KK20

Ask 10 sysadmins and get 10 answers. We went from 7 to 1609 and didn't look back. Now we are moving to 1709 and will be complete at Christmas. I know a local school that uses LTSB and intend using that till it is out of support. We created a 1609 golden image and installed on PCs using FOG (automated from power on to domain logon via iPXE). We initially upgraded from 1609 -> 1709 via WSUS however it turned into an overnight job (!!) so we simply reimaged with a brand new golden sample (less than 30 mins from power on to domain logon). Our W10 is almost fully stripped of bloat, we delete provisioned and user apps leaving only a couple installed. Cortana is castrated as much as possible, no "people" button, no edge "suggested sites" rubbish - all through GPOs (try and keep away from reg hacks, they will bite you in the bum eventually when you upgrade again and forget about the hacks). The only "app" we use is minecraft education so we need the store and cannot use LTSB (without bodging LTSB which I wasn't prepared to do) How you do it is up to you. what you will need to do is sort out your GPOs (don't forget the ADMX's for the version you will be running!). Don't be lazy about this, use filtering and put W7 on *ALL* your current GPOs and build W10 ones with filtering - trust me, you will find troubleshooting a lot easier. Read the gotchas on here (such as copyprofile being "problematic" in 1709 unless you take precautions). Good luck.

out-there idea. Was your windows 7 x86 and your windows 10 x64?

Do you use old fashioned printer scripts or printer preferences? We found that the old printer scripts on an asymmetrical VBS worked faster than printer preferences (which are sequential). Local and roaming take about 35 seconds for us - there is no time difference (pupils are roaming, staff are local). If a printer is offline then preferences took a few seconds (per printer) longer.

just an update for us (and those who are interested). 1709 testing on about 60 machines ( 2 labs). The XML I posted much earlier in this thread still works for us; I have only added more .LNKs. The same XML has .LNK, IE and now a logoff.lnk (a nifty shortcut mapped to C:\Windows\System32\logoff.exe) and I also create an LNK to open the old file/printer sharing screen (an LNK mapped to %SystemRoot%\explorer.exe shell:::{A8A91A66-3A7D-4424-8D24-04E180695C7A} - this is a great way to get shortcuts opening old control panel items). the odd user has some icons missing - profile delete sorts this out but the vast majority works. I found originally that people have fewer issues if I get rid of the tile group title name. LNKs are a mixture of local (copied from an old fashioned script file with icacls making sure they have the correct permissions) and network .LNK our XML was originally generated in 1607. We skipped 1703 and are updating (via WSUS) to 1709.

Personal theory. It only errors on our 1607 PCs that have certain messaging apps permanently removed, our test machines with no apps permanently removed do not error. We don't use messaging apps or Skype etc. We disabled the service with GPO reg key HKLM\SYSTEM\CurrentControlSet\services\CDPUserSvc value Start as 4 This cured it for us, nothing appears to have stopped working for us (email works, no other apps appear to stop working). simply reversing the Start to 1 gets the service running again.

return them with 8.1 and a KMS client key. Whilst in your possession they are licensed just fine using your EES. When you give them away it is up to that person to license them and no longer your concern. A KMS client key will not be using your personal MAK key and is freely available from MS as a key. The base machine will have an OEM or license sticker (otherwise your own EES is invalid) so the OS will be licensed from your point of view - once it leaves your possession it is no longer your concern if it is licensed or not. Personally I would burn an 8.1 install disc form VLSC and install from scratch formatting along the way (again this is fine in your possession as it will be your own VLSC version of 8.1), it isn't up to you to concern yourself with the leasing company being licensed or not) - leave in first boot OOBE for the next person (stuff installing drivers, audit mode or imaging it etc). Does the contract state 8.1 OEM or just 8.1? If it says (specifically) OEM then you might have an issue locating OEM installation media (i.e. media activated using the BIOS string).

KMS operates in two steps - a client generic key (windows 10 education: slmgr.vbs /ipk NW6C2-QMPVW-D7KKK-3GKT6-VCFB2) and a KMS server key for your own server. In VLSC under windows 10 you see your own SERVER key - this will not work in clients. Clients use the freely noted ones: https://technet.microsoft.com/en-us/library/jj612867(v=ws.11).aspx Of course you can use MAK keys that you will also find under VLSC. If you are using KMS and you haven't installed your own KMS server then you will also need to configure (or forward) your KMS client requests. Look for _VMLCS "SRV" record under your _tcp zone in DNS, that will say where your clients are trying to get to on a KMS request. Why are there both MAK and KMS in VLSC? Because there is a minimum amount that you need before KMS servers start activiating clients. You need a minimum of 25 clients or 5 servers before KMS starts "working" (you will get a 180 day grace period to get this count up - this can be an issue if you ONLY have 25 clients as it might not be long enough if some PCs aren't regularly switched on or broken).

If you are virualising then the cost shouldn't be any different. It was always a minimum 2 license with 2 CPU per license so the minimum you could license was 4 CPUs and 2x licenses. It will hit the people who ran standalone physical SQL servers as those could have had MANY cores but only 2x CPU.

The EES desktop packs include CALs (depends on what you need, std vs enterprise offer different CAL packages). Main omissions from either of the EES desktop packs that catch people are SQL CALS and RDS CALS. Server 2016 datacentre offers a different subset of options too - stretch clustering might be of use to people who don't have SAN replication as you can replicate SAN to cheaper iscsi NAS for cheap emergency resiliency etc. This might be of benefit to some people and worth the extra cost of licensing vs hardware (a separate discussion of course).

we had this issue early on, I fixed it by providing .pdf file association to acrobat DC. Windows was forcing it to edge and was causing an issue with the profile on login, the file association GPO made it go away.

Nope, as in click and nothing happens, no window, no movement; a quick circle of "busy" and nothing. I managed to figure out that the search and taskbar works if you DONT click the start menu. As soon as you click the start button then search and taskbar buttons stop working until you log out/back in. There will be a GPO no doubt stopping this so i've passed it over to the minion to disable all the GPOs and find the offending one....

ran 1703 on one machine. I already knew about the lock screen not listening to GPO but now our start menu wont even open (nor search) - however it DOES populate my taskbar with the correct icons! "allow cortana" is "not configured" so im not disabling that. Up till now I had no issues with start menu in 1607. sigh. here we go again.

It does depend on your sql licence. It might come with 2x cores per license (each SQL license we purchase comes with 2x cores so purchasing 2x "2 core" will be licensed in your case). At least in VMs you only have to license the CPUs allocated, if it was a physical server then you have to license ALL cores now!

There are plenty of exampled of working scripts if you look back. Mine was posted two pages ago. This is what I use for file explorer: - - - Updated - - - I posted my working script a couple of pages back. That had a file explorer portion. works for start menu tile and taskbar pin.

I have found XML changes only action when GPO background updates happen. Or you can gpupdate /force

We have a Kyocera 2551ci. Currently it is just used as a printer and a network scanner, copy has been disabled. I am looking at enabling copy but need to charge departments for copying (printing isn't an issue as the print tracking can do that). I have setup job accounting on the printer, I have set up the "users" for each department so now each user can log into the printer as their department and copy (I have enabled guest printing for network printing so no userid is needed for "normal" printing). I can use Kyocera netview to look at each user and what they have "used" (it shows the copies colour and mono) but what I cannot do is set a date range. I have no idea how to set a range of dates to see what has been done between the range, it only shows a raw count. Any idea how I can show either counts between a date range or export a print log (with usernames and dates) so I can use excel to do it?

same as the above. I have a user that only has credentials for the scan folder - nothing else.

I found deploying MSI much easier. Hence I don't use (and have removed) the store. I don't trust provisioned apps.

Here is my working start menu .xml remember it must be saved UTF-8! It should be noted that the third group does not always appear. Mostly it doesn't but the earlier shortcut does appear. I cant be bothered to see why - perhaps because they are the same .lnk? I should copy the .lnk and see if that fixes it. Oddly enough I couldn't get a network shortcut working for internet explorer - it had to be locally sourced.

how often do you clear profiles off machines? Do you have profiles cleaned on logoff? I was finding hundreds of profiles not clearing properly until I moved to roaming - then the issue went away. The GPOs for clearing profiles simply didn't work reliablyfor us (so we were running out of space locally on the popular machines). delprof2 aside this was a bit of a nightmare.

Yes. I use a redirected desktop (and documents) but not a redirected start menu. I use the GPO with a start menu export, edit as appropriate (UTF-8 only!), add my to the bottom for the taskbar icons, then GPO to apply the XML. I have had no issues doing this. We use Edu1607 & roaming profiles. Our XML is on a shared drive - I have noticed that W10 LOCKS the file open for reading though, this isn't an issue for reading by multiple people but is a problem if you want to edit the file during the day. I suppose a copy from network/use locally would be a much better option.

been there, done that. Installing the language pack isn't the problem, the problem was all the "SET AS DEFAULT" screens, then setting the "advanced" logon screens too! Crazy.

all the EDU versions have cortana removed. We use W10 EDU 1607. I hadn't heard of the "pro EDU" before now.

this is just information in case anyone else needs to do the same (and of course if I google in a year after I forget...) We deleted provisioned apps (pretty much all of them) from one of our W10EDU 1607 images (we have two images, an LTSB for the digital signs and a CB for everyone else). However, our IT teacher wants to play with the store and install a few apps to see if they are worth it (from a teaching point of view). I had deleted the store from provisioned (and user of course). After searching I found that you CAN put the store back but you need a donor machine with the same version and updates. This is the site I used. Restore Microsoft Store application in Windows 10 - Super User I needed to copy these folders from c:\program files\windowsapps on a donor machine (ownership needs changing) Microsoft.WindowsStore_11606.1001.39.0_neutral_split.scale-100_8wekyb3d8bbwe Microsoft.WindowsStore_11606.1001.39.0_x64__8wekyb3d8bbwe Microsoft.WindowsStore_11606.1001.394.0_neutral_~_8wekyb3d8bbwe and then run this powershell (note the last command is slightly different as the XML files are in a different place) Add-AppxPackage -DisableDevelopmentMode -Register "C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe\AppXManifest.xml" Add-AppxPackage -DisableDevelopmentMode -Register "C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.23816.0_x86__8wekyb3d8bbwe\AppXManifest.xml" Add-AppxPackage -DisableDevelopmentMode -Register "C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\AppXManifest.xml" Add-AppxPackage -DisableDevelopmentMode -Register "C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\AppXManifest.xml" Add-AppxPackage -DisableDevelopmentMode -Register "C:\Program Files\WindowsApps\Microsoft.WindowsStore_11606.1001.39.0_x64__8wekyb3d8bbwe\AppXManifest.xml" Add-AppxPackage -DisableDevelopmentMode -Register "C:\Program Files\WindowsApps\Microsoft.WindowsStore_11606.1001.394.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml" after this you MUST add the local security principal "ALL APPLICATION PACKAGES" permissions (read and execute) to c:\program files\windowsapps voila! store now works. This also means you can search for the other deleted provisioned apps from the store (if you wish)

My latest default user profile is 88Mb and logon times (roaming, core2duo, 2Gb and cheap SSD) is between 30 and 40 seconds - very similar to our W7 so i'm happy now. Our staff have local profiles, initial logon is 30-40 seconds with subsequent about 8 seconds). Combine with fast boot and it will go from "off" to desktop in under 30 seconds (BIOS, PXE check and typing time included) best advice is use something like "treesize" to see which folders are eating up the space (look in appdata\local\Microsoft\windows - plenty of bloat in there. For starters I removed "onedrive" folder - we don't use it and it has been uninstalled from provisioned apps. Second I deleted all the databases EXCEPT the TileDataLayer database(start menu screws up if you delete this). There are LOADS of cache files in the local\Microsoft folder - comms cache, webcache, icon cache etc, all these are pointless as they are rebuild on first profile creation anyway (so they are just bloat that are copied and reinitialised). There is 10Mb in the IE suggested sites database alone! (in the bin you go)