Creating 'All Programs' using GPO

[mmeoli]

Hi,

 

I was wondering if anyone could point me in the right direction with something i cant work out. I am trying to create a program set list that gets shown in the 'All Programs' menu when users log on. I need each subject to have its own area on the list that will house the relevant software shortcuts. I also need different user types so see different menus e.g. staff to have one that only they can see for things like SIMS etc. In addition to this, not all software will be installed on all machines around site so i don't want shortcuts to be visable if the software itself is not installed on that particular machine.

 

I am sure you can do this with GPO's but just need a pointer as to where to start.

 

Many Thanks

 

Mik

 

P.S. sorry if my explanation is a bit rubbish and let me know if you do not understand what im saying :-)

[sted]

redirected start menus set one up how you want it for say staff they sue folder redirection to get them to use it

[mmeoli]

Thanks.

 

How do i make it so that the Shortcut will only display if the software is installed. I have the situation where if i have some french software only installed on the french classrooms i do not want the icon displaying in the english rooms as it would just come up as a missing shorcut.

 

Cheers

 

Mik

[timtom]

I've struggled with that for a long time GPP shortcut creation and then GPP file copy for shortcuts and use the GPP options for item level targeting. They worked but GPP shortcut creation added 10 seconds onto the login and GPP file creation added 5 seconds. In the end I figured a few invalid shortcuts was better than 5 seconds on every login and I'm just in the process of going back to redirected Start Menu

[detjo]

Could you not simply set up a GPO for each room / subject and have it point to a redirected menu for that room / subject ?

 

Depending how easy / complicated your AD structure and imaging is (ie generic), you might need to consider bringing loopback and system variables in to the GPO.

All in, theres no reason why you cant then specify a start menu for both staff and students for each room / subject in the school.

[Ephelyon]

Le EDIT: sorry, I've been translating all night...

 

We manage that through a single GPO here, but we've also enabled ABE on the file server and then configured the permissions such that e.g. only the security group for staff members has access to the "Staff Tools" folder etc. You can use that to configure a custom menu for all user groups. In this way, the librarian is the only one who can see the "Library Tools" folder, which contains shortcuts to things like Heritage and her beloved CorelDraw 7 (local installation, I could never get her to see the light)...

Edited October 20, 2013 by Ephelyon
Wrong language!

[StevieM]

Could you not simply set up a GPO for each room / subject and have it point to a redirected menu for that room / subject ?

 

Depending how easy / complicated your AD structure and imaging is (ie generic), you might need to consider bringing loopback and system variables in to the GPO.

All in, theres no reason why you cant then specify a start menu for both staff and students for each room / subject in the school.

 

I realise that this is an old thread, but I'm looking to do something similar. At the moment, we have GPOs for staff and students that have basic folder redirection for Desktop and Start Menu set up through User Preferences - i.e. all staff have the same desktop and start menu items regardless of which computer they log in at, as do all students. I'd like to have different desktops and start menus depending on where they are. There are separate GPOs for each room, but with my limited knowledge I don't know which settings to adjust.

 

Now I could spend ages experimenting and I'm sure I'd get there in the end, or I could ask for help from some of you more experienced Edugeeks. Any specific advice would be very much appreciated.

[timtom]

Hi Stevie. The way we have it set up is a GPP files rule that copies shortcuts into a users local profile as they log in. It does a item-level-targetting check to see if the application is installed before copying. I suspect you'll need to do this on a user-type GPO. You probably could do loopback processing but I find that tends to get messy. Sorry to be brief, having a fun afternoon over here..!

[Ephelyon]

The way I'd try to go about that is to still keep a single repository of shortcuts on a share with ABE enabled, but then have each computer on startup copy on the files/folders it should have down into a local Start Menu folder, which redirection for everyone points to. This would be regenerated on startup. You could define which shortcuts are available to which computers by organising their computer accounts in AD into security groups, then setting permissions on individual shortcuts (or folders of shortcuts) to include just Administrators and whichever computer security groups you like - i.e. no full access for SYSTEM as by default. The magic of ABE would mean only those items could be "seen" by computers copying from the share on startup because their individual SYSTEM accounts, which startup scripts run under, equate to their AD computer accounts I think...

 

Le EDIT: Actually, I think @timtom's suggestion might be better... xD

[detjo]

@StevieM - I'll have a look into how I set this up and add my method too. I did use this and it worked a treat, tho we have a new network with 8.1 and custom start screens now, which is easier IMO. I'll post back when I can dig out the info ..

[StevieM]

Thanks, all. Not ignoring your posts, just a little snowed under at the moment. Will post back later.

[sparkeh]

Yeah we build the start menu with GPPs and item level targeting, works a treat.

[StevieM]

Right, while I've got a few minutes. I had a little poke around Group Policy yesterday and found that the Advanced setting for Folder Redirection under User Policies - Windows Settings gives the option to point to different folders depending on Security Group membership. In our current setup, basic folder redirection is enabled in Student and Teacher GPOs. If I were to create Student/Teacher Start Menu/Desktop folders for each location and apply the advanced setting to GPOs for each location instead of the users, would that work? (Am I even making sense? I know what I mean!)

[TechMonkey]

Same as others really, I have created 2 folders on the Hard disk, StaffStart and StudentStart and a central shortcut repository. 2 GPOs (one for staff and one for students) copy the shortcuts using GPP and by evaluating if the application is installed using item level targeting. Start menu is then redirected to the local folders.

 

Seems to work, keeps it simple and it also means that at a push the shortcut can be manually copied an appears instantly. If I could get it to one folder and one GPO that would be fantastic but this works.

For Admins we don't redirect start menu so we can see everything.

 

The only annoyance overall is that the search box doesn't work so has to be removed.

[detjo]

I wanted a different start menu for staff and for students for each room/subject. Then I could make changes to it whilst ‘live’ and without the need for them to log off to pick up any changes. Also, it didn’t matter what software was installed on the computers coz I could control what they see in their start menu. I can’t get to the old DC now to check, but it went something like this:

 

 

• Set up redirected start menu for students in the student user policy and set the root path to %StudentMenu%
  
• Set up redirected start menu for staff in the staff user policy and set the root path to %StaffMenu%
  
• Create GPOs (or add to existing if you prefer) for each room/subject to link to the computer OU for those computers
  
• In each GPO set the environment variable and location of the redirected start menu
  

 

ie: In a GPO for Library computers,

 

• Go to "Computer Configuration\Preferences\Windows Settings\Environment"
  
• Create New > Environment Variable (Action: Update - Type: System Variable)
  
• Set the 'Name' to StudentMenu
  
• Set the 'Value' to "\\Server\RedirectedMenu\Library\StudentMenu" (etc. - adjust accordingly)
  
• Create same again for Staff
  
• Close and link to correct OU
  

 

This sets the Variables for both user groups and contains the location for the user policy to pick up. I think that should about do it!

Edited November 4, 2014 by detjo

[StevieM]

Thanks, everyone. I really appreciate all your responses. @detjo's answer seems closest to the kind of thing I'm trying to achieve, without the need to copy files and folders each time the computer starts. It's similar to what we have at the moment, but using the system variable idea makes it a lot more flexible. I'll have a play around with test folders/GPOs/OUs and see what I come up with.

 

Out of interest, how do I use this 'item level targeting' that people have referred to. Forgive my ignorance, but as I said earlier, my knowledge of Server is rather limited though I'm trying my best to learn what I can.

[sparkeh]

Out of interest, how do I use this 'item level targeting' that people have referred to. Forgive my ignorance, but as I said earlier, my knowledge of Server is rather limited though I'm trying my best to learn what I can.

When setting a Group Policy Preference there is a 'Common' tab, on this tab there is an option for 'Item Level Targeting' where you can set rules as to what objects the preference will apply to.

[detjo]

Once you create a setting in a GPO, 'Item level targeting' allows you to specify who that GPO setting will apply to. Very useful if you have a setting added to a GPO used by more then one group etc.

In the case of the start menu with Env Var - item level targeting is not needed.

[sparkeh]

Once you create a setting in a GPO, 'Item level targeting' allows you to specify who that GPO setting will apply to. Very useful if you have a setting added to a GPO used by more then one group etc.

In the case of the start menu with Env Var - item level targeting is not needed.

Applies to preferences only, not standard GPOs.

[StevieM]

Woo-hoo! I'm learning! I've managed to use the system variable to redirect the folder for desktops. I've not got it working correctly for Start Menus yet (it's appears to be defaulting to local), but I think that's just a mistake I've made somewhere. I'll keep checking until it's done.

[Ephelyon]

There's a Group Policy setting called "Remove common program groups from Start Menu" that you might want to enable.

[timtom]

The only issue I have with building using GPP is I have a 'delete all' option that wipes it down to rebuild the menu. The whole thing takes a good 5-10 seconds on every login. My goal to sort this is to standardise software throughout the site so remove the need to 'delete all' and only delete software that gets removed and hopefully speed up logins.

 

n.B I use the GPP file copy rather than the GPP shortcut because I found the GPP shortcut even slower - about 10-20 seconds on every login.

 

For wireless laptops everything gets amplified so I've seen laptop users with 1-2 minutes just building the start menu which is pretty mad. I've since changed our laptops to use Local Profiles and a start menu that only builds once (no delete all)

 

My other consideration was redirected start menu with ABE as others have mentioned. I would love to have some time to test that out but I'm not convinced it'll make any real difference to speeds so that's on the back burner.

[StevieM]

Yes, Yes, Yes!!!!

Finally got this thing working exactly how I want it. Been struggling with it for days. The whole Environment Variable thing worked ok for redirecting the desktop, but no matter what I did, the Start Menu kept pointing at the user's roaming folder on the C: drive.

 

So I changed tack:

 

First, I created folders ..\profiles\desktops and ..\profiles\startmenus. Then I created student and staff subfolders in each, followed by more subfolders for the different locations, e.g. ..\profiles\desktops\students\suite1, and populated them with appropriate shortcuts.

 

Once the folders were created, I added environment variables to the GPOs for the computers in each location, e.g. name="location" value="suite1"

I then edited the folder redirection policies in the users' GPOs to point to, for example, ..\profiles\desktops\students\%location%.

 

And it works!!!

Thanks to everyone who offered ideas, especially @detjo. Although your instructions didn't quite work how they should have, in my case, it was the method of using environment variables that gave me the answer.

 

StevieM = One Happy Bunny!

[detjo]

Yeah, i was a bit hazy on the instructions, i think. It was hard to check with not being able to log on to the old DC. Glad you got it sorted