Windows 10 Deployment in School Best Practice w/ GPO

[FWBD]

I'm currently getting ready to deploy Windows 10 Education across our campus this summer to multiple computers and laptops using MDT and I'm struggling to get the start menu and a few other key bits locked down so students can't muck about with the settings. Has anyone achieved something similar and if so what have they done in order to do so?

 

Some things I'm looking into currently and having not much success with includes:

 

Removing/Disabling Sleep in the Power menu

Hiding several folders in the start menu i.e. Powershell/admin tools/system tools

Disabling or changing the WinX menu so that it either doesn't load up or doesn't show CMD and other programs

 

I'd like to make these changes globally if possible as going around every device isn't ideal

 

Any tips or suggestions are appreciated

[QwertyMash]

I can help with the start menu - you need to deploy an XML start menu - it is a bit of a pig to be honest.

Have you added the ADMX templates for Windows 10 so you can block the apps being used etc.

 

Do you have a list of all your goals you would like and I can help point you at the correct GPOs or PowerShell/MDT funness you need to do haha.

[FWBD]

The start menu layout itself I have managed to get exporting fine after a few lines of extra were needed. It's the folders in the all programs/apps menu which I'd like to edit and try hide.

 

Goals so far are listed above but it is work in progress at the moment and we'll add to it as more things crop up

[eddyc]

Also following this post with interest as it seems we're in a similar position. We have the XML working and folder redirection working but lots of the default windows apps are still listed on all programs like calculator, paint, etc. Any way to tidy these up and put them into a folder/remove them?

[mrbios]

Disabling or changing the WinX menu so that it either doesn't load up or doesn't show CMD and other programs

 

Depends how you do your profiles, but personally as our students are on a mandatory profile, i've just modified the appdata\local\microsoft\windows\winX folder as part of the profile. They're in 3 groups, just delete what you don't want to show up. Hey presto. You could do the same thing with local and roaming profiles with a GPP to delete them i guess.

 

EDIT: %localappdata%\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk for example should delete one of the powershell links from the list.

Edited June 29, 2017 by mrbios

[FWBD]

Depends how you do your profiles, but personally as our students are on a mandatory profile, i've just modified the appdata\local\microsoft\windows\winX folder as part of the profile. They're in 3 groups, just delete what you don't want to show up. Hey presto. You could do the same thing with local and roaming profiles with a GPP to delete them i guess.

I had done that before with no luck but I've just copied your example and it has worked!

 

I was using %localappdata%\Microsoft\Windows\WinX\Group3\Windows PowerShell.lnk as apposed to %localappdata%\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

 

I can't find any reference to it being called the second in the shortcut link. My next question is how did you find that out and where can I get the full names for the other shortcuts!

[mrbios]

I had done that before with no luck but I've just copied your example and it has worked!

 

I was using %localappdata%\Microsoft\Windows\WinX\Group3\Windows PowerShell.lnk as apposed to %localappdata%\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

 

I can't find any reference to it being called the second in the shortcut link. My next question is how did you find that out and where can I get the full names for the other shortcuts!

 

If you create the policy on a windows 10 machine and browse to the links in the policy window it'll give you the real name rather than the displayed name. Frustrating i know!

 

For the most part you can set a delete policy to get rid of the entire Group3 folder. Personally I delete group3 on staff and students, then delete most of group2 for students and leave them for staff.

[FWBD]

Okay so just to recap on what I've managed to achieve so far I've locked down the Win X menu so students and staff which is a step closer to what I'm achieving.

 

I've also used the same method to delete certain folders in the start menu for students so they are no longer able to see the System Tools, Administrator Tools and PowerShell folders any more!

 

So next on the check list is:

 

Removing/Disabling the sleep button in the power menu under start

Preventing users from using the 'Open File Location' button in start and navigating to the C: Drive

Limiting the results in Windows Search

[mrbios]

Removing/Disabling the sleep button in the power menu under start

Preventing users from using the 'Open File Location' button in start and navigating to the C: Drive

Limiting the results in Windows Search

 

All of these are achievable using group policy i think.

 

Certainly when i try and use open file location as a student i get permissions issue pop ups, and C: is removed using group policy from the drives window. Have you set those? The "Remove access to these drives" and "prevent access to these drives" settings in windows components > file explorer of the user settings.

 

Sleep button, i can't quite remember how to do that one, but have you made sure all the power options in the computer settings section of GP are disabled? Also additional tip, if you never use hibernate run the command "powercfg -h off" and it'll remove the hibernation file saving you a few GB of space.

[FWBD]

Certainly when i try and use open file location as a student i get permissions issue pop ups, and C: is removed using group policy from the drives window. Have you set those? The "Remove access to these drives" and "prevent access to these drives" settings in windows components > file explorer of the user settings.

The C: Drive is hidden for students here but not restricted as it caused issues with software needing access.

 

 

Sleep button, i can't quite remember how to do that one, but have you made sure all the power options in the computer settings section of GP are disabled? Also additional tip, if you never use hibernate run the command "powercfg -h off" and it'll remove the hibernation file saving you a few GB of space.

 

Been playing around with that already but the power settings seem to be more focused towards saving power and less to do with removing buttons

[mrbios]

The C: Drive is hidden for students here but not restricted as it caused issues with software needing access.

 

Ah, might have a tough job with that one then. Which software was it? I've not had a problem with it over the course of 3 OS's in 10 years. but let me guess...is it made by pearson?

[FWBD]

Ah, might have a tough job with that one then. Which software was it? I've not had a problem with it over the course of 3 OS's in 10 years. but let me guess...is it made by pearson?

 

I'd have to double check as it was stuff in place before I arrived but it wouldn't surprise me!

 

In regards to power I have found a registry setting which removes sleep from the power menu. Found this one buried in a tech net thread;

 

HKLM\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab

Create the Dword "ACSettingIndex" and set value to 0

All I need to do now is add a log off button to the power menu now but that is more house keeping if anything