KK20

Ironically, I think this hasn't affected me because I stripped the default profile of ALL databases when I copied to netlogon - I figured that they are recreated on first logon anyway so why copy them across? I also strip the webcache, onedrive install - pretty much MOST of appdata/local (if the directory was over 5mb then I looked into it to see what it was) but I DIDNT strip the tiledatalayer and didn't delete everything. Nice to see someone else has posted so we can piece together the mess that is default profile...

I don't let my golden sample join the domain - I VPN into the system and open a direct share to whatever needs installing just when im preparing my golden sample (removing the share afterwards).

You can via WSUS. I would seriously look into getting a WSUS up and running. That way you can phase updates, set installation periods and roll updates in a controlled manner.

Having run get-windowsupdatelog (W10 edu 1607) it generates the .txt log file but the log file simply contains lines of: 1601/01/01 00:00:00.0000000 976 5468 Unknown( 15): GUID=1f9e54c8-9e31-3e53-867d-d9f39756ad7f (No Format Information found). etc (lots and lots of them in a row) I downloaded updated symbols from https://developer.microsoft.com/en-us/windows/hardware/download-symbols (1607 august) and installed them. This time I ran get-windowsupdatelog -symbolserver "c:\path to the symbols I just installed" but no change (it did run the log combinind much quicker though), I still get the no format information found. any ideas?

removing provisioned apps will require admin privs I'm afraid but you can always do this as a computer GPO on startup. These sites had the basis for my script (particular to us so it wont be of use, just use the script from the site and add your own bits and pieces as required) https://4sysops.com/archives/remove-provisioned-built-in-apps-in-windows-10/ https://deploymentparts.wordpress.com/2015/09/10/remove-builtin-apps-from-windows-10-reference-image/

Arthurdent, Our 1511 was enterprise. I moved to EDU in 1607 as I wasn't convinced I was licensed (with all the "you should be with your software assurance just phone MS to add it to your agreement" debacle). I used the same system of creating an image, deployment, GPOs and the same startmenu XML (with the taskbar bit added to the bottom of the XML). It worked on both. I only use notepad to edit the XML not notepad++ and it seems I am one of the few with the XML element at the top.

Mine works just fine (W10 education, 1607), I even have some network stored URLs in there that also work (the image also has the shortcut for IE created). The key is how you save the file, it MUST be saved as encoding type UTF-8 I should note that it has always worked for me even in 1511. I moved to 1607 as I wanted to change the taskbar pinned items easily too.

Does anyone have a link to the way people get their default profile down to size? That is the final stumbling block for me. W10 1607 education for me, no black screens, startmenu setup, XML importing for taskbar and tiles. Now to get the logon times down. We are sat on 50 seconds first logon and 25 subsequent (roaming profiles). Our default profile is 165mb (audit mode, copyprofile = true). I intend to copy the default profile to netlogon\default user.v6 but first I need to get it down to size. tips? links? Someone said there was a link on here but ive searched for "default user" "default profile" "profile size" but only found others asking questions.... edit: the longest portion of my logon is "preparing windows". I can actually ctrl-alt-del at this point and get to a desktop (start menu doesn't work at this point though), there are no pop up screens awaiting attention, no obvious issues and after 50 seconds the start menu become functional (as per my XML). GPOs (disabling) doesn't seem to make a difference to the "preparing windows" phase. I have removed provisioned & user apps on the image (we have a few remaining such as photos, calculator, edge and 3dbuilder).

I have still to see anything that would say we are Windows 10 Enterprise licensed. My EES license summary says windows 10 2016 LTSB (with our FTE) and underneath it "Windows E3 Per Device" listed as Windows 10 Education with our FTE. I do have the option to download Windows 10 Enterprise but there are no MAK keys available for it (only a KMS). Windows 10 Education has both MAK and KMS key available. Looking at the relationship summary and our current programme gives "OVS Desktop Platform" as being SA eligible so that adds yet more confusion to the pot. Can you actually get EES without SA? Does that mean EES without SA gives you W10 education but not enterprise? Does the SA eligible part mean you can now use the SA part to "upgrade" to W10 enterprise? Personally I wouldn't be keen arguing with the BSA so we went W10 education.

I have removed the header for this site, not really an amazing issue; the header is just there as a security (good practice) reason. It is cure against mime sniffing attacks that is all. Oh well, thanks for getting back quickly though.

I can browse to that page without any F12 errors. The page looks the same with or without the header (a long string of code) edit: a long shot, does HAP attempt to check MIME types at all? since the whole point of nosniff is to stop MIME sniffing, perhaps that is triggering something? I dropped the URL back to /api - that worked too, I had no idea there were so many api's available. /api/test returns "OK" if that is any help. the others I have tried return an index out of range aspx error.

I used IE11 developer mode to get the web page error message; take the header away and it works again immediately. We are using a real SSL cert, this is a subdomain of a working website (which works with the header). here are three pictures, working, not working and the web page error

The only thing I can think of is the SSL certificate binding for the web server on the HAP ports (Im assuming normal 443 but you never know). If you are using IIS then scroll the site bindings box down, you might have a host header with a different binding.

Just installed HAP but was having an issue getting it to work. Found the culprit in the end, I have X-Content-Type-Options set on my ISS server to stop MIME sniffing, this breaks HAP though (if I remove that header then HAP works just fine - tried on two completely different IIS servers with the same reproducible issue). Any thoughts? Id rather not disable this if possible.

easily missed as you have to scroll down (at least when RDPing I did) I cant see "windows feedback" or "contact support" in either start menu or cortana search so I believe I have removed them. Could be wrong myself.

use installation media, shift+f10 to get to command prompt, diskpart, list disk, select disk 0 (assuming a one disk machine here!), list partition, (select the partition) i.e. select partition 1, delete partition override. or you can select disk 0 then clean to wipe all partitions if you like. or use Linux live GPARTED to murder the disk.

We have had the opposite behaviour, all laptops that have been imaged by us in school have worked fine but some of our teachers with their own devices who have a variety of surface pros and laptops (plus a mac with bootcamp) have had issues with wireless not connecting randomly when they bring the laptop in from home (first boot of the day so to speak). The mac works fine in macOS mode in school or at home. Wireless is ubiquiti unifi and has no issues with teachers on windows 8.1 (for those who have two devices). I try to tell people to tag the work connection as work, this has helped sometimes but not always. I did take one of the SMT surface pro and add it to our domain (it was pro windows 10 not enterprise though) and I also added the VPN too. He has had no issues since which may point to tagging issues as im not sure if joining a domain tags network connections in a different way?

nope. Look at the bottom of the GPO: If the policy is enabled, disabled, or not configured, users will still be able to override default file type and protocol associations. I have yet to find a more modern method to sort this out (logon/bootup scripts belong back on NT4.0 and shouldn't really be necessary in an AD environment although it is hilarious how many times I need to use a script when the GPO doesn't work as intended. For example, THIS GPO should fix this "second logon behaviour" but doesn't work: Administrative Templates\Windows Components\File Explorer\do not reinitialise a pre-existing roamed profile user when it is loaded on a machine for the first time why? If you read the text: you will see that you need to use delete cached roaming profiles, which is broken in 1607. Yey. And even if it worked, I suspect that the profile will be reset when an update is applied that adds new default apps (such as candy crush saga, or other stupid MS home oriented shovelware): A second issue presents itself (and I suspected it might) that updates bring more default applications along. They can also reset the current state of default applications (naughty windows 10!). It should be noted that I do use WSUS for W10 updates and we are running client branch enterprise not LTSB enterprise. In any case, here is ANOTHER powershell script for those who want to remove default applications - the default applications need to be removed from the PC *and* the default user context. This is the current powershell script I use (well part of it), no doubt there are more apps being added to this each patch - feel free to use/critique/comment as appropriate: Again, I have found no way in GPO to do this - I shouldn't NEED to uninstall these from a machine each patch, I should be able to suppress them as necessary but hey ho. As for speed, this script takes 30 seconds to complete on a freshly imaged machine with ALL the default apps installed (2g ram core2duos with Kingston v300 SSDs - fairly bottom end machines) after that the script takes about 2 seconds to run so I leave it enabled and add more default apps as I am aware of them.

This is a script of mine copied verbatim. It works as it is our "library" printer logon. ' delete network printers strComputer = "." Set objWMIService = GetObject("winmgmts:" & strComputer & "\root\cimv2") Set colInstalledPrinters = objWMIService.ExecQuery ("Select * from Win32_Printer Where Network = TRUE") For Each objPrinter in colInstalledPrinters objPrinter.Delete_ Next 'add network printers appropriately Set WshNetwork = CreateObject("WScript.Network") WshNetwork.AddWindowsPrinterConnection "\\VS01_Print02\Library_LaserJet401" WshNetwork.SetDefaultPrinter "\\VS01_Print02\Library_LaserJet401" perhaps the forum mangled the "quotes"? If you have strict scripting then you might want to dim the variables. I suppose it is lazy not doing so: dim strComputer dim objWMIService dim colInstalledPrinters dim objPrinter dim WshNetwork can be placed at the top.

it depends how you store and run your GPOs. My script is run as a USER logs on. However, I organise my PCs as a collection of COMPUTERS. I group this script according to a collection of COMPUTERS (I.E. all computers in OU "art" will apply the "art" printer script). The problem with GPO is that you are wanting to run a USER script as part of a collection of COMPUTERS (not a collection of users). In this case you will need to use "loopback processing", i.e. loop back and look at user scripts that have been called as part of an OU of computers. Merge means it will merge this script with other user scripts (not supercede them). I cant remember offhand where loopback processing is, it is definitely in COMPUTER and within system->group policy I think. If you search for "loopback processing GPO" it is easily found.

long term, yes. Maybe then all the kinks will have been ironed out. Maybe others are more up to date but we moved to 8.1 18 months ago. I feel no reason to move to 10 at this moment in time, I made the images to see how it would run but have come up against more problems and more issues that I did with 8.1 10 seems rushed and doesn't (for me) seem to be fully ready for enterprise deployments. Our roaming profiles have had more issues than not - last night I came up against another issue: vpn will dial off before roaming profile has fully synced if the user logs onto a PC for the first time with no previous .v6 profile in the repository; this results in a partially uploaded .v6 profile (sooner or later it will corrupt I imagine as I have no idea how far it had progressed). This doesn't happen if the user already has a .v6 profile on the server - only if the .v6 is created by logging on via a VPN for the first time. Now it could have been my network connection at home but I doubt it (I cant remember the upload on virgin home packages but im sure it will be enough - it certainly wasn't dialling off after a preset time I.E. timeouts). Don't get me started on non LTSB versions of 10. 8.1 support will be around for a while, hell, even 7 will be around for a few more years. Hopefully 10 will be in a decent place by then with all the kinks ironed out.

Ever since GPP came into fruition in windows 7 I have had issues with printers not deploying correctly. So I went oldschool in W7, W8.1 and my W10 testbed and my printer script works perfectly in all versions. I run this as a (loopback merge) user logon script for each OU as necessary (it deletes, it then adds. Simple): strComputer = "." Set objWMIService = GetObject("winmgmts:" & strComputer & "\root\cimv2") Set colInstalledPrinters = objWMIService.ExecQuery ("Select * from Win32_Printer Where Network = TRUE") For Each objPrinter in colInstalledPrinters objPrinter.Delete_ Next 'add network printers appropriately Set WshNetwork = CreateObject("WScript.Network") WshNetwork.AddWindowsPrinterConnection "\\printerserver\printer" WshNetwork.SetDefaultPrinter "\\printerserver\printer" Now the reason I suggest this is because I believe this method works differently to the GPP or GPO method, the delete_ may remove something that lets you add your printers properly - I cannot say. Perhaps just give the "delete_" part a run and let your GPO install the printer afterwards? Maybe that will suppress any error messages (or remove offending parts that cause issues)

I created an LTSB image and came to the conclusion that it had zero benefits over windows 8.1, LTSB is fairly pointless - you might aswell look at reskinning windows 8.1 We used to use minecraft education until they changed the licensing. Plus minecraft education REQUIRES full fat windows 10 (oh great). I have been testing and building a windows 10 image and will be putting it in the wild in one of the lesser used IT suites as a testbed.

I a similar vein to the above, I create shortcuts to various programs that may or may not be installed on a PC, store them in a network share, copy them to a (via startup script) c:\program files folder of my creation and use a script that adds them to the %APPDATA%\Microsoft\Windows\Start Menu\Programs\ as appropriate. In 1607 this approach seems to work for me (students have roaming profile). The startmenu and taskbar have been a pain in the arse IMHO

do you have the group policy too? This script will only sort the default user out. You will also need a group policy using the same XML. The GPO lives in Administrative Templates\Windows Components\File Explorer\Set a default associations configuration file You cannot manually edit the XML file as there is a checksum on the entries I think. You need to Dism /Online /Export-DefaultAppAssociations each time you make a change. Obviously, on the machine that you export make sure the file associations have been set up correctly! You can view the contents of the XML to see if they are what you think they are (as a final check)