Redirecting Start Menu stops File Explorer link from working, but not explorer.exe

[Garacesh]

Building User GPO's from scratch (actually, rebuilding everything from scratch...) and I've hit this confusing little snag.

 

User Configuration

Policies

Windows Settings

Folder Redirection

Start Menu

 

This handy little GPO clears absolutely everything out of the Start Menu except the 'Settings' link. Is good! But an unfortunate side-effect is that the File Explorer link (above Settings, Power and All Apps) doesn't do anything.. You click it, the Start Menu vanishes, but no explorer window opens. The little > arrow next to it still works, bringing up the users Quick Access links, and those do work, launching an explorer window to the requested folder (annoyingly, Documents isn't being redirected for some reason, but Downloads, Desktop and Pictures all are...)

The shortcut in the Start Menu (Target type: Microsoft.Windows.Explorer, Target location: Applications) doesn't work either.

Win+R, explorer.exe does work.

 

Windows 10 Enterprise LTSB, 10.0.10240

 

Anyone dealt with this?

 

(Getting some real semantic satiation on the word 'Explorer' right now..)

Edited April 13, 2016 by Garacesh
Derp, confused explorer.exe and explorer.exe. I am not a smart man.

[free780]

I had the same thing. I think I just did a shortcut to the home drive on the start layout. I think it's to do with hiding c:

[Garacesh]

I haven't hidden C:

(I plan to, but I'm working my way through policy bit-by-bit and haven't set that one yet)

Removing the Start Menu redirection (but keeping Documents etc redirected) fixes the issue, so it seems intrinsically linked to that

Edited April 13, 2016 by Garacesh

[free780]

Well done m$. Further testing needed. Edited April 13, 2016 by free780

[Ephelyon]

Just a hunch - and it's probably wrong - but does it work if you run the following as Administrator on your testing workstation (and reboot to be on the safe side)?

 

fsutil behavior set SymlinkEvaluation L2L:1 L2R:1 R2L:1 R2R:1

[Garacesh]

Computer is currently reimaging, should be done in <10 mins, will try.

 

Should I execute that from an unaffected account (such as the local administrator) or from an account with the redirection policy applied?

I need more caffeine.

[Garacesh]

fsutil behavior set SymlinkEvaluation L2L:1 L2R:1 R2L:1 R2R:1 returns no response, but %ERRORLEVEL% is 0.

Rebooted PC, login as test user, symptoms still persist.

[Ephelyon]

Just checking.

 

For info, what that command does is enable symbolic links to work across different local and remote volumes, and from local to remote and vice versa. We use it to enable a symbolic link in our redirected Start Menu to the local menu (only admins can see it though - ABE is enabled on the Start Menu file share).

 

What happens if you change the default target of File Explorer from Quick Access to This PC (in Folder Options)?

[Garacesh]

What happens if you change the default target of File Explorer from Quick Access to This PC (in Folder Options)?

Still nada, even after reboot. CTRL+R 'explorer.exe' fires up This PC as expected, but the Start Menu link still doesn't work.

 

If I can get Documents redirecting properly, it's not strictly required (they can just click the > and then Documents) but Documents doesn't seem to want to redirect, either, though Music, Pictures, etc still does. I've tried both mapping Documents by explicit path (to the mapped drive) and %HOMEPATH%%HOMESHARE%, and I've tried the "Redirect to the user's home directory" option. Neither work.

 

Edit: %HOMEDRIVE% doesn't work either, but if I navigate to %HOMEDRIVE% as the test user it does interpret it correctly and take me to \\file-server\etc\etc\user.. So it appears the policy is the problem itself, not how I'm formatting the location.

Edited April 14, 2016 by Garacesh

[Ephelyon]

It should just be %HOMESHARE%, I think.

 

It might be worth logging the test user on, then opening the Registry on that computer (ensure the Remote Registry service is enabled and started), finding their profile hive key (i.e. SID) in HKEY_USERS and drilling down through Software\Microsoft\Windows\CurrentVersion\Explorer to check how the entries for Personal have been applied in the Shell Folders and User Shell Folders subkeys. They should be the direct result of whatever settings the policy has applied. If they don't look right, or don't seem to be updating when you change the policy, it'd be worth running the Group Policy Modelling/Results Wizards against that user/computer combination.

[Garacesh]

It should just be %HOMESHARE%, I think.

 

It might be worth logging the test user on, then opening the Registry on that computer (ensure the Remote Registry service is enabled and started), finding their profile hive key (i.e. SID) in HKEY_USERS and drilling down through Software\Microsoft\Windows\CurrentVersion\Explorer to check how the entries for Personal have been applied in the Shell Folders and User Shell Folders subkeys. They should be the direct result of whatever settings the policy has applied. If they don't look right, or don't seem to be updating when you change the policy, it'd be worth running the Group Policy Modelling/Results Wizards against that user/computer combination.

 

...\Explorer\Shell Folders "Personal" is unmodified, as is the User Shell Folders equivalent, linking to C:\Users\$User\Documents. I've made a GPO user preference that changes the HKCU\SOFTWARE\...\Shell Folders\Personal and HKCU\SOFTWARE\...\User Shell Folders\Personal values to their mapped drive, and that's fixed it. Still, pretty annoying that Folder Redirection doesn't work for Documents but does work for all the other folders..

 

Still doesn't fix the issue of the File Explorer link not working, but given that the Quick Access links all now point to the right locations, it's less of an issue.

[Ephelyon]

You've found more details of the issue, but a Preferences-based fix is not ideal - the ordinary redirection policy should be applying.

 

Do the Wizards shed any light on that - conflicting policy upstream etc?

[Garacesh]

Do the Wizards shed any light on that - conflicting policy upstream etc?

No idea. Don't know what wizards you're on about First time doing policy on such a grand scale.

I'm rebuilding policy from scratch, so there shouldn't be anything blocking it. Only 2 GPO's contain folder redirection policies, one that is a general user policy (redirects documents et al) and the other is the pupil redirection policy (redirects start menu and desktop).. Members of staff will have their own start menu/desktop policy, too, but I haven't gotten around to creating that yet. The "Redirect Documents" and "Redirect Pictures/Videos/Music/Downloads" are all part of the same GPO, so the policy itself is being applied as the others work.

 

I'm positive I found threads yesterday on Spiceworks and (the-site-formerly-known-as) Technet of others asking about this but I can't seem to find them again today

 

And this stupid bug with the Group Policy Management console that makes the policy list refresh when you press T (thus disabling the ability to rename a policy to anything with the letter T in it) is doing my nut in

Edited April 14, 2016 by Garacesh

[Ephelyon]

Down the bottom of the Management Console:

 

Group Policy Modelling Wizard (simulates applying all settings and shows where policies might conflict)

Group Policy Results Wizard (collects actual results of policy application - must be run against a user currently or previously logged on to a computer since the last reboot)

[Garacesh]

Group Policy Modelling says it should be successful using the test user and test machine.

 

[b]Applied GPOs[/b]


[indent]Windows 10 - User Policy - All Users (Docs via Folder Redirection) [incremental][/indent]


[b]Denied GPOs[/b]


[indent]Windows 10 - User Policy - All Users (Docs via Registry) [incremental]			Disabled Link[/indent]

Policy names are a little haphazard at a glance, but make sense to me. Anything [incremental] is still under production, so there are lots of little policies each doing individual things, thus incrementally applied. When I'm happy I've done all I need to, I consolidate them all into one policy labelled [Completed].

 

Further down it says:

[b]Component Status[/b]


[indent][b]Component Name[/b]
[indent]Folder Redirection			Success[/indent]

[/indent]

 

 

Group Policy Results with test user and test machine show similar results

[Ephelyon]

In that case, have a look at the Application Event Log for Group Policy events during user logon. If the Shell Folders / User Shell Folders links aren't being updated, the policy isn't applying properly and something is very wrong...

[Garacesh]

In that case, have a look at the Application Event Log for Group Policy events during user logon. If the Shell Folders / User Shell Folders links aren't being updated, the policy isn't applying properly and something is very wrong...

 

Just logged in now, with the (via Folder Redirection) policy applied and you're right, there is an error.

Failed to apply policy and redirect folder to "Documents" to "\\file-server\...\TestUser\".
Redirected options=0x1200.
The following error occured: "".
Error details: "This security ID may not be assigned as the owner of this object.
".

 

However, the user has Full Control permissions on its home folder, and the current owner is the local Administrators group on the File Server, which also has Full Control.

 

All the other folder redirects (Downloads, Pictures etc) are applied fine, and are set up in exactly the same way, to subfolders of the same directory (eg \\file-server\...\TestUser\Downloads). All these subfolders are inheriting permissions.

 

Google is being considerably less-than-helpful with this error :/

Edited April 14, 2016 by Garacesh

[Ephelyon]

https://support.microsoft.com/en-us/kb/2493506

[Garacesh]

How in the heck..? O.o

 

Seriously, I spent some time searching the error code looking for a solution before posting that reply, as I don't really want to be asking about an error that can be fixed by looking at the first result in Google. I did not find that page.

 

Enabling both settings results in the same error, however disabling them both makes it work.

 

File Explorer link still doesn't work though

[Ephelyon]

First result on search "folder redirection security id may not be assigned as the owner of this object"...

 

At least it's working now from a functional perspective

[Garacesh]

Hm, I must have glossed over it because it only says it relates to Vista or 7

[Ephelyon]