I'm deploying a Windows 7 image that I've made to client workstations (just in Test mode right now) using an MDT 2010 TS and I have the machines automatically join the domain during the TS. However, EVERY time when I logon to the machine for the first time I am always asked to set the network location. I have specified in an unattend.xml in the oobeSystem section that I want the machine to automatically select "Work" but that does not work at all. Not sure what I'm missing or what to do about this one, but I do know that I do not want my end users to see this when they start using Windows 7 for the first time. Additionally, no matter what user account I login with, I'm not actually permitted to select work (meaning even if I log in with an Administrator account or a Domain Admin). When I try to select Work I'm given an error message that "Windows could not set the network settings" and that I should try later. In the Network and Sharing center, I do see that I'm on a Domain network, which makes me wonder why I'm even being asked the question (along with trying to give it the answer in the unattend file). Also, on another weird note...perhaps related, IE8 in Windows 7 does not seem to be providing the user's credentials properly even though I have the Use Integrated Authentication selected. We have some Intranet websites in my company that only authenticated users are permitted to see...every time I login with a new user account on this Windows 7 computer I'm asked to supply my domain credentials in order to see these pages (if I do supply them I can get to the page). We have some GPO's in place that set all of our Intranet websites into the Trusted Sites zone, and I do see that the policy is in effect and is applyed to the machine...so that is working. Interestingly on that issue, if I logoff the machine and then immediately log back on with the same user account, then all of the IE8 issues with authentication are resolved for that account. I can go directly to these same pages and I am not prompted for any credentials. However, a new user on the same box will see the exact same problem. I'm really stumped on that one, and I don't know where to begin. Any help would be apprecated.Mike N.

It's a known bug in Windows 7, it's currently being investigated. I have been working with two customers suffering from the same problem, which is hardware related, meaning only certain hardware models have this partcular issue. If you ping me offline ( johan [dot] arwidmark [at] truesec [dot com ) I can you send you the bug number. There more people reporting this issues the more likely we will have a hotfix before Windows 8.

I've seen this on hyperv virtual machines too Johan, does that tie in with your findings ? My step by step SCCM Guides windows-noob on Twitter

What about the IE issue I'm seeing, is that also related to the same thing?Mike N.

not sure about the IE8 stuff, havn't noticed any problems with it yet, if you try the same in a lab with no GPO's do you still see the problem ? My step by step SCCM Guides windows-noob on Twitter

That's not as easy a thing to test as you might imagine. Our Test environment is basically a mirror of the Production one so this took me a bit longer to figure out...but here's what I've discovered: Someone, several years back, put in place a GPO that has all of the IE Security Zone settings in it. For whatever reason, they took all of our INTRAnet sites and put them into the Trusted Sites zone. While that works fine on Windows XP and IE7, IE8 and Windows 7 did not like that and even though we had policies in place to pass through the user credentials in the Trusted Sites zone, that policy does not appear to be working. Therefore we were seeing login prompts every time we went to some of our Intranet sites. However, I've tested the results of moving the Intranet sites into the Local Intranet Zone and when I do that, the authentication works properly. Now comes the tricky part...the GPO that has the WRONG settings in it, is the Default Domain Policy. Yes, I know, that one should never have been touched, unfortunately that's where all of these IE settings are living and now I need to get them out of there. Any suggestions on how to basically RESET the Default Domain Policy to its default...? I want to put my IE settings into an IE policy and leave the Default policy alone. Also, on another interesting side note, there appears to be something wrong with something else in our environment because a machine with no policies applied to it seems to think that our company's internal home page is in the Internet Zone rather than the Local Intranet Zone (this is what IE shows me). Where should I look to resolve this issue? Mike N.

The tools that has been around for resetting the default domain policies is a last resort thing... I'm assuming you do not have a backup of your policies? I would rather just compare it with a "clean" system, and adjust the policy...

No, we do not have a backup that goes far enough back which does not already include these settings. My concern with the GPO is that the IE settings were Imported into it... I'm going to try and remove (or maybe just move) the settings that are in it... I'll see where that gets me. Thanks for the insight.Mike N.

Ok, after much reseach I've discovered that it is possible to reset just the IE Maintenance policies in the Default Domain Policy without obliterating the entire GPO and starting over. So, that's the course I'm going to take to resolve that aspect of this problem. I also discovered that someone had put our Intranet sites in the Trusted Sites zone for some reason rather than putting them into the Local Intranet zone as they should be...so that certainly was why I was seeing the weird IE behavior when I logged on for the first time with a new account. All is well now. Mike N.

Howdy Mike, Didn't know how else to get in touch with you, but please go to my blog and send me a message so I can get your e-mail address. Sorry to hijack the thread Johan & Niall. You guys can disregard, unless you want to send me money, I'll take that :-)Jason | http://myitforum.com/cs2/blogs/jsandys | http://blogs.catapultsystems.com/jsandys/default.aspx | Twitter @JasonSandys

Done. Hopefully it gets through to you. I've been having issues with the MyITForum site lately. If you don't get my message, get in touch with Matthew Hudson. He knows how to reach me. Mike N.

The bug is fixed! Windows 7 Network Location bug finally fixed! http://www.deployvista.com/Blog/tabid/70/EntryID/136/language/en-US/Default.aspx / Johan

Well, that's good news... Mike N.

still doesn't explain why i see the issue on hyperV virtual machines though, but i will try and get my hands on the KB (please send it to me if you have it) and test it here. My step by step SCCM Guides windows-noob on Twitter

Yes it does... Hyper-V is just another hardware they forgot to test properly :) / Johan

Johan, Are you sure the hotfix is (KB 2028749 )? I thought all hotfix's were 6 digits. I am trying to get it through the permier online portal. Thanks, Jason

I'm very sure... please check my article for updated (today) info about the hotfix... Windows 7 Network Location bug finally fixed! http://www.deployvista.com/Home/tabid/36/EntryID/136/language/sv-SE/Default.aspx / Johan

I eventually manged to get this hotfix from Microsoft (took a while to convince them it existed). The exe is indeed named with KB2028749 and I'm pleased to report it has resolved the issue for me. I built and captured a new image with sccm then deployed it. First logon did not prompt to set the Network location. Thank you Johan for letting us know.

You can now download this hotfix here: http://support.microsoft.com/kb/2028749/

Hey Robin, Thanks for the update / Johan

Hi Guys, can anybody download and UNPACK this hotfix? I've requested it, got link to download and password to unpack, but password is incorrect. There is a password popup during unpacking, and when I enter password from mail, this popup get cleared, and nothing happens. I can enter this pass again and again, but cannot get this package unpacked. Can anybody help? Micha

This should be a new thread; however, there have been a lot of reports of this issue for multiple hotfixes over the past 24-48 hours. I recommended you call CSS directly to get the hotfix -- they will not charge you for requesting a hotfix.Jason | http://myitforum.com/cs2/blogs/jsandys | http://blogs.catapultsystems.com/jsandys/default.aspx | Twitter @JasonSandys

Jason, you were right. I called MS, and they said, that they have problem with their mechanism to change password for hotfixes. Probably not that specific hotfix, but all. The problem is known to MS, and they're working on a solution. An advice for me: "Try later" :( Anyway, thanks for your help :) Micha

Jason, Have you heard of any issues installing kb2028749? It installs fine on my primary, but i have issues in secondaries. What is the preferred method for installing this? I am running as a software install.

??? 2028749 is a patch for Windows 7, it has nothing to do with ConfigMgr. You should install it during your Win 7 deployment task sequence.Jason | http://myitforum.com/cs2/blogs/jsandys | http://blogs.catapultsystems.com/jsandys/default.aspx | Twitter @JasonSandys