Currently the GPOs provided by MS SCT (https://docs.microsoft.com/en-us/windows/security/threat-protection/security-compliance-toolkit-10) have differents approaches how to install them.
e.g.
Windows 10 Version 1507 Security Baseline\LocalScript\10ClientInstall.cmd
Windows 10 Version 1809 and Windows Server 2019 Security Baseline\LocalScript\BaselineLocalInstall.ps1
Windows 10 Version 1909 and Windows Server Version 1909 Security Baseline\Scripts{Baseline-LocalInstall.ps1, Baseline-ADImport.ps1, Remove-EPBaselineSettings.ps1}

It would be nice to have common/generic approach how those GPOs can be applied. For example one powershell script that can be used to install any GPO regardless of the Windows patch level or AD status (joind to AD or standalone/local GPO) and specify the details with parameters. Otherwise it every time such GPOs are rolled out it is necessary to follow a different approach on how to install them.
My wish would be to have a generic "entrypoint" that can be used for all GPOs (also GPOs which will be released in the future).

Cheers

With the old Remote Desktop Connection app, there was a display setting to "Use all my monitors for the remote session." This still works in that app, but I have been unable to find such a setting in this Windows Remote Desktop. I prefer to use this app because there are multiple machines I need to remote into and it's nice to be able to logically group them and whatnot, but there are times when I want to remote in and have that be my whole computer screen, and for that I have to use the older app, which sometimes has connectivity problems more than I've had with this one.

Enterprise environment, 200+ servers 2012r2 @ 2016. We call for functionality to manage via GPO (means managable GUI way, no registry, scripts etc) WU installation & restart for specific group of servers based on their role in severity in our holding. We need to be able to specify day:hour:minute:second when downloaded updates have to init installation and specific day:hour:minute:second to be restarted so we can incorporate this into backup plan.
For such management there is NOTHING on Win Servers OS. We need to work with specific days in calendar (not just "every monday..."), with specific time (sorry, not idiotic "working hours" on servers where production apps controlling production lines are running. Starting 20+ servers it is worthless for IT staff to manage it "by hand" - during weekend nights via VPN login to Remote Desktop and manually do it :-( And when there is 200+ servers it is impossible.
Current result is: server with last updates in 2015 etc and nearly daily news about ransomware attacks in emails.
Sorry Microsoft, instead of just renaming Windows 10 onto Windows Server 2016 (resulting in bulk of clientside waste in server OS !!!!!!!) you should think for corporate clients, their needs and possibilities.
I reaĺly do not care about another "gender" emoji , new colors of start menu and another nosence. I need managable system on the server side to hold available and secured environment for people who maybe just care about those "gender" ...

Adding the Datasource below:

        DataSource perfCounter3 = new DataSource

        {

            SourceType = DataSourceType.PerfCounter,

            PerformanceCounter = new PerformanceCounterDataSource

            {

                CounterPath = "GGD",

                CounterName = "Memory Bandwidth MB/sec",

                InstanceName = "*"                      // All instances


            },

            AggregationType = DataAggregationType.Sum,

            SeriesContext = "GGDPerfCounters"

        };

Getting the following error below when i add the custom DataSource above:

Update-InsightsCapability : System Insights failed to register one or more of data sources for capability 'GGD Capability'.
At line:1 char:1
+ Update-InsightsCapability -Name "GGD Capability" -Library "C:\GGdCapa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo          : InvalidData: (GGD Capability:String) [Update-InsightsCapability], Exception

+ FullyQualifiedErrorId : SystemInsightsError,Microsoft.SystemInsights.Management.PowerShell.UpdateInsightsCapabilityCommand

Everything works fine if i remove this datasource and use one from PhysicalDisk.

Also after checking Event Viewer to check the error, I see the error below:

Failed to update capability 'GGd Capability'. Enable the Debug channel to see more details.

Unknown exception when adding or updating for capability GGd Capability. Exception type: System.ServiceModel.FaultException`1[Microsoft.SystemInsights.Management.SystemInsightsError]. Reason: The creator of this fault did not specify a Reason.

Currently volume licensing and most other MS portals don't provide (SHA, MD5 or any) filehashes.
I learned that later this year MS is planning to update the VLSC portal to support this. That's good news.

It would be a bonus to see the hashes on a true public part of the portals or otherwise on www.microsoft.com without any form of subscription.
Reason is that only a limited number of persons have an account that can actually download ISO’s from VLSC. On the other hand, a lot of IT admins cannot download themselves but use these ISO’s and have to rely on the hashes provided by the first group.

Could be done for all types of downloads (.ISO, setup.exe, msi etc).

Hash access without an account would enable everyone to directly verify with the source at MS which enhances integrity and security !

Microsoft lawyers claim that Microsoft comes with "help" also known as "documentation." When one examines the claimed documentation one finds the usual finely crafted, artistic web pages that contain minimal information for the technical, non-employees who want a deep dive into how to operate Windows (various attempted releases). It is clear why Microsoft keeps this sort of thing close to the vest. Were it to become clear that there really isn't any documentation and no operating instructions then sales would stay exactly where they are. Nobody cares. Especially among the don't care group are top executives at Microsoft. And the receptionist users of WaaS learn as little as possible and still get some work done. This is outrageous and unacceptable. But legal in USA. ... Want Microsoft to provide documentation for their products and services?
The lawyers ordered the engineers to put this into Hyper-V Manager so their company
has something to point at should somebody complain, accurately, there is no documentation.

Just calling words on websites documentation does not make it documentation.

Launch the Hyper-V Manager in Windows Server 2019, locate the Help link, and launch.
The Microsoft Management Console, another "masterpiece" of the Component Object Model,
displays the following:

Access help for Microsoft operating systems
Need help? All help for Windows 10 and Windows Server products is available online.

If you're looking for general help with Windows, the main Windows site is the best resource.

Are you an administrator for Windows 10 devices? Find content especially for IT Pros, developers, and more at the Windows 10 site.

Do you manage servers? All of the Windows Server products are documented at Windows Server.

https://go.microsoft.com/fwlink/?linkid=861993
This is called "the main Windows site."

https://go.microsoft.com/fwlink/?linkid=861991
This is "for administrators who administrate Windows 10 devices."

https://go.microsoft.com/fwlink/?linkid=861992
This is "for those who manage Windows Server products."

Help indeed.

If you have several types of clients updated by a wsus server, the software vendor for some of the clints might have found some updates to cause problems for their software so that the specific updates should be possible to decline for specific computer groups while still being available for other groups. I really do not understand why there is no such possibility in wsus.. As it is now, "not approved updates" could mean two things. Either you specifically do not want to install the update or you have just not decided over the update yet, it really should be an easy way to distinguish the two..