[1703, cu] Allow User Accounts to Create Shortcuts

[Bedders]

Hi EduGeeks,

 

Hope you've all survived/are surviving in the recent bad weather

 

My task today is to create a shortcut to a program on our Accounts Team's desktops and Start Menus. I am using GPO on a Server 2008 R2 domain controller, with the latest 1709 ADMX files.

 

The EXE that the shortcut needs to point to is located on a shared network drive that is restricted to our Accounts team.

 

During testing I found that simply adding the shortcut through Group Policy won't work, as the target EXE could not be found. I believe this is because the SYSTEM account that creates the shortcuts on the local machine has not got access to the EXE.

So I moved the shortcut creation GPO into the User Policy rather than Computer Policy, and told it to run as the logged-on user. This then failed because by default our users have not got security permissions on the "%AllUsersProfile%\Microsoft\Windows\Start Menu" folder.

 

Next I tried to add 'Everyone' and 'BUILTIN\Users' and granted them full control onto the following folders:

 

> %AllUsersProfile%\Microsoft\Windows\Start Menu\

> %SystemDrive%\Users\Public\Desktop\

 

This created the shortcuts successfully. Great, I thought!

However, now users cannot pin anything to their Start Menu. The option is no longer in the Context Menu for them. (Start Menu is applied using an XML file to add locked groups, then users can add anything else but not touch the defaults.)

 

So my question: How would you wonderful people go about doing this? I can see a couple of options:

1. Adding the SYSTEM account to be able to access our entire Accounts share. Really not ideal as I don't understand the full implications of allowing this.
   
2. Finding the correct permissions to allow start menu/desktop items to be added by users whilst retaining the 'Add to Start Menu' option in the Context Menu.
   

 

EduHugs and EduHobNobs* to anyone who can help!

 

* Rewards may be claimed virtually, or by PM'ing your postal address to me and when I get round to it I'll get a packet or two shipped.

[Bedders]

Also going to post this on Experts Exchange. I'll update here if I get an answer.

 

Basic Question is: How do I create a Start Menu shortcut to an EXE on an NTFS restricted drive on Windows 10?

[sted]

you could just manually create the shortcuts once copy them to a server in a place the pc account has read access to and just file copy them across rather than creating a shortcut on login

[Rob_D]

Is there a reason not to use redirected start menus?

Otherwise, I'd go with sted, and just have a simple copy in the startup/login script.

[Bedders]

Is there a reason not to use redirected start menus? Otherwise, I'd go with sted, and just have a simple copy in the startup/login script.

 

Thanks Rob, yes there's a reason - we would like our users to be able to customise them to add additional tiles if they want to. As I understand it, Redirected Start Menus don't allow this.

 

you could just manually create the shortcuts once copy them to a server in a place the pc account has read access to and just file copy them across rather than creating a shortcut on login

 

I didn't realise this would work - This is what I've now done:

 

• Create the shortcut .lnk in the "\\DOMAIN.FQDN\NETLOGON" folder
  
• In Group Policy Editor on the domain controller gone to "Computer Configuration" -> "Preferences" -> "Windows Settings" -> "Files".
  
• Right-click -> New -> File
  
• Action is "Replace"
  
• Source Name is "\\DOMAIN.FQDN\NETLOGON\ShortcutName.lnk"
  
• Destination File is "%CommonStartMenuDir%\ShortcutName.lnk"
  

 

Thanks for your help folks (Don't know if this is allowed - If either of you PM's me a postal address then next week I'll ship a couple of packs of EduHobNobs out! )