Windows 10 - Unstable Start Menu & Cortana issues

[dsgoody]

Hi all,

 

We have deployed Windows 10 Education 1511 site wide; and are working to nail down the Group Policies ready for September. We are currently seeing the following issues:

 

• Using Cortana seems to bypass UNC path restrictions in File Explorer;
  
• The Start Menu seems really unstable, with the File Explorer and Settings link disappearing at random and users loosing their tiles. We injected a default Start Menu layout into the default user profile on the machines using PowerShell Import-StartLayout.
  

 

Other than that everything seems to be working for the minute. Removal of the Xbox, Music, Video and Get Office apps; Default App Associations; Lock Screen & Default User Image Replacement all work. Even the Mandatory profile seems to be working (so far).

 

Cheers,

 

Dave.

[mavhc]

1607 disabled Cortana for Education version. Can't you actually secure the shares instead of relying on them being slightly hard to find?

 

Odd that you've let Settings be enabled though.

 

File explorer's defaults have changedin 1607 too, annoying.

 

You say you have a start menu xml in default profile on the machines, but then say you're using Mandatory profiles, I'm confused.

 

How are you removing the metro apps?

[dsgoody]

1607 disabled Cortana for Education version. Can't you actually secure the shares instead of relying on them being slightly hard to find?

They are secured; but as is the way there are always the odd one or two bits and pieces (network apps for example) that Students have full access to - and I wouldn't want them getting to these. They are all hidden $ shares; but it only takes one of them to work out the network path.

 

Odd that you've let Settings be enabled though.

It's disabled through AppLocker; it's more File Explorer that they will use.

 

You say you have a start menu xml in default profile on the machines, but then say you're using Mandatory profiles, I'm confused.

Staff get roaming; Students get mandatory - both pickup the default layout.

 

How are you removing the metro apps?

Get-AppXProvisionedPackage -Online | Where-Object {$_.packagename -like "*Zune*"} | Remove-AppxProvisionedPackage -Online

Get-AppXProvisionedPackage -Online | Where-Object {$_.packagename -like "*XboxApp*"} | Remove-AppxProvisionedPackage -Online

Get-AppXProvisionedPackage -Online | Where-Object {$_.packagename -like "*MicrosoftOfficeHub*"} | Remove-AppxProvisionedPackage -Online

This is run through a PowerShell script when the machines are built via SCCM.

[dsgoody]

How it should look:

 

How it sometimes looks:

[dsgoody]

After extensive Googling and testing; I believe the problem lies with the way Windows 10 1511 handles the local profile component when using roaming profiles with 'Delete cached copies of roaming profiles' enabled in GPO.

 

After some Googling; this looks be be resolved, or at least improved, in 1607. So after months of preparing for 1511 it looks like our hand might be forced towards upgrading the whole site before September. Anybody else having the same experience?

Edited August 11, 2016 by dsgoody

[free780]

Yes. The dilemma is that going to 1607 so quickly is a bit worrying. It doesn't reach wsus until the 16th. Very little 3rd party software will be tested on it. Unless you have a zero touch solution in place its going to be a nightmare doing it within term time. A wol in the night and the wsus method may work. Or even a re-image. A lot of schools/colleges are bound to have software that has to be manually installed. I'd stick with 1511 for the first couple of months.

[dsgoody]

Yes. The dilemma is that going to 1607 so quickly is a bit worrying. It doesn't reach wsus until the 16th. Very little 3rd party software will be tested on it. Unless you have a zero touch solution in place its going to be a nightmare doing it within term time. A wol in the night and the wsus method may work. Or even a re-image. A lot of schools/colleges are bound to have software that has to be manually installed. I'd stick with 1511 for the first couple of months.

I can't agree more; and I've been really hesitant in even thinking about it. My original plan was think about it once the September rush is out the way, possibly looking for an October or April deployment. It's really what's the lesser of the two evils....?

 

We can use SCCM to push the upgrade no problem. Suppose we will have to get some testing done in-between now and then.

[mullet_man]

They are secured; but as is the way there are always the odd one or two bits and pieces (network apps for example) that Students have full access to - and I wouldn't want them getting to these. They are all hidden $ shares; but it only takes one of them to work out the network path.

 

 

 

They can reveal the share if you have a redirected start menu to a network share, by right clicking on the icon, choosing more and then open file location. See image.

 

 

I've only just noticed this was possible today so am guessing there isn't a way to lock this down?

 

I can access the share by putting it in the search too.

Edited August 11, 2016 by mullet_man

[KibosJ]

They can reveal the share if you have a redirected start menu to a network share, by right clicking on the icon, choosing more and then open file location. See image.

 

I've only just noticed this was possible today so am guessing there isn't a way to lock this down?

 

I can access the share by putting it in the search too.

 

We have removed the "Open File Location" option from right click for all of our users.

 

This is the policy we use:

 

[TABLE=class: subtable]

[TR]

[TD]Hive[/TD]

[TD]HKEY_CLASSES_ROOT[/TD]

[/TR]

[TR]

[TD]Key path[/TD]

[TD]lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu[/TD]

[/TR]

[TR]

[TD]Value name[/TD]

[TD](Default)[/TD]

[/TR]

[TR]

[TD]Value type[/TD]

[TD]REG_SZ[/TD]

[/TR]

[TR]

[TD]Value data[/TD]

[TD]0[/TD]

[/TR]

[/TABLE]

[mullet_man]

We have removed the "Open File Location" option from right click for all of our users.

 

This is the policy we use:

 

[TABLE=class: subtable]

[TR]

[TD]Hive[/TD]

[TD]HKEY_CLASSES_ROOT[/TD]

[/TR]

[TR]

[TD]Key path[/TD]

[TD]lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu[/TD]

[/TR]

[TR]

[TD]Value name[/TD]

[TD](Default)[/TD]

[/TR]

[TR]

[TD]Value type[/TD]

[TD]REG_SZ[/TD]

[/TR]

[TR]

[TD]Value data[/TD]

[TD]0[/TD]

[/TR]

[/TABLE]

 

You superstar, thanks for that.

 

Just need a way of stopping being able to open file shares from the search box and I think am good to go.

[KibosJ]

You superstar, thanks for that.

 

Just need a way of stopping being able to open file shares from the search box and I think am good to go.

 

I've also disabled search and Cortana. I've used AppLocker for this, if you block Cortana with applocker it also disables searching from the start menu.

[mullet_man]

I've also disabled search and Cortana. I've used AppLocker for this, if you block Cortana with applocker it also disables searching from the start menu.

 

That's great thanks for the advice, I'll have a play with that.

[mullet_man]

I've also disabled search and Cortana. I've used AppLocker for this, if you block Cortana with applocker it also disables searching from the start menu.

 

Hi KibosJ just looking now, so I just need to disable Cortana via applocker to disable search as well?

[mullet_man]

We have removed the "Open File Location" option from right click for all of our users.

 

This is the policy we use:

 

[TABLE=class: subtable]

[TR]

[TD]Hive[/TD]

[TD]HKEY_CLASSES_ROOT[/TD]

[/TR]

[TR]

[TD]Key path[/TD]

[TD]lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu[/TD]

[/TR]

[TR]

[TD]Value name[/TD]

[TD](Default)[/TD]

[/TR]

[TR]

[TD]Value type[/TD]

[TD]REG_SZ[/TD]

[/TR]

[TR]

[TD]Value data[/TD]

[TD]0[/TD]

[/TR]

[/TABLE]

 

Is there more to this? I can't get it working.

[mavhc]

Now you're removing useful features instead of securing your shares

[Arthur]

so I just need to disable Cortana via applocker to disable search as well?

Cortana can be disabled via Group Policy too.

 

Computer Configuration \ Administrative Templates \ Windows Components \ Search \ [b]Allow Cortana[/b]

 

There's also a setting called "Prevent indexing certain paths" in the same section that sounds like it could do what you want.

 

Obviously securing shares with the appropriate permissions also helps.

[mullet_man]

Now you're removing useful features instead of securing your shares

 

My start menu is redirected, so when they open file location it opens the share where my start menu is, revealing server name and hidden share name.

 

I'll double check my permissions so they can't access the other start menus in this share.

[mullet_man]

Cortana can be disabled via Group Policy too.

 

Computer Configuration \ Administrative Templates \ Windows Components \ Search \ [b]Allow Cortana[/b]

 

There's also a setting called "Prevent indexing certain paths" in the same section that sounds like it could do what you want.

 

Obviously securing shares with the appropriate permissions also helps.

 

I have Cortana disabled via GP, it was the issue of being able to just open file shares really easily from the search.

 

I thought I tested the prevent paths GP and it still let me access the shares, I'll double check though.

 

I'll obviously check my share permissions too to lock them done further.

[mavhc]

My start menu is redirected, so when they open file location it opens the share where my start menu is, revealing server name and hidden share name.

 

I'll double check my permissions so they can't access the other start menus in this share.

 

But it disables open file location for everywhere in Windows.

 

If you don't want people to run certain apps, deny their read rights to that exe.

[KibosJ]

Is there more to this? I can't get it working.

 

It works for me, have you applied it as a Computer Policy and not a User policy?

[mullet_man]

It works for me, have you applied it as a Computer Policy and not a User policy?

 

Yes, I tested just on a test VM locally but couldn't get it working. I'll have another test a some point but I've tightened up my startmenu/desktop icon share so that if someone clicks open file location they can't browse into some of the other shortcut folders.