CHiLL Posted March 6, 2017 Posted March 6, 2017 We use Start Menu redirection to control the Start Menu, however some items appear in the list that ideally I don't want. How can I remove them? I can't seem to figure it out. For example, the following are appearing: Connect Contact Support Microsoft Edge Photos Search Settings
technodan Posted March 8, 2017 Posted March 8, 2017 (edited) Do you want to use Photos at all? You can completely get rid of it by using Remove-AppxProvisionedPackage in Powershell. This will uninstall it for all users. As for the other apps, you can create an AppLocker packaged app policy (Computer Policies > Windows Settings > Application Control Policies > Applocker) to deny running them. Any new logins will simply not have them in the Start menu at all. Existing logins will still have the apps present, but users will get a message saying "This app has been blocked by your Administrator." You can block/allow apps by user group so if you wanted e.g. staff to use Edge but not students, you can do that. Make sure to have an "Allow All" rule in there somewhere though or certain built-in functions (e.g. Domain joining) will break! In the screenshot below I'm blocking Edge, Contact Support and the Connect app, but allowing everything else. Edited March 8, 2017 by technodan 2
CHiLL Posted March 9, 2017 Author Posted March 9, 2017 Do you want to use Photos at all? You can completely get rid of it by using Remove-AppxProvisionedPackage in Powershell. This will uninstall it for all users. As for the other apps, you can create an AppLocker packaged app policy (Computer Policies > Windows Settings > Application Control Policies > Applocker) to deny running them. Any new logins will simply not have them in the Start menu at all. Existing logins will still have the apps present, but users will get a message saying "This app has been blocked by your Administrator." You can block/allow apps by user group so if you wanted e.g. staff to use Edge but not students, you can do that. Make sure to have an "Allow All" rule in there somewhere though or certain built-in functions (e.g. Domain joining) will break! In the screenshot below I'm blocking Edge, Contact Support and the Connect app, but allowing everything else. [ATTACH=CONFIG]42007[/ATTACH] Unfortunately that hasn't worked for me. The apps aren't blocked and are still appearing in the Start Menu. I've attached a screenshot of my settings. [ATTACH=CONFIG]42035[/ATTACH]
thimon Posted March 9, 2017 Posted March 9, 2017 I also tried using Applocker when first testing Windows 10, quickly gave up. PowerShell is your friend (although even then you can't get rid of everything). Which version of Windows are you running?
CHiLL Posted March 9, 2017 Author Posted March 9, 2017 I also tried using Applocker when first testing Windows 10, quickly gave up. PowerShell is your friend (although even then you can't get rid of everything). Which version of Windows are you running? I'm using Windows 10 Education 1607.
technodan Posted March 9, 2017 Posted March 9, 2017 Unfortunately that hasn't worked for me. The apps aren't blocked and are still appearing in the Start Menu. I've attached a screenshot of my settings. [ATTACH=CONFIG]42035[/ATTACH] Is the Application Identity service running? What shows up in your event logs? Also (and I credit this to me setting it up on a Monday morning!) make sure AppLocker rules are actually marked as configured and enforced...was wondering why on Earth it wasn't working in production (after it working fine in my testing environment) before I remembered to tick that! 1
CHiLL Posted March 10, 2017 Author Posted March 10, 2017 Is the Application Identity service running? What shows up in your event logs? Also (and I credit this to me setting it up on a Monday morning!) make sure AppLocker rules are actually marked as configured and enforced...was wondering why on Earth it wasn't working in production (after it working fine in my testing environment) before I remembered to tick that! [ATTACH=CONFIG]42040[/ATTACH] The Application Identity service wasn't running, so I've set it to start automatically in the GPO. I've also selected the tick box in AppLocker Properties to enforce the packaged app rules. After a few gpupdate /force and reboots, the items are still appearing in the list. However, when I attempt to run them, they say 'This app has been blocked by your system administrator', which is a step in the right direction. If only we could remove them completely from the menu items.
thimon Posted March 10, 2017 Posted March 10, 2017 (edited) If only we could remove them completely from the menu items. dism /online /remove-package /PackageName:Microsoft-Windows-ContactSupport-Package~31bf3856ad364e35~amd64~~10.0.14393.0 get-appxpackage Microsoft.WindowsFeedbackHub | remove-appxpackage PowerShell is your friend : Edited March 10, 2017 by thimon
thimon Posted March 10, 2017 Posted March 10, 2017 (edited) If only we could remove them completely from the menu items. dism /online /remove-package /PackageName:Microsoft-Windows-ContactSupport-Package~31bf3856ad364e35~amd64~~10.0.14393.0 get-appxpackage Microsoft.WindowsFeedbackHub | remove-appxpackage PowerShell is your friend : Edited March 10, 2017 by thimon
technodan Posted March 10, 2017 Posted March 10, 2017 "New" logins (i.e. people who haven't logged onto that machine before) shouldn't have the apps present. Existing ones will need to be cleared off, via Delprof2 or similar. I'm not sure how that will work if you're using mandatory/roaming profiles - we've just stuck with local profiles for now (with group policy preferences to configure a few settings, hide some "first run" splash screens etc). 1
technodan Posted March 10, 2017 Posted March 10, 2017 "New" logins (i.e. people who haven't logged onto that machine before) shouldn't have the apps present. Existing ones will need to be cleared off, via Delprof2 or similar. I'm not sure how that will work if you're using mandatory/roaming profiles - we've just stuck with local profiles for now (with group policy preferences to configure a few settings, hide some "first run" splash screens etc). 1
CHiLL Posted March 13, 2017 Author Posted March 13, 2017 "New" logins (i.e. people who haven't logged onto that machine before) shouldn't have the apps present. Existing ones will need to be cleared off, via Delprof2 or similar. I'm not sure how that will work if you're using mandatory/roaming profiles - we've just stuck with local profiles for now (with group policy preferences to configure a few settings, hide some "first run" splash screens etc). That worked, cheers. However, I now have encountered another issue. I've used this to disable Edge, however now my .url shortcuts have no file associations. This is despite the fact that I am deploying the default apps by the XML file, setting IE11 as the default browser, which worked prior to this change.
technodan Posted March 13, 2017 Posted March 13, 2017 Hmm, that's a new one. What if you use Group Policy Preferences to make a new Open With preference (in User > Control Panel > Folder Options) just for .url files?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now