Shared Start Menu based on what's installed!

[psydii]

If this has already been suggested and dismissed - I appologise, consider it another vote for an alternative method.

Why not let the individual machine build its start menu based on what it has installed. Use Transforms to control the location of the installed shortcuts. If there are apps that run from network locations you can use GPP to populate the shortcuts.

If you are trying to restrict who can run what apps then either NTFS permissions or AppLocker could be employed.

[FN-GM]

If this has already been suggested and dismissed - I appologise, consider it another vote for an alternative method.

Why not let the individual machine build its start menu based on what it has installed. Use Transforms to control the location of the installed shortcuts. If there are apps that run from network locations you can use GPP to populate the shortcuts.

If you are trying to restrict who can run what apps then either NTFS permissions or AppLocker could be employed.

Do you mean using the all users start menu?

[linkazoid]

Will the All users start menu clear when I used MDT or WDS? If not maybe i'm over complicating things and should just stick with that.

[psydii]

I don't think it clears. We put office 2010 into my image and all the shortcuts just work.

Everything else is deployed either via a script or msi+transform so the baseline image hardly ever gets fiddled with.

[edie209]

I have been looking at this script for the last couple of days but I just can't get the shortcuts to populate, the folder is created on the c: drive of the desktop but thats as far as it goes. The network share has Read write and execute. I must be doing something wrong.

We are in the process of moving from RM to a vanilla solution and wanted something that work ins in the same way as the RM method, check to see if the Target and Icon can be found, if they can show the shortcut. If all the shortcuts within a folder a hidden also hide the folder.

I have come up with a script based solution and execution time at logon on a Virtual PC running on an i5, 4gb RAM, 2008R2 (base OS) takes approx: 5-8 seconds (according to event log).

It works in the following way:
Startup Script: to copy the start menu to a local folder on the workstation using robocopy and some extra params to also copy secyuirty settings so you can restrict folders by security group (for example out MIS folder is staff only)

Logon Script: At logon the script accesses the local folder and hides/unhides folders/files depending on what can be accessed (icon path and target).

Folder Redirection: All users have their start menu redirected to the local path on the machine.

StartUp Script - Placed in the NetLogon Folder

[edie209]

I have been trying to get this to work for quite some time now in between other things, but it just will not work. I can't get redirected menus to work for students no matter what I do I have tried sharing from a folder share and netlogon yet nothing works.

I must be missing something but what.

In the redirection GPO it seems the desktop and start menu don't work yet in the group policy modelling wizard it passes.

So anyone have an idea?

Servers are 2008R2 clients are Windows 7

[Roberto]

Edie, have you checked RSOP for your test user & machine to see if the policy is applied?
Are there any group policy processing errors logged? Check the system log for general issues and applications & services\Microsoft\Windows\GroupPolicy log for a detailed report on what policies are applied and if any errors are generated?

Can the test user access the start menu location on the C:\ drive?

[edie209]

I ran RSOP and got an error

Error Can not create folder "\\sccm-01\redirection$\Student\Desktop\Programs" 
  ErrorDetails This security ID may not be assigned as the owner of this object

I tried all the solutions suggested by Microsoft yet nothing worked. So I stripped out folder redirection and still I have no start menu (maybe a clue here) Anyway I created a separate GPO just for the redirection and started with a folder in the netlogon directory,and it worked, But as so as I try this script I get nothing, I have noticed that the icons are not being copied to the local folder, but the folder is created.

[Roberto]

I ran RSOP and got an error

Error Can not create folder "\\sccm-01\redirection$\Student\Desktop\Programs" 
  ErrorDetails This security ID may not be assigned as the owner of this object

I tried all the solutions suggested by Microsoft yet nothing worked. So I stripped out folder redirection and still I have no start menu (maybe a clue here) Anyway I created a separate GPO just for the redirection and started with a folder in the netlogon directory,and it worked, But as so as I try this script I get nothing, I have noticed that the icons are not being copied to the local folder, but the folder is created.

Sounds like a permissions or NTFS owner problem. As an experiment, see if you can look at permissions on the target start menu folder; the file/folder owner needs to be set to something sensible and the machine needs to be able to create and copy folders as the startup script is run in the machine's context, and the user needs to be able to edit file object attributes as the login script is run in the user context. What happens if you set "everyone - full control" on the parent (local start menu) folder and under advanced permissions set objects created inside that folder to inherit from it. I'm not suggesting that's an actual solution, but if it works you know where the permissions issue is hiding.

Oh yes - can't remember if this applies to start menu re-direction offhand or not, but worth checking - on folder re-direction GPO settings there's a tickbox on some of them to grant the user exclusive access to the re-directed folder. A Reasonable setting for private folders, of course, but not a good idea for a shared start menu...

[nm_media]

If I use the script mentioned here but I hide/restrict C drive within GPO for users, does the user still get access to the local shortcut folder created on the C drive?