access to the store blocked, can install apps via Edge. Opening Edge and scrolling around under "My feed" will eventually get you to this: You also get the same thing under "Top sites" on a new tab in Edge: Daily Mail are you serious Microsoft?!? Anyhow, notice how it lets you "Install app".. clicking this then just, well, installs it on the machine without any route through the store it seems and I have no idea how to turn it off. You can click the link to see more apps to download and it takes you to the MS Store page - here, you can see loads more apps, but you can't install them, since it tries to open them in the Store app (which I have blocked). However, it seems as though the GPO to block the Store simply stops you opening the app, but doesn't disable functionality to install apps. And, even if you enable the GPO to disable all Store apps, it doesn't stop you installing them as above (which means you can install this crudware, but you can't open it. Failington Failford.) Has anyone found a solution for this? We don't really want people randomly being able to install apps, but we need apps to work because Microsoft decided that the Calculator app should be the One And Only way to add two numbers together on a computer. Maybe block all apps and make an exception for Calculator?

From a slightly different angle, I have developed a program that does something similar, although it grabs data from hosts instead of switches. Its a really simple libpcap application that you can run manually on every PC (like using a Fluke tool on a port) or set to automatically check as a PC starts up and record the results in a database without any input. I have a bit of PHP that then pulls all the machines and their details out of the database and you can filter them and suchlike. Its part of a bigger project I'm working on, but you can use it to record the host and switch port details, which you can either cross-reference with an SNMP-generated list or you can work it out for yourself from the tables in the database. If its something anyone would be interested in, feel free to get in touch. I use it at a college in Luton, as well as where I worked before at a University.

The problem is, certain applications will throw an error when attempting an install or configuration (with msiexec) as a domain user; error 1606 (Could not access network location), as well as error 1314 when inspecting msiexec logs. Some background on our infrastructure at where I work: We use UEV to virtualise a user's profile. They log on and then the following mappings occur: User files for their %homeshare% are stored on a network share, under \\fileserver\home$\username\ (e.g. Documents, Desktop, etc.) User settings for %appdata% are stored on a network share, under \\fileserver\setting$\username\ [*]Each user has access to their own shares on the paths above and have full permissions over their area. [*]Registry settings are as below, for a standard machine: This link suggests that the error is to do with registry entries, as do a few other Q&A links. Not to say that this isn't the answer (because changing all those entries does allow an application to successfully finish) but the real issue sounds like its a permissions or availability issue, since we want to be able to use UNC shares. For example, if I change a user's desktop variable from \\fileservc\home$\OTB\Desktop to %USERPROFILE%\Desktop (which is C:\users\otb\desktop), and try and run one of the listed programs below, everything works fine because a local folder is being used. It just seems like MSIs dont like being run where a user's folders are set to UNC paths. Usually. Here are some examples of applications we use where I've seen have the errors: AutoCAD 2014: Error 1606 pops up when a user (some users, not all it seems) try to run AutoCAD for the first time. If an administrator (local and domain) tries to launch it, everything runs fine and it appears that settings are stored locally, rather than on their network share storage area for their settings. Sometimes. But if a regular user tries to run it, the message appears that it can't access a folder. Autograph 3.20: Error 1606 pops up when trying to install AutoCAD as a domain user. Eventually the installation fails, because it can't access /SendTo or /Documents Examples from the msiexec log: MSI © (40:28) [15:55:12:744]: Note: 1: 1314 2: \\fileservc\settings$\otb\Microsoft\Windows\SendTo\ MSI © (40:28) [15:55:12:744]: Note: 1: 1606 2: \\fileservc\settings$\otb\Microsoft\Windows\SendTo\ Error 1606.Could not access network location \\fileservc\settings$\otb\Microsoft\Windows\SendTo\. MSI © (40:28) [15:57:45:230]: Product: Autograph 3.20 -- Error 1606.Could not access network location \\fileservc\settings$\otb\Microsoft\Windows\SendTo\. Cloud Drive Mapper: This runs for each user when they log on, to map their drive. This involves msiexec, which for most users, results in error 1606 when trying to map their desktop (whether this is what is intended or not isn't the point, its more that the logged on user can access a location that the setup can't seem to) Examples from the msiexec log: MSI © (70:04) [10:00:49:185]: Product: Cloud Drive Mapper -- Error 1606. Could not access network location \\fileservc\home$\OTB\Desktop\. MSI © (70:04) [10:00:49:185]: Note: 1: 1314 2: \\fileservc\home$\OTB\Desktop\ MSI © (70:04) [10:00:49:185]: Note: 1: 1606 2: \\fileservc\home$\OTB\Desktop\ MSI © (70:04) [10:00:49:185]: Note: 1: 2262 2: Error 3: -2147287038 I thought perhaps it was an issue with the local host running msiexec as "system", but the error logs seem to indicate that it is running as the logged on account: Additionally, the file server shows no error logs in event viewer - I tried to add auditing on a test user's shared folder and checking for failure on all policies under Local Policies/Audit Policy/. Nothing shows up. The only place errors are shown is on msiexec on a local machine. I've also tried trusting the test machine for delegation to the file server, and changing the file server's security settings to add the test computer account's with full access just to cover all bases. No difference. Has anyone got any ideas for anything else I could try, or anywhere that would give me more information/logging? I'm kind of stumped now - are we using incorrect settings somewhere? Will MSIs just never work nicely with UNC paths? Update: I worked out that modifying the registry to point to a drive path, mapped to the UNC path, works fine. But this is insane - why can't I just use a UNC path everywhere? Thanks for any suggestions anyone can come up with!