Windows 10 Start Menu - A Working Solution

[Michael]

Does this get rid of all the standard shortcuts (3DBuilder, etc)? I've been fighting with deployment and drivers so I've not had chance to check yet.

 

If you disable Apps as well (using a GPO), yes it'll hide the lot.

 

User Config > Admin Templates > Classic Shell > Classic Start Menu - Show Apps menu - Enabled, State: Locked to this value and then leave the tick box below unticked.

 

This is already set as part of the templates I uploaded.

[robjduk]

I have a script which Pins items to the taskbar. Im in the middle of stuff at the mo but if you are stuck, PM me and I will dig it out.

[Michael]

That's cool - shame we still can't do this via GPO. Can you post it?

[sparkeh]

That's cool - shame we still can't do this via GPO. Can you post it?

*ahem*

 

Well I was thinking of setting a gpp to copy shortcuts to '%appdata%\roaming\classicshell\pinned' which should set the pinned apps (as long as you're as telling the Start Menu to use the classicshell pinned folder rather than the standard start menu).

 

But yes this would be per user which is a bit of a PITA. Just wondering if anyone had any better ideas?

 

Having apps pinned might be good for our younger users.

 

 

Tested and this works perfectly (so far). I now have different users getting different pinned items depending on AD group and what apps are installed.

Edited January 11, 2016 by sparkeh

[neb1355]

Classic Shell was almost a perfect solution for our Windows 10 tablets... but for some reason the GPO 'Allow deployment operations in special profiles' seems to cause the Classic Start Menu to freeze/crash when enabled?! Without this GPO enabled none of the users to access the built in Metro apps such as Calculator or Maps etc. :-(

[Michael]

Classic Shell was almost a perfect solution for our Windows 10 tablets... but for some reason the GPO 'Allow deployment operations in special profiles' seems to cause the Classic Start Menu to freeze/crash when enabled?! Without this GPO enabled none of the users to access the built in Metro apps such as Calculator or Maps etc. :-(

 

I've deliberately hidden/disabled Apps using App Locker, yet end users can run Calculator and Photos Apps just fine. The only difference is these are not Win 10 tablets (if that makes any difference)?

[neb1355]

I've deliberately hidden/disabled Apps using App Locker, yet end users can run Calculator and Photos Apps just fine. The only difference is these are not Win 10 tablets (if that makes any difference)?

 

I've got App Locker working fine and blocking most of the default metro apps except ones like Calculator. As I mentioned above we need the 'Allow deployment operations in special profiles' enabled to allow the Metro Apps to work but this seems to be the only GPO that also breaks the Classic Shell annoyingly. Are there any other alternatives to Classic Shell perhaps?

[Garacesh]

So, for someone that's never used AppLocker before, how easy/difficult is it to set up? Anyone got a decent guide for using it with W10? (I know I could Google it, and I will if I get no response, but it always helps to have someone in a similar situation say "I used this guide and understood it well.")

[sted]

So, for someone that's never used AppLocker before, how easy/difficult is it to set up? Anyone got a decent guide for using it with W10? (I know I could Google it, and I will if I get no response, but it always helps to have someone in a similar situation say "I used this guide and understood it well.")

as long as you test your settings on something before you fire them out site wide fairly easy

[neb1355]

This is the guide I used to set up AppLocker: Blocking built-in apps in Windows 10 using Applocker - CCMEXEC.COM – System Center blog

[Garacesh]

This is the guide I used to set up AppLocker: Blocking built-in apps in Windows 10 using Applocker - CCMEXEC.COM – System Center blog

 

Thanks.

So I'm to understand it doesn't get rid of the icon in the start menu, but does stop the program from launching? Apparently I can't read.

 

So what happens, do you know, if an Admin logs in that doesn't have the applocker policy (Say, the local admin account)? It still keeps it hidden for everyone else?

And does this make the first logon sequence shorter, if it's stopping programs being installed?

Edited January 18, 2016 by Garacesh

[neb1355]

You can set the AppLocker policies to apply to different user groups. I believe local administrator accounts bypass any restrictions though.

 

It should be fairly self explanatory once you start playing around with it, there's also plenty of other guides out there on the interwebz :-)

[sted]

You can set the AppLocker policies to apply to different user groups. I believe local administrator accounts bypass any restrictions though.

 

It should be fairly self explanatory once you start playing around with it, there's also plenty of other guides out there on the interwebz :-)

 

they wont run as local administrator anyway iirc as you need uac on and thats always off on local administrator (it gives a message to that effect if you try it)

[Garacesh]

You can set the AppLocker policies to apply to different user groups. I believe local administrator accounts bypass any restrictions though.

 

It should be fairly self explanatory once you start playing around with it, there's also plenty of other guides out there on the interwebz :-)

Thank you again, I'll be looking into it

 

they wont run as local administrator anyway iirc as you need uac on and thats always off on local administrator (it gives a message to that effect if you try it)

Well my issue is that the local admin account is logged in as part of our deployment sequence, before the machine is joined to the domain (thusly, before any policies are applied)

[sted]

Well my issue is that the local admin account is logged in as part of our deployment sequence, before the machine is joined to the domain (thusly, before any policies are applied)

that user dosent need to be able to run say maps/calc etc though do they? if thats the only account on the pc i see no issue yes if you logged in as admin2 say they could run modern apps but it would need a user account to do so

[Garacesh]

Well, no. But my issue is with:

if the user never logged on to the computer before the Applocker policy is applied the application, in this case Contact support is not installed for the user at all and therefor not present either on start or by using search which is really great!

 

If the local admin logs in as part of the deployment sequence, it installs Contact Support and all the rest. So they're still going to show up in everyone else's start menu, right? Just get the 'blocked by your administrator' error?

Not a massive issue, just a niggle from the 'Making things look nice' view.

[sted]

Well, no. But my issue is with:

 

 

If the local admin logs in as part of the deployment sequence, it installs Contact Support and all the rest. So they're still going to show up in everyone else's start menu, right? Just get the 'blocked by your administrator' error?

Not a massive issue, just a niggle from the 'Making things look nice' view.

if you want the apps 100% removed just use dism on the install.wim file on the dvd and remove them from the image

[DJ-1701]

Although AppLocker is configured on a machine basis, Apps are generally installed per user, so you shouldn't get Conatact Support as long as it has been disabled in AppLocker and the Application Identity service has been set to start on bootup before the users first logon to the machine. Edited January 18, 2016 by DJ-1701

[Sheridan]

I think its a telling indication of Windows 10 readiness that a third party solution is the fix to something Microsoft couldn't get to work

[Garacesh]

I might've ballsed things up.. Testing applocker, set deployment sequence going.. Machine is now hanged on a black screen. Yaay

[Blue_Cookeh]

Does anyone know if this fixes an issue where users cannot click on anything along the task bar? I'm getting reports that occasionally our kids can't click on the task bar/search bar/start button.

[Michael]

Does anyone know if this fixes an issue where users cannot click on anything along the task bar? I'm getting reports that occasionally our kids can't click on the task bar/search bar/start button.

 

Yes and no - for users who can no longer access/open the Windows 10 Start - Classic Shell does resolve this issue. This is typically caused by a corrupt profile.

 

As for the Search Bar (I presume you mean Cortana?), I disable this with a GPP as it serves no real use day to day. I've not had any other reports of users unable to click or pin Apps on the Taskbar.

[Blue_Cookeh]

Yes and no - for users who can no longer access/open the Windows 10 Start - Classic Shell does resolve this issue. This is typically caused by a corrupt profile.

 

As for the Search Bar (I presume you mean Cortana?), I disable this with a GPP as it serves no real use day to day. I've not had any other reports of users unable to click or pin Apps on the Taskbar.

 

The profile is a roaming profile for a generic account a younger class use, so I'd have thought if it was a profile issue I'd have seen it across all devices. Also what I mean is, the user cannot actually click anything along the task bar (including start button/cortana).

 

Either way I'll give Classic Shell a go, was just hoping someone might have a more definitive answer before I waste time pursuing it

 

Might end up going back down to W8.1

[Michael]

The profile is a roaming profile for a generic account a younger class use, so I'd have thought if it was a profile issue I'd have seen it across all devices. Also what I mean is, the user cannot actually click anything along the task bar (including start button/cortana).

 

Either way I'll give Classic Shell a go, was just hoping someone might have a more definitive answer before I waste time pursuing it

 

Might end up going back down to W8.1

 

Thinking about it (top of my head), the only time I've seen similar behaviour is if you apply a deny rule (for all) using Applocker and no Allowed Apps. As to whether this is a bug or a coincidence, I'm not sure.

 

Classic Shell's great for Windows 8, 8.1 and 10

[sparkeh]

Does anyone know if this fixes an issue where users cannot click on anything along the task bar? I'm getting reports that occasionally our kids can't click on the task bar/search bar/start button.

 

Interesting as I think I have just hit this problem. Can't nail down exactly what's going on but randomly the start menu (classic start), task bar and notification area just stop responding. Then you have CTRL + ALT + DEL sign out.