Windows 10 1709 & Server 2012 R2 – Group Policy Management of the Start Menu

[FlowerManDan]

Hello, can someone please lend me a hand with this one? Feel like I am hitting my head against a brick wall aha...

 

I want to set up a default start menu for all student users. I’ve made sure I’ve got the latest ADMX files for Windows 10 1709.

 

Is it possible to redirect the start menu like you could in Windows 7?

 

I’d like to setup a start menu where each student user has the same pinned tiles to quickly access programs and that stops them accessing such things as CMD from the start menu.

 

I have attempted to get this working using the Powershell cmdlet export-startlayout and then applying this via GPO. It does apply to the user I was testing but the tiles/groups I arranged loaded in a different format than what I exported them as, it looked all disorganised and some apps (Such as IE) didn't show up at all. I will get screenshots when next on site but will attach the .xml.

 

I am also struggling to find a way to restrict the user access to CMD, Powershell etc… How can I do this for Windows 10? I want to get rid of these folders (Windows Powershell, Administrative Tools etc..) for the student users start menus and just have some of the windows apps and all the installed programs appear in the all programs list.

 

Users just have Local Profiles in this current setup.

 

Please tell me there is a nice neat, group policy way of doing this? Why have Microsoft made this so difficult?

startlayoutv1.txt

Edited December 14, 2017 by FlowerManDan

[3s-gtech]

1) Yes, you can redirect Start Menus.

2) You're on the right lines. Once you have created the layout with Powershell, you can easily edit it directly in Notepad.

3) If any icons you're trying to add are not also in the Start Menu they won't show in the layout. The classics for this are things like This PC. They need to be in both.

4) Applocker is needed to whitelist or blacklist the software you don't want to run. Students can load anything in Program Files or the Windows folder at their own privilege level, so ping, nslookup etc work by default. You can lock down certain apps using User Configuration/Admin Templates/System/Don't run specified Windows applications - you can put powershell.exe and cmd.exe in here.

[FlowerManDan]

Thanks for the info and your reply. So am I right in think that if I setup a GPO to copy the IE shortcut to %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\ , pin it to the start menu and the export the startlayout.xml, it would then show up? Or am I over thinking it?

 

Also, thank you for the heads up regarding Applocker and the GPO path regarding stopping programs from running, this will be good to use if I am unable to get rid of the folders from the start menu All Programs list.

[3s-gtech]

If that location is used as your Start Menu, and IE isn't already there, it should show up. We block that location for our users and redirect to a network share, but nothing wrong with your approach.

[james5150]

If that location is used as your Start Menu, and IE isn't already there, it should show up. We block that location for our users and redirect to a network share, but nothing wrong with your approach.

 

On the back of this, can I ask how do you block this location and how do you redirect to a network share? Is there a GPO?

 

Does this way swap out the default start menu?

 

(the start menu you get for example if you logged in as local user / admin? "Accessories", "Administrative Tools" etc)

 

Any guidance on or help with this would be amazing! - Having the same problems as FlowerManDan and your way intrigues me!

 

Thanks!

[3s-gtech]

The location is blocked with GP - User Configuration/Policies/Administrative Templates/Policy definitions (ADMX files)/Start Menu and Taskbar/Remove common program groups from Start Menu

 

Folder redirection is set under Policies/Windows Settings/Folder Redirection. Point the Start Menu setting at your UNC share, with the correct layout.

[james5150]

Thanks,

 

So the latter is just the same as Window 7 Redirects?

[FlowerManDan]

Thank you for that info, that has broke the back of the problem. I have now managed to get redirected start menus working in Windows 10 1709.

 

I do still have a problem relating to the Start Menu Tile Layout. I can export the .xml normal, it gets applied by GP normally but the layout isn't correct.

 

Please see the attached pictures, the Desired picture is what im exporting and the Current is what is being applied, any idea why this might be? Thanks again for your help on this.

 

Desired Result (what i am exporting)

 

Current Result (what gets applied via gp)

 

startlayoutv2.txtstartlayoutv2.txtstartlayoutv2.txt

Edited December 14, 2017 by FlowerManDan

[3s-gtech]

Sometimes you need to just play with the xml, which is what I did to fix mine. Save a copy first. The grid locations for each entry can be tweaked, then log on to see the results. You'll get there!

[FlowerManDan]

Managed to get mine working by using the below .xml string to define how big the actual start menu was and then playing around with the size of the tiles. Thanks again for your help and guidance, there were so many forums and videos out there regarding this topic but none of them made it clear. This one does!

 

[JATSO]

Hi All,

I have been trying to change the start menu layout as per this article:

https://blogs.technet.microsoft.com/deploymentguys/2016/03/07/windows-10-start-layout-customization/

 

I have followed it and my export looks like this:

 

 

After saving it to a share on the server and applying the GPO to users, the policy seems to apply but the layout is not changed as per the export but is restricted for changes by the user.

 

Am i missing some step.

I have removed the users profile from the server and the local machine checked the registry for remnants, but even with a clean profile the layout is the default user profile for the logged on user.

Edited December 18, 2017 by JATSO

[3s-gtech]

You're not running 10 Pro are you?

[JATSO]

You're not running 10 Pro are you?

 

No Win 10 Edu 1703