Windows 10 Base GPO

[gshaw]

Yes you can stop them running but as far as I understand the Modern apps go through some sort of provisioning process for each new user profile on the machine. That's the cause of the slow login process and I remember reading a KB article starting it's by design. Therefore removing unwanted apps that have no need to be there would be of benefit.

 

Also agree that the bugs with customisation are a real pain. MS seem to be going through a rough spell releasing numerous ropey updates at the moment.

 

We want to roll it out more with tablets and laptops first but it feels like a consumer product work-in-progress right now rather than something trustworthy enough for business use.

[burgemaster]

Having issues here where I specify the start layout xml at a unc path normally accessible by everyone, and my start menus appears blank, no tiles, nothing. Layout was exported to xml with the powershell cmdlet. Any updates on this? I'm on build 1511 edu x64

 

We dont seem to have that problem here on RTM. We put the exported XML in netlogon. Using enterprise.

[cogrady84]

We dont seem to have that problem here on RTM. We put the exported XML in netlogon. Using enterprise.

 

Hmm, i tried on RTM and 1511 edu x64 and neither work. I'll give it a go on enterprise for giggles and i'll update the thread, any special permissions other than default on your netlogon?

[cogrady84]

I've noticed some people seem to say that the shortcuts must also be specified in any redirected start menu also, so I tried that and it still didnt work, did you do this?

[cogrady84]

Ok, just trying this on enterprise now, and got slightly further than before. I have calculator, in the correctly named group and the right column/row. Now whats interesting is, Calculator is specified completely differently in the xml file to all the others, and is referenced as an app, rather than a desktop application, see below:

 

 

Any thoughts? Nothing else appears, I have shortcuts to the full Office 2016 suite, wmp, ie11, notepad, control panel, all specified in that xml, but the only thing that shows up is calc, in the correct position.

 

note: i've added a space between

 

Oh, and calculator doesnt actually work...

Edited November 30, 2015 by cogrady84

[cogrady84]

Ok, after disabling firewall, UAC and specifying netlogon and sysvol hardened unc paths with local policy, aswell as enabling verbose startup messaging and always wait for network, all tiles apart from internet explorer have appeared! Wow, ok so it appears it was a problem with windows 10 education after all! As I had this exact same config for edu as ent... now to figure out why IE isnt showing...

[cogrady84]

ok scratch all that, logged off and back on again and it gave me the default tiles again e.g. minecraft, etc on one computer and no tiles on another computer... jesus!!!!!!!!!

[Michael]

The only progress I've made with a re-directed Start Menu, is if the GPO is already in place, at the point the computer is Sysprepped and joined to the domain.

 

Then the re-directed Start Menu works, be it with missing tiles. It's progress, but then I've yet to try changing/updating the existing XML file and see if the change applies. My XML file is hosted in the same share as with a re-directed Desktop.

 

Previously I would re-visit/apply the XML policy after the computer was already joined to the domain. What bearing this has and why it behaves this way is far from clear, but it's very much a backwards step compared to the likes of Folder Redirection which just works!

[cogrady84]

Its just completely inconsistant, my start layout appears to have just completely stopped working, for no reason at all, the user it was applying to now just gets the default start menu with minecraft etc... I didn't even change anything other than logging off and back on... so frustrating

[Arthur]

now to figure out why IE isn't showing.

 

Solving the Internet Explorer icon issue

When we export the file above it exports the Internet Explorers ApplicationID in the .xml file. This will fail when you import it as the Internet Explorer icon doesn’t exist in the users Start Menu folder or as an application during when the Start Menu is imported. It doesn’t exist in the Default start menu folder either and it is not present as an ApplicationID when the Start Menu is imported and therefor it will not show up in the users Start Menu.

 

To solve this we need to do two things, add a .lnk file that points to Internet Explorer somewhere that all end-users can reach it. I will create it in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

 

Then we need to change the information in the exported .xml file as well. The following line in the .xml file needs to be replaced with a pointer to the .lnk file instead of the ApplicationID.

 

DesktopApplicationID="Microsoft.InternetExplorer.Default"

 

So we replace it with the following line instead, using the DesktopApplicationLinkPath instead and pointing to the Internet Explorer.lnk file we created before.

 

DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"

 

If we then log on as a new user once again we get the Internet Explorer icon on the Start Menu as well as intended.

 

Source: http://ccmexec.com/2015/09/customizing-the-windows-10-start-menu-and-add-ie-shortcut-during-osd

 

The same method should work for other applications too (like WMP).

Edited November 30, 2015 by Arthur

[Michael]

A working solution to the Windows 10 Start Menu can be found here

[burgemaster]

I don't suppose you have a screenshot of your broken default win10 start menu Michael? Or maybe a copy of your XML. I could link it onto our test machine start menu GP if you like and send a screenshot back. strangely It all seems to be working here out of the box.

[Michael]

I don't suppose you have a screenshot of your broken default win10 start menu Michael? Or maybe a copy of your XML. I could link it onto our test machine start menu GP if you like and send a screenshot back. strangely It all seems to be working here out of the box.

 

I don't have a screenshot, but I can tell you all I added was Word, Excel, PowerPoint and Publisher 2016, along with Computer, IE and Chrome. That's it for starters.

 

Interestingly, all I have found is when the device is imaged and joined to the domain (via Sysprep), if my GPO is in place it works (sort of). If the GPO isn't there from the start, it doesn't work for new or existing users to that device, yet it did (again sort of) work with my Domain Admin account.

 

As I say, compare this to the likes of Classic Shell, it was installed, customised (involving GPOs and GPP regedit) and it just works, first time, every time, no nonsense.

 

I'd be curious to know also (on a test device), if you change/update your XML, does it still work first time, every time?

[burgemaster]

Sorry for the delay Michael,

This went on the back burner for a while.

What weve found is that for any tile to appear it must also be in the redirected start menu. If any are missing or hidden then the tiles to not show.

They also do not return when the links are added back into the start menu. Weve found that if you change the datestamp on the "\\share\start.xml" then the tiles are re-added.

 

New tiles seem to be working well, new tiles appear when the XML is updated, but weve found another problem that I was wondering if ever came up in your testing.

 

Redirected start menu with "Basic - Redirect everyones folders to the same location" works fine. But if we use want different startmenus for different users.

 

"Advanced - Specify locations for various user groups" and specify a group the redirected start menu doesnt show.

Even though event viewer shows "Successfully applied policy and redirected folder "Start Menu" to \\server\share\StaffStartMenuW10"

 

Is this something that you maybe also experienced too?

 

Thanks in advance

[Michael]

I'm glad you've had some success, but as I say, I've installed Classic Shell on literally hundreds and hundreds of devices now controlled via GPO on many Network Domains and it just works. I have none of the issues you're describing as a result.

 

I've not tried an Advanced Start Menu redirection, but only a Basic (for Staff/Pupils) or nothing at all for Domain Admins. I can't see/think of any reason top of my head why Advanced Start Menu redirection shouldn't work, but seeing as it most likely did for the likes of Windows 7, then in theory it could be an issue with Windows 10, or possibly something permissions related (as a guess).

[burgemaster]

I'm glad you've had some success, but as I say, I've installed Classic Shell on literally hundreds and hundreds of devices now controlled via GPO on many Network Domains and it just works. I have none of the issues you're describing as a result.

 

I've not tried an Advanced Start Menu redirection, but only a Basic (for Staff/Pupils) or nothing at all for Domain Admins. I can't see/think of any reason top of my head why Advanced Start Menu redirection shouldn't work, but seeing as it most likely did for the likes of Windows 7, then in theory it could be an issue with Windows 10, or possibly something permissions related (as a guess).

 

Doh, i had enabled the wrong policy item when locking it down! There's 2 hours wasted...haha

 

Remove Users Folders from Start Menu
Hides all folders on the user-specific (top) section of the Start menu. Other items appear, but folders are hidden.

[lmrogers]

Hey,

 

Im just working on Windows 10 Group policies now. I have had it all setup and nearly ready to go when all of a sudden the windows 10 machine I have been using for testing just appeared to not apply half of the group policies it should have. Has anyone got any ideas as to why this may be?

 

Cheers

[Sheridan]

Windows 10 LTSB, Classic Start Menu and Applocker and I'm nearly happy with the image. Still buggy, still can't manage the Start tiles and Applocker still flakey about blocking powershell.

 

I also don't like the fact that if a non admin searches for powershell, they can find it - they can't run it but they can open the containing folder and therefore browse around the C: drive, despite this being blocked by group policy. Its likes going back to Windows 98 from a management point of view.