KK20

environment: 2x 2012R2 nodes (Dell R620's - full 2012R2 std install ), dedicated 10GB heartbeat via isolated switch, 10Gb to rest of network. Storage via HBA SAS to an MD3220 SAN (dual quad port on SAN , 2x HBA lines to each server one from each controller for multipath redundancy). 192Gb RAM about 70% in use if all VMs are on one node. The cluster hosts 8 VMs (not quite enough to justify 2x copies of datacenter yet). I also have a backup synology array connected via iSCSI (this is also included in the CSV) Firstly, the cluster "works", it can failover and VMs migrate happily. I inherited a dell T610 and was going to add this as a third node 'cause "why not". Redundancy is good yes? I setup 2012R2 the same as I did with all my Dell machines. The specs are the same other than CPUs (VMs do have the "different CPU" enabled as the CPUs in my existing R620s are mildy different so I have done this from the very beginning), same RAM, same NIC, same HBA setup. New node joined the cluster and all seemed to be well. The LUNs were added fine from the MD3220, the iSCSI LUN was setup fine from the synology. However. I ahve discovered that unless the new node is the "owner" of the CSV drives, it can "read only" CSVs. So if either of the R620 nodes are "owners" of a CSV the new node cannot write to the volume (read only) - this is for ANY of the CSV's, i.e. the ones mounted from MD3220 LUNs or the one from the iSCSI LUN. There is no corruption, no dataloss, nothing to suggest the CSV is dodgy (the VMs run quite happily on the new node as long as the new node is the OWNER of the CSV the VM is residing on). If the new node is the owner of (any of) the CSVs, the old nodes can read and write to the CSVs, it is just if the old nodes are owners the new node cannot write. Im sure ive had a brain burp and forgotten something, any ideas on what ive forgotten to do?

you could just change the registry directly if you wish. We still use a registry workaround to run a W10 slideshow screensaver at the CTRL-ALT-DEL screen (this wont help you in your particular endeavour but may give you a starting point) https://support.microsoft.com/en-us/help/185348/how-to-change-the-logon-screen-saver-in-windows

This cannot be true as we have many machines that have no SLIC (they have retail box windows 8 stickers on the machines- the physical windows 8 key has never been used as the sticker is there for audit purposes). We use KMS to activate these machines just fine with W10 edu (EES upgrade). I suspect you haven't updated your KMS client key. you can run an slmgr.vbs /ipk script on your clients if you wish, the KMS client key isn't a secret and you can WMI filter your versions too so you wont kill the wrong key.

The "windows 10 2016 LTSB KMS key" is for "active directory" activation only. If you want to activate using KMS server classic then you will need "Server 2016" activation key. I know because I went through these hoops. You can run active directory and classic on the same server at the same time. Server 2012R2 key for Windows 10 is only good for 2015 LTSB. I emailed the VL team with my agreement and simply asked for a server 2016 KM adding to our agreement. It was done within 1 hour. When I needed the office 2016 KMS key I telephoned and got one added to the agreement there and then on the phone. It was painless. Classic KMS activates using the "highest key possible" and will activate ALL other versions underneath it. The actual licensing count in this scenario is a paperwork exercise (afterall, you could have a couple of 2012R2 on KMS, server 2008R2, Windows 10 LTSB and Windows 10 1607 all running KMS client - the server 2016 host key activates them all)

don't take me as being pedantic; do you mean lock after a period of ACTIVITY or inactivity? Screensaver is the obvious choice for inactivity, just use a benign or transparent screensaver if you don't want it to LOOK like a screensaver. If you mean lock after ACTIVITY (the inverse of a screensaver almost) then you will need to look at scheduled tasks running regularly, ironically you will look at activating something on "task does not run in xxx time" based on inactivity (which denotes the task not activating because the computer being in use). The "does not run" can invoke a screensaver manually thus locking the computer.

MDT is available to all in a domain environment. It is quite a simple setup to get going. I suggest spooling a few virtual machines as test-beds. https://docs.microsoft.com/en-us/windows/deployment/windows-10-poc-mdt https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt I use snappydriver-origin, it is a nice lazy way to get drivers sorted.

How to run a post script after a Windows 10 feature upgrade with SetupConfig.ini - Jose Espitia was what put me onto the setupconfig.ini Great for running scripts post-WSUS feature updates. Get-AppxPackage -Name $app -AllUsers | Remove-AppxPackage will remove for users that already exist on the machine. Get-AppXProvisionedPackage -Online | where DisplayName -EQ $app | Remove-AppxProvisionedPackage -Online will remove from the system for future users.

I just created the entries manually for the new packages in the end (create default rule, rename default rule, change package name etc)

This is what kept me off S2D. What if I had hardware failure and needed to change the server in 3 years time? Do I need to migrate to a new cluster? Assuming new hardware joins the cluster, it may not LET you if the HW is different. Regular clusters can take different hardware (as long as the different CPU architecture is enabled) as we run a pair of R630 and an R610 in our cluster but as far as S2D goes Im not sure. Even MS own documents now say "recommend" not "must" https://docs.microsoft.com/en-us/windows-server/storage/storage-spaces/add-nodes when adding more storage. And thinking logically, how do you ADD more storage to servers without downtime? Surely you would add storage to your servers a bit at a time thus keeping the cluster up? But if you have multiple servers that have different specs, different drives and different configurations then I would guess you need to have your S2D within VMs https://blogs.msdn.microsoft.com/clustering/2015/05/27/testing-storage-spaces-direct-using-windows-server-2016-virtual-machines/ thus host your S2D infrastructure within VMs that are guests of dissimilar hardware hosts. That way the VMs are identical "hardware" as far as S2D goes. Need a new server? Add another host/guest to the S2D. The other obvious answer was starwind vsan as you don't need similar hardware.... The more I looked into S2D the more I saw issues. With 2 nodes the redundancy is "icky" at best (2 drives or 1 server? That's not a lot for a whole array - and you would be saving little over a 2 node cluster with a cheap HBA SAN - say a dell 32xx) 3 isn't much better. Since we already had datacentre licensing for our hosts we simply went with a 3 node stretch cluster

I'd guess drivers for both printer issues.

just found out about this. In the old W7 days you needed the local admin logon to do anything "bad" (you could system restore but only if system restore was enabled in the first place). this is not good. Scripting the BCDEDIT as a one off machine startup now...

There are many ways you can do this and it depends where you are starting from and what you want to do. Firstly, if you don't care that the start menu has the icons for all the apps and simply want to stop them opening, use applocker *and* a GPO to stop the store (otherwise there are ways around the applocker block for the store). This will not remove start menu items, it will not remove them from your installation but will stop the apps from opening. Applocker can be customised to let certain apps through for certain usergroups too (such as paint, calculator etc) If you are at "below" 1703, currently have the apps unprovisioned and uninstalled then be aware that 1703/1709 will put them back. This means you need to use a %systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini to spawn your powershell removal script following a WSUS feature update. This works well and ensures you still have the same unprovisioned and uninstalled appx If you have no W10 installed or are planning a fresh install then depending on how you install you can run the powershell in OOBE setupcomlete.cmd etc 1709 has changed the name of some APPX - for example, the "connect" is no longer miracast but is PPIProjection, XBOX has ballooned to a few entries too. Windows.Holographic.FirstRun is the mixed reality.

because I only want the updates installing after 16:05 not during the day. "Wait after system startup" gets registration out of the way too. It should be noted that this policy is unchanged from our W7, W8.1 and W10 machines (WMI exists to point to different client side processing), it has always worked for us.

Our W10 GPO for WSUS: computer->policies->Admin->windows components->windows update Allow Automatic Updates immediate installation Disabled Automatic Updates detection frequency Enabled Check for updates at the following interval (hours): 4 Configure Automatic Updates Enabled Configure automatic updating: 4 - Auto download and schedule the install The following settings are only required and applicable if 4 is selected. Install during automatic maintenance Scheduled install day: 0 - Every day Scheduled install time: 16:05 If you have selected “4 – Auto download and schedule the install” for your scheduled install day and specified a schedule, you also have the option to limit updating to a weekly, bi-weekly or monthly occurrence, using the options below: Every week First week of the month Second week of the month Third week of the month Fourth week of the month Install updates for other Microsoft products Delay Restart for scheduled installations Enabled Wait the following period before proceeding with a scheduled restart (minutes): 15 Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box Enabled Enable client-side targeting Enabled Target group name for this computer CommonUpdates;Windows10 Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates Enabled No auto-restart with logged on users for scheduled automatic updates installations Enabled Re-prompt for restart with scheduled installations Enabled Wait the following period before prompting again with a scheduled restart (minutes): 30 Reschedule Automatic Updates scheduled installations Enabled Wait after system startup (minutes): 30 Policy Setting Comment Specify intranet Microsoft update service location Enabled Set the intranet update service for detecting updates: http://:8530 Set the intranet statistics server: http://:8530 Set the alternate download server: (example: http://IntranetUpd01) Download files with no Url in the metadata if alternate download server is set. I always seem to be at 99% with updates, there always seems to be at least 1 update "waiting to be installed" at any one time....

Assign the .vbs to a computer OU as a user logon script and ensure Loopback processing is enabled as "merge". For the original issue, my guess is permissions. Somewhere along the line permissions are causing an issue. an existing guest already has the printer and doesn't query for additional drivers, queue, server information. A new guest has to and is failing somewhere.

Assign the .vbs to a computer OU as a user logon script and ensure Loopback processing is enabled as "merge".

Have you tried good old fashioned scripts? this might get you working whilst you look for a "proper" fix with GPP. Scripting does have one benefit - you can asymmetrically add printers via scripts to avoid long login times (GPP pauses and waits for timeout when a printer is offline or missing). don't forget you will need "loopback processing" if you are putting this USER logon script in a computer OU

Since 1709 is being rolled out by WSUS on our 1607 machines, I thought I'd update our applocker settings for the newer mixed reality offerings. However, as soon as I try and "select" an "installed packaged app as a reference" the MMC crashes with an exception. Anyone else having issues with applocker? The machine with RSAT was a 1607 that had WSUS upgraded to 1709. Applocker ran ok in 1607.

who knows. ask a dozen people and you will get a dozen answers. The same reason I had no issues with 1607 whilst others did.

This is no different from 8.1 and 7 not being supported on latest silicon. The worst case scenario is a new LTSB installation to be built and tested for new machines in 2019 (the next LTSB release). Buuuuut, you will need to upgrade your installation for "whatever CB is available" in that time anyway so I do not need the difference regarding "time wasted". Again, there is nothing in any of the MS releases that say LTSB is unsupported for general use. MS say "not recommended" and I guess this is because they have zero chance of store sales on LTSB. Not recommended is a far cry from not supported. Let us say (for example) you are a school that is on a lease scheme/decent budget. This scheme/budget gives you the latest and greatest every 3 years. Your upgrade cycle coincides with an LTSB release (i.e. 2016 was your last upgrade). This means that technically your next batch of PCs in 2019 will not work on LTSB 2016. this means 1x rollout of LTSB2016 then another rollout of LTSB2019 (using whatever method you see best - incidentally, MDT supports LTSB). However, on CB you will have had 1 initial rollout followed by 5 interim 6 month upgrades. If LTSB doesn't suit your requirements then roll out CB. As long as you lasted at least 6 months then you are still no worse off timewise - the same testing will need to be done each "update" anyway as history has shown all sorts of issues crop up each upgrade. I run a mix of CB and LTSB as it suits me but I cannot see why people shouldn't run LTSB if the situation fits. LTSB "not getting bug fixes" is FUD, LTSB does get bug fixes (else KMS wouldn't have worked for all users in 2016 LTSB initially - you needed the first cumulative patch to enable full KMS support with a 2012 server + 2016 host key)

Nope SSD, PCs are old, SSDs were an interim fix until funds available. FOG over WDS/MDT because it works without any intervention from me (all our PCs are pxe boot). The domain join and rename works well (I am aware of OSDComputerName ) and it means I can "golden image" all our "cannot script, batch or MSI install software" can be pre setup. MDT thrashed the network and storage producing unreliable GPO installations - there is a limit to GPO software installation instances and we have found that for a given room of 30 with a pure GPO installation post image you will not get identical machines off the bat. FOG can multicast an entire room or floor and each machine is identical after boot (some rooms DO have additional GPO software installation but these are generally not critical to running and can survive installing "the next day") I would need citation on MSOffice 2013 (we do not use O365) not being supported in LTSB as I couldn't find anything when I rolled out LTSB regarding unsupported configurations. At the time I did see that Surface devices were not support and that MS suggested "use cases" but did not say "not supported", of course you have no store or EDGE. We do not have SCCM so LTSB lack of SCCM compatibility does not impact us. WSUS has successfully patched Office 2013 on LTSB the same as 1607 CB. LTSB is pretty much the same as Windows 7 functionality-wise. I do not have the time to sit down with a dozen machines every 6 months, upgrade overnight, test each piece of software for compatibility on those machines and restore back if necessary - thus we use LTSB on specific office PCs and CB on the "mob". HR do not use network storage because the compliance officer says not to. I put forward the case of NTFS permissions on network storage, they decided local with single user access, local backup and that was the end of discussion for my part. The concern was that an admin (me+SMT) can take the backup from the server, restore it elsewhere and utilise the data accordingly, this was mitigated by restricting the access to the room by both key and lack of Remote/RDP/management tools being installed on the HR system. Incidentally, the HR/DBS machine has a machine certificate from Capita, it needs to be generated for the machine and we are charged for it; upgrades to OS and major hardware changes knock this certificate out. The exams officer PC has some software that does the same (some sort of foreign exams board software, not A2C that one is easier to setup) - instant LTSB decision. Each update does bring a fresh set of issues though. 1709 initial testing brought about the worst case of profileitis we had seen. This was fixed with a few tweaks but that was still 1 days worth of time wasted. This would not have been an issue with our LTSB. Roaming profiles is still a supported mechanism within windows, for right-or-wrong UE-V is not the be all and end all. UE-V does not transfer all settings and storage within a profile. Sure, you can redirect APPDATA separately and hope all your applications play ball (yes Sibelius, im looking at you!) but there are quite a few apps that wont work properly with UE-V (yes adobe non volume CS i'm looking at you!) properly. Some software needs to be installed and licensed individually but does allow the copying of individual license files - these can only be installed on a golden sample then the license file copied afterwards via script. I am quite aware that this is not the fault of MS yet I still need a solution to these issues and the sysprep/golden sample solution works well for us. Incidentally, our businessplan for "lack of edge" on LTSB is "install chrome"; Look at the GPOs for Chrome, and look at the GPOs for Edge (even in 1709) and weep. I know Edge takes quite a few cues from IE11 but it is a pale comparison. For crying out loud, we only recently got Favourites sync (we made a business decision before 1703). I am yet to find anyone that has installed windows 10 and successfully upgraded each time without changing their GPOs each time (im not talking about additional features, merely existing working environment). In fact it has been the complete opposite, each patch has brought additional "features" that have needed removing, patching or hacking about. Unless you have a base of 1703, you will still need to remove and disable provisioned apps after an upgrade. Even future upgrades will bring extra items that need removing (people bar springs to mind for one). This is extra time that I can nil afford. I'll keep saying this to everyone who tells someone to "do it this way". No, everyone has a reason for setting things up the way they do, each person has their own network with their own pressures and their own set of circumstances. Once thing for certain, if I was setting up a network from scratch then I'd go Linux but that is another story. (we have a small 3 computer Linux "lab" for 6th form ICT, it is viable on an AD network....) Not everyone has an identical setup, nor the man-power to keep a continual upgrade system running. Remember, once you go CB then you are on (at a minimum) a 2 year decreasing upgrade/test plan (you do get the 60 day grace period after-all).

There isn't a one size fits all. Hence my original ask 10 people and get 10 answers. For example, Our school has 1 IT manager (me) and no technicians and we have 280 PCs so I need to have it as smooth as possible. I have automated all I can but there are still some applications that do not play nicely with GPO installations (yes non-VL Adobe CS i'm looking at you). We have multiple science based software that again isn't GPO friendly (even down to batch file silent install etc). This means I cannot go the "GPO will install everything based on the OU the computer is sat in". However, to make a golden sample with everything I need takes 2 hours at the most, there are 27 individual steps I take. Uploading to the FOG server takes another 20 mins and each client is at the domain logon in under half an hour. CB is not to hard to maintain in such circumstances. Last time I ran WSUS 1607 -> 1703 it took about 4 hours to complete per PC and things didn't work 100% with each client. Running my FOG method worked every time without fail - I merely needed to manually install the odd device on PCs (such as overhead cameras, SWANN CCTV, individual scanners etc) these all had single user licenses so I couldn't script nor implement on the image due to licensing restrictions. However. There are always the finance PCs with Sage, bespoke banking software, smart cards with certificates, the HR/DBS ladies PC with no network storage and VEEAM windows free agent backing up locally etc. These are on 2016 LTSB as I most certainly do not want these being "upgraded" every two years. We have weather station PCs and digital signs, again these are LTSB. We even have offline exam laptops - these will remain windows 7 until they die (networks disabled, sanitised exam USB pens etc). Don't worry though, you can WMI filter LTSB too! That is great for start menus as LTSB wont have all those shiny Edge and Paint3D installations (SELECT OperatingSystemSKU FROM Win32_OperatingSystem WHERE OperatingSystemSKU = 125 is LTSB, 79 is education) UE-V is great in principle but becomes quite tiresome when you need to monitor many different templates. It is only as good as the templates you maintain. Roaming profiles have just worked for us *providing* you don't screw up copyprofile AND start a new set of profiles when you go to a new build. don't ask about roaming between 2016 LTSB (essentially 1607 without bug fixes) and 1709. You get the same issues - broken start menus, printers going missing, edge freaking out. However, create a 1709 profile and roam to 1607 and all is still good. Okaaaaay. Good luck with whatever you do. And yes, going to 8.1 looks quite viable...

Windows 10 is quite picky when it comes to certain things. roaming profiles can cause a headache - each version of windows 10 needs profiles resetting. The "new" roaming profiles need to be created from a new master profile. copyprofile is fussy, very fussy. Start menu customisation is hit and miss for most people. I am convinced this is tied to the quality of your profile as we have never had an issue with start menu's when others have had nightmares - our default profile is the default profile given (no changes), I use GPO to lock/change/default everything. LTSB is not without its issues. It doesn't have EDGE, this could be a good or bad thing. It doesn't many of the normal apps you would expect windows to have. you are also only getting security fixes - this means no feature pack, no minor bug fixes either. The edition is set in stone. Everything else you install and maintain yourself. Again, this could be good but can also be bad. There is no store, we use minecraft education (store only) so no LTSB for us. Other people use various calculators, paint, etc packages. However, as you say 1607, 1703 and 1709 will be obsolete before W7 ....

1511 was a nightmare for us, so much so I abandoned the rollout. 1607 was manageable and brought a lot of things forwards. Dare I say, 1709 has almost all the GPOs I want and (on the surface) appears to work just fine for us. I must be one of the rare people who have had logon times go DOWN for me on 1709 (same hardware of course). No inplace WSUS upgrades though, pure reimage each time.

So, if you accidentally image a bunch of machines and forget that you had copyprofile=true due to being uncaffeinated and forgetting that 1709 hates copyprofile, there is a quick fix; simply delete all the files in c:\Users\Default\AppData\Local\Microsoft\Windows\WebCache and away you go (till I can reimage properly). Alternatively, for the OU you cunningly messed up in, run the following hacky batch file on startup (which will move the files rather than delete @echo off >nul 2>nul dir /a-d "%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WebCache\*" && (goto FILES_EXIST) || (goto END) :FILES_EXIST echo "*** Taking ownership ***" icacls "%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WebCache\*" /setowner "Everyone" /T /C echo "*** Setting Permissions ***" icacls "%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WebCache\*" /t /grant Everyone:F echo "*** moving files - the flags will be copied over so hidden fodler ***" robocopy "%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WebCache" "%programfiles%\webcache-backup" /MOV :END Windows 10 with lovely DOS era batch files. Makes me all fuzzy. This is only good for NEW profiles created after the event though, existing profiles on the machines will still be borked (for us it was always edge and search that crashed)