rosslaing

the script i use to change the last write dates to what they should actually be can be found here: https://techcommunity.microsoft.com/t5/Windows-10-deployment/Issue-with-date-modified-for-NTUSER-DAT/m-p/102438 I changed it around a bit to run it remotely as its designed to be run on the machine locally. but it does indeed do the job. Script is about half way down the thread. If you use this to fix the dates then the GPO setting or Delprof2 works fine.

Ok so moved on a bit here, got this working with the GPO, but have a script that looks at the last write time of the profile folder, which always seems to be accurate and then changes the ntuser.dat file last write time to match. Profiles delete. However, now that it is working, the number of days counter is not accurate, seems to be smart enough to not count weekends!, so operating on a 5 day week principle. took me ages to figure that one out!

How is the time on the PC's? are they picking it up correctly?

yeah we have seen that in the past year with them appearing in office and being able to print but not showing correctly in devices and printers. Seemed to go away when we moved from 1803 though, or staff stopped complaining about it!? No matter, the reg key is out this afternoon and some initial testing shows the printers adding pretty quickly now. We use a powershell script to map them for the users.

There is a group policy setting for this which we have used since 1511: Computer Configuration->Administrative Templates->System->Device Installation->"Prevent device metadata retreival from the Internet" However after checking some over our machines, the reg value you have provided is still set to 0 so I have no idea if it is working! I think I will set this reg key as well and double down.

Looks like this will continue to be an unsupported fix. Gen 1 and 2 boards no longer supported from 1903 on. https://community.prometheanworld.com/forums/topic/update-to-1st-generation-2nd-generation-ab100-ab300-ab500-bsod-windows-10-1903/

There is a GPO for this - Computer Config -> Admin templates -> Onedrive: 'Allow syncing OneDrive accounts only for specific Organizations' This will limit it to just your Tenant ID for O365 or any others you suggest. Im sure this became available in the 1809 ADMX's. **Edit - Just read your original question, obviously this is just for onedrive. Not the microsoft accounts The above suggestion is what I would go with**

We are the same as you local profiles and UEV, the powershell above worked for us.

As others have said, Images should be built and captured on VM's. The main problem with sysprep is the store apps, in my experience. Make sure you have not connected your reference machine to the internet and none of the store apps will update. Good practice to not connect reference images to the internet anyway.

Yeah we have had this, also when some of the apps update from store. Have to delete some registry keys. Powershell for this is: Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList' | ForEach{Remove-Item ("Microsoft.PowerShell.Core\Registry::" + $_.Name)} May want to test it on one machine first before deploying it to everything.

This doesnt work properly with windows 10. This policy uses the timestamp of the ntuser.dat file to determine the age of the profile. With windows 10 Store updates and some windows updates modify the .dat file on a regular basis, regardless of whether or not the user has logged on. I have had a premier support call into MS for this and they acknowledged this as a bug, but it has never been fixed. Delprof also uses the .dat file for age by default unless you change it to use the .ini, but even this is not accurate anymore, so you have the same problem. We have resorted to just cleaning our IT suites down completely using delprof 2 or 3 times a year.

yeah, Im hoping the fslogix profile container stuff bares some fruit, quite frankly, Microsoft seem to have given up on supporting roaming users.

I hadn't until you mentioned it, but you appear to be correct, marvellous, now have no way of deleting profiles older than X days, i'm away to open a new MS premier support call so I can get the actual GPO setting working. So using delprof with ntuser.ini is deleting based on the creation date instead of last used, feel like curling up in the fetal position.

To be honest ive been waiting on this dropping for the last year to do away with both. I know its mostly VDI, but I believe this is what Microsoft are going to push for "roaming Profiles" on physical machines too. Hopefully it drops in June like the article says so I can have a looky, will be free to me on my subscription thankfully. https://www.christiaanbrinkhoff.com/2019/03/21/the-future-of-roaming-profiles-add-fast-logon-performance-and-office-365-support-to-your-virtual-desktop-vdi-daas-environment-with-microsoft-fslogix-profile-container-including-existing-uem-sol/

That is the reason for it in the first place to be honest, but I would rather keep stuff that has at least been used in the last 2 months, otherwise id be just as well re-imaging the PC's. Plus we have a bizarre issue with Xerox drivers not working correctly for secure print and auditron when profiles are deleted, so again would rather keep recently used profiles. We normally re-image machines during the summer but our estate has doubled with mobile devices in the last 18 months and it is now unworkable to do this, so feature updates will help a lot, but trying to keep users experience as good as possible. It has always been a complaint when they come back and have to rebuild profiles, UEV is not all its cracked up to be!

**Bump** Still broken in 1903, ntuser.dat still modified regularly by updates. Also noticed a slight problem in using the ntuser.ini file to determine profile age. When you feature update a Windows 10 machine, all profiles are obviously still there (Copied/converted) and all contents are there, apart from................yeah, ntuser.ini, until they log on again. In the absence of a ntuser.ini file the profile is deleted, so if you are running delprof on startup, prepare for all profiles to go bye bye after a feature update.

Users need to be an Administrator on the machine to run Sandbox, no? Certainly asks me for admin credentials, in which case would users even be able to run it? I would hope not.

What happens if you just try to Bitlock the drive without MBAM policies?

I have literally just encrypted two brand new HP laptops running 1903, using MBAM, and they both worked fine.

If it is an HP its definitely this, just had this problem in the last month. Extra software to enable the display function keys. You can go into Settings->Display and brightness settings should be the first thing you see, (on 1803 anyway), if you have access and do it that way but depends how far you have Settings locked down.

Local Profiles, UEV, redirect everything apart from Appdata (No point if using UEV) Machines end up being rebuilt mostly at least once throughout the year so not noticing profile build ups really, but 120Gb SSD's (Dont have many) do get close to the bone in out CDT departments, and have to be cleaned down occasionally with Delprof.

I dont think you need easeofaccess. my understanding is the stuff directly in settings are category's and pages are underneath. so to allow magnifier for example all you would need is showonly:magnifier Adding in extras just requires a ; so i think yours should read: showonly:narrator;magnifier;highcontrast;closedcaptioning;keyboard;mouse;otheroptions

Word for Word this is where I am at as well. I did however find that putting the script into the machine startup folder instead of a login script helped a little too. Also had the benefit of adding the printers once the user is logged on, taking the time out the logon process, made logins a bit snappier. Users have a shortcut to re-run if not there.

SCCM can install/provision store apps to the machine, which will then install into all users profiles. So it is possible and i would imagine you can do it other ways. From what I can remember, you can use DISM or powershell to do this, and it is just a case of actually getting a hold of the files required, which is only possible if the apps in the store allow it tbf its the same for SCCM.

Set it via Group Policy for Mobile Devices: Computer Policy -> Administrative Templates -> System -> Power Management -> Button Settings 2 settings: Select the Lid Switch action (On battery) Select the Lid Switch action (Plugged-in) Change them to 'Take no Action'