Office Deployment Tool - Rolling out Office 365 on to clients and remote hosts

ODT is good tool if you are manual installing Office 365 applications on to clients and or remote desktop hosts.

Office 365 applications are supported on remote desktop hosts with the right Microsoft 365 license (Office 365 E3, Microsoft 365 E5, Microsoft 365 Business Premium)

Users can also manual install Office from the www.office.com portal again with the right license, but a global admin could limit this if they wish to keep office on company only devices.  If this is the case then each device needs to have Office preinstalled which can be done with ODT.

The ODT tool as can be downloaded from here or from the link in the Overview below, encase they move it and the blog is outdated.

It comes with a few options but the ones we need are download and configuration, both need an XML file

The XML file can be sorted via the Office Customization Tool found here which helps build the XML file

Overview of the Office Deployment Tool - Deploy Office | Microsoft Docs

Overview of shared computer activation for Microsoft 365 Apps - Deploy Office | Microsoft Docs

Configuration options for the Office Deployment Tool - Deploy Office | Microsoft Docs

Overview of the Office Customization Tool - Deploy Office | Microsoft Docs

Enable Windows Photo Viewer within Windows 10, 2016, and 2019

Here is the Reg keys to enabled the Windows Photo Viewer that is still part of Windows 10, 2016, and 2019.

This is works well for 2019 Remote Desktop Host

https://gist.github.com/AndyUK24601/cc26266e7af84df3297d7d63271c18fc

Before doing this I would make sure that the following below location still exists as Microsoft may remove it later down the line

"C:\Program Files (x86)\Windows Photo Viewer"

You will also need to run the following too in cmd as admin

regsvr32 "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"

Side note,  running the REG does make it the default straight away

Windows Remote Desktop host seeing alot of .BACKUP-## folders in C:\Users

 Not 100% show on why this happens but it appears to be related to User Profile disks and users not logging off correctly and some issues with he UPD storage.

First step would be to put limits in place on the sessions times so that users get logged out even then they forget too.  Staff training also would be a bonus on how to do it correctly.

Once you have that set you are still going to see a few and they are going to need to be cleaned down.  a good script I have found is located here

PowerShell/Remove-LocalUPDProfiles.ps1 at master · andy2002a/PowerShell · GitHub

And it uses the Delprof2 application from here

Download Delprof2, SetACL (Studio) • Helge Klein

This cleans down the profiles and check if the user is in the system before it does.  I normally run it at night using a schedule.

Also if you are storing your UPD on a share I would recommend disabling share caching on the share its self.  This can have a performance impact but its more stable when logging off.

Windows 2019 Remote Desktop Start menu stops working

 This one has driven me crazy over the last year or so as different things appear to break it and different fixes appear to resolve it.

• Windows server has missed a few updates
  
• Every fix should start with updating, unless an update broke the system then skip this part
  
  
• Windows Firewall as too many rules
• Each time user logs in to the server a few rules are added to the firewall but over time this can lead to thousands of rules being made,  this was fixed in Windows 2016 but it appears that 2019 needs a reg key enabling to sort it.
  
  Also you will need to clean out all the old rules,  quickest way is too open the "Windows Defender Firewall with Advanced Security", right click on "Windows Defender Firewall with Advanced Security on Local Computer" and select Restore default policy
  
  This will reset the polices but you had an custom polices these will not be gone and need to be remade.  still quicker then trying to delete bad ones with the system locking up all the time.
  
  Only Forward: Remote Desktop Host firewall is filled with multiple firewall rules (only-forward.net)
  
  
• Firewall Reg Keys that need removing and remaking
  
• Open Powershell as admin
• Type the Following:
  
  • Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
  • New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
  • Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
  • New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
• Corruption in the Universal Windows Platform applications
• I think its the explorer app that gets damaged but am not 100% on that.
  
  run the following in an PowerShell(admin) console
  
  1. sfc /scannow
  2. dism /online /cleanup-image /scanhealth
  3. dism /online /cleanup-image /restorehealth
  
  Now if point 3 ends with an error like it can not find the source to resolve the issue,  you can use a donor system to pull the files from but its got to be working and updated to the same level (ish,  I have had success with a outdated 2019 as a donor to an updated 2019 but mileage may vary here it could break more then it fixes)
  
  4. Dism /Online /Cleanup-Image /RestoreHealth /source:\\<DEVICE>\C$\Windows\WinSxS /limitaccess
  5. Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
  
  Now point 3 and 4 can be swapped with using the install media if you have it available but I have never tested it this way as I have never had it to hand but the command is
  
  Dism /Online /Cleanup-Image /RestoreHealth /source:wim:D:\\sources\install.wim:1 /limitaccess
  (on the install.wim:1 the :1 is the version of the OS you are using, like core / Desktop / Data Center / Standard)

Remote Desktop Host firewall is filled with multiple firewall rules

Every time a user connects in to the RDH,  firewall rules are made for the users Windows Apps but never cleaned down.

This can have a few issues linked to it like Black screening on the host or the start menu not displaying but depending on the Windows version you mileage will vary.  In all case it can lead to slowing down of the system.

For Windows Server 2016 you will need to confirm the following update is installed KB4467684,  Server 2019 should already be able to do this but I would bring it in line with all updates to just be sure.

Make a GPO if you have more then 2 RDH and put this Key in place.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
DeleteUserAppContainersOnLogoff (DWORD)
Value: 1

No Microsoft document appears to back this up but it is listed in a few updates and talked about as a known issue under KB4467684

Windows Server Performance issues - Power options

 This is a little basic, but when looking at server performance make sure that the Power options are set to High Performance

This has a impact on the system and can help with some low level performance issues.  all servers guest and hosts.

Can be done via group policy Computer > Administrative Templates > System> Power Management > Select An Active Power Plan

Windows server 2019 Remote Desktop Host with Search installed

 The way Windows 2019 / Windows 10 works with search has changed.  the short of it is that now parts are stored in the user profile which can have issues with User Profile Disks.

If you are seeing the follow event in the event log

Event Log: Application

Event Level: Error

Event Source: Search-ProfileNotify

Event ID: 2

Event Data: Unable to remove Windows Search Service indexed data for user '<User Name>’ in response to user profile deletion.  Error code 0x80004002

This can be the start of issues with Search for all users.  The fix is to make a task that triggers on this event to restart the search service.

Program: powershell.exe
Arguments: restart-service WSearch

This was taken from jkindon.com site so that I have it at hand if it comes back up again, but they go in to more details of the thing.

Windows Search in Server 2019 and Multi-Session Windows 10 – James Kindon (jkindon.com)

Search Service Tuning on a Remote Desktop Services (RDS) Server GPO Settings

 Recommended GPO Settings

These GPO settings can be updated to turn down the indexing while allowing the Outlook’s instant search feature to function.

• Windows Components/Search
• Allow indexing of encrypted files, Disabled
• Prevent adding UNC locations to index from Control Panel, Enabled
• Prevent adding user-specified locations to the All Locations menu, Enabled
• Prevent automatically adding shared folders to the index, Enabled
• Prevent indexing e-mail attachments, Enabled
• Prevent indexing of certain file types, Enabled
• Prevent indexing public folders, Enabled
• Enable Throttling for online mail indexing, 6 items per minute (maximum is 120 per minute)
• Prevent indexing certain paths:
  file:///C:\*
  outlookexpress://{*}/*
  otfs://{*}/*
  mapi://{*}/*
  mapi15://{*}/*
  ONEINDEX15://{*}/*
  iehistory://{*}/

Copied for Keep sake from

Search Service Tuning on a Remote Desktop Services (RDS) Server - Peters & Associates

Group Policy loopback for Remote Desktop host

When it comes to setting up a Remote Desktop Host,  once you got it running the first thing you will want to do is lock it down.

The issue can be though when you start designing the sites group policy is that what works for a workstation may not work for a desktop host, this is where loopback processing comes in to it.

This setting tells the device how to manage the user and computer polices that are assigned respectively.

The quick answer is to use Replace as this will tell the device to ignore group policy's assigned to user account and only apply polices assigned to the computer account when a user logs in.

https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy

Group Policy set Start menu on Windows 10 / Remote Desktop Host

 It looks like this may no longer be a developed feature but still works if you make a change to the XML.

https://docs.microsoft.com/en-us/windows/deployment/planning/windows-10-removed-features
Under Taskbar settings roaming, but could be unrelated as its not clear what is included in "Taskbar Settings"

So mileage may vary.

First get a Windows 10 / Remote Desktop host and set up the start menu as you wish it to be.  the open PowerShell and run the following.

Export-StartLayout -Path "<LOCATION>/<FILENAME>.xml"

Open the XML and edit the following line

<DefaultLayoutOverride>

so that it appears like this

<DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">

save the XML and set the Group policy to the location where it was saved.

User Configuration>Administrative Templates>Start Menu and Taskbar>Start Menu Layout
https://docs.microsoft.com/en-us/windows/configuration/customize-windows-10-start-screens-by-using-group-policy