Start Menu Redirection and Roaming Profiles

[deKay]

OK, it's time to ask...

 

How the heck do you get this to work? I've done it "the old way" (set a folder redirect GPO). I've followed every guide I can find. I've created brand new users, brand new machines, just one single setting on a single policy. I've checked permissions. Tried giving my user admin rights and full control even. Upgraded to 1709 because "that fixes the issue" (which somewhere also says 1607 did too - it didn't). Eventvwr says the policy has applied. GP results say it has applied. The damn registry has the right settings too!

 

It. Doesn't. Work.

 

What I want, is a start menu that picks up shortcuts from a network share. That's all. Same as on XP and 7. I don't care about the tile layouts (they can go, actually), and can probably sort getting rid of the useless built-in apps. Instead, I have something that works, then the user logs off and back on (the same machine!) and variously ALL the shortcuts are gone, or they're reset back to the defaults. Then sometimes when I log back on, they're back and correct. And sometimes they're not. It's maddening.

 

I've read up a lot and the consensus seems to be: don't bother. Stick all the shortcuts on the desktop or don't use roaming profiles or something. But surely someone must have this working?

[BOOT]

It doesn't work. I gave up in the end.

Deployed all shortcuts to a local folder, and set a tool that runs on user logon to pin whatever shortcuts I've put in the 'Pinned Shortcuts' folder to the menu. Way more reliable.

[KevinB]

We never got roaming profiles working satisfactorily in either 1511 (shudder) or 1607 so we gave up and opted for UEV instead, which seems to be working really well with the usual start redirection to a share.

[yac2016]

This does work, the windows 7 redirection works fine on Windows 10, only issue the folders are in alphabetical order. We have used the new 10 layout for taskbar and a start menu for just Office.

[deKay]

This does work, the windows 7 redirection works fine on Windows 10, only issue the folders are in alphabetical order. We have used the new 10 layout for taskbar and a start menu for just Office.

 

OK, thanks for the confirmation... but how did you do it?

[smarties11]

OK, thanks for the confirmation... but how did you do it?

 

I realise you may have this fixed now but I also had the same issue as you on 1709. To get it working, do the following

 

• Ensure that you are redirecting AppData too
  
• Create a new decimal DWORD registry key called SpecialRoamingOverrideAllowed at HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer and set it to 1
  

 

Your redirected menu should now appear at every logon without an issues - at least it does for us.

 

Now just trying to get the start layout xml working - apparently not officially supported with roaming profiles but we shall see.

[Guest Guest]

I’d be looking to scrap the roaming profiles if using Windows 10 as their soon to be ditched by Microsoft

[flyinghaggis]

I'm still trying to work out how best to setup profiles for our Windows 10 deployment. Given roaming profiles are being deprecated that leaves us with the option of either Mandatory or Local profiles. I'm wondering whether it might be better in the long run to just go with local profiles combined with redirected appdata and start menus plus maybe a few scripts/registry edits to configure things where necessary. I'm thinking this might be the most flexible way forward.

 

Things seem to be working OK generally with local profiles though the first login is kind of slow and there are a few apps which don't redirect appdata cleanly meaning setup becomes a per machine thing. The redirected start menu works fine though it seems combine shortcuts from the local machine with the redirected shortcuts which is kind of annoying and leaves the menu a bit cluttered with duplicate shortcuts. I could probably run some kind of script to clean these issues up though.

 

We've always used roaming profiles since going to Windows XP and 7 so I don't have any experience setting up mandatory profiles so it could just be that I'm fearing the unknown.

 

Has anyone tried using local profiles on a school Windows 10 network or is Mandatory the better option?

[smarties11]

I'm also in the process of testing local profiles for staff with Win10 and everything is positive so far. I think lots of schools have moved in this direction already.

 

For your user settings, check out U-EV (User Environment Virtualisation) which is built in to Win10 clients. It packages user settings up and saves them in a network share, so that their personal settings roam with them. It comes with templates already for Windows, Office etc but you can create templates for any application and capture the settings. I've not actually tested it here yet, but will be doing so next week. My understanding is that this should negate the need to redirect appdata too.

 

If you don't want to combine the redirected with local start menu, enable the group policy option 'Remove common program groups from Start Menu' at 'User Configuration/Policies/Administrative Templates/Start Menu and Taskbar'. This will hide all start menu items in the all users profile, effectively showing only your redirected menus plus any installed UWP apps. That's what I have done here and it works well. For machines that have ad-hoc software installed that isn't installed site wide, you just need to ensure you have a shortcut in the public desktop folder so your users can access.

 

For our pupils I'm currently testing having them as guest users (by adding pupil user group to 'guest users' group on the local machine - can be done by GPO) - as this just gives them a temporary profile which is deleted on logoff. Haven't come across any issues yet, except for OneDrive which fails to open saying it can't be used with guest accounts. We don't use it here though (yet, anyway). The other option is mandatory profiles but my understanding is that these don't work well with start layout xmls, in the same way that roaming ones don't. Failing that pupils will have to have local profiles too, but then that becomes another thing to manage with something like delprof2.

 

Just going through all of this here now in my Win10 testing so hope this helps.

[jmak]

 

For our pupils I'm currently testing having them as guest users (by adding pupil user group to 'guest users' group on the local machine - can be done by GPO) - as this just gives them a temporary profile which is deleted on logoff. Haven't come across any issues yet, except for OneDrive which fails to open saying it can't be used with guest accounts. We don't use it here though (yet, anyway).

 

Just going through all of this here now in my Win10 testing so hope this helps.

 

Lots of useful information - thanks. What are login times like for pupils logging in as "guests"? I'm looking at that, but concerned every login will be a first login, so too slow.

[flyinghaggis]

 

For your user settings, check out U-EV (User Environment Virtualisation) which is built in to Win10 clients. It packages user settings up and saves them in a network share, so that their personal settings roam with them. It comes with templates already for Windows, Office etc but you can create templates for any application and capture the settings. I've not actually tested it here yet, but will be doing so next week. My understanding is that this should negate the need to redirect appdata too.

 

If you don't want to combine the redirected with local start menu, enable the group policy option 'Remove common program groups from Start Menu' at 'User Configuration/Policies/Administrative Templates/Start Menu and Taskbar'. This will hide all start menu items in the all users profile, effectively showing only your redirected menus plus any installed UWP apps. That's what I have done here and it works well. For machines that have ad-hoc software installed that isn't installed site wide, you just need to ensure you have a shortcut in the public desktop folder so your users can access.

 

For our pupils I'm currently testing having them as guest users (by adding pupil user group to 'guest users' group on the local machine - can be done by GPO) - as this just gives them a temporary profile which is deleted on logoff. Haven't come across any issues yet, except for OneDrive which fails to open saying it can't be used with guest accounts. We don't use it here though (yet, anyway). The other option is mandatory profiles but my understanding is that these don't work well with start layout xmls, in the same way that roaming ones don't. Failing that pupils will have to have local profiles too, but then that becomes another thing to manage with something like delprof2.

 

Just going through all of this here now in my Win10 testing so hope this helps.

 

Good to know the start menu problem can be solved with something as simple as a GPO setting! I'll check out U-EV as well.

 

That's an interesting idea using the guest group for pupils. That was a concern about local profiles in that I worry we'll encounter an issue and will need to run a script to get rid of them in bulk at some point so it would be useful to have that covered. I'd kind of hoped using something like Delpfof could be made a thing of the past when moving to Windows 10 but it doesn't look like there's any other option unfortunately when managing profiles.

 

Thanks for the advice. I'll post any useful information I find when testing it here so it'll hopefully be of some assistance to others

Edited April 13, 2018 by flyinghaggis

[smarties11]

Lots of useful information - thanks. What are login times like for pupils logging in as "guests"? I'm looking at that, but concerned every login will be a first login, so too slow.

 

Login times currently sub 30 seconds, but still have a few group policies to configure and applocker to set up so may increase a little. Staff with local profiles are the same for first login but much quicker on subsequent logins. I'm wondering if there is another way to force temporary profiles without being a member of guests - that would solve the one drive issue which we may use in the future.

[smarties11]

That's an interesting idea using the guest group for pupils. That was a concern about local profiles in that I worry we'll encounter an issue and will need to run a script to get rid of them in bulk at some point so it would be useful to have that covered. I'd kind of hoped using something like Delpfof could be made a thing of the past when moving to Windows 10 but it doesn't look like there's any other option unfortunately when managing profiles.

 

Yeah, same here, don't like the idea of profiles accumulating. There is a GPO setting to clear profiles older than x days but from what I've read it's not reliable. Delprof2 is a bit too Heath Robinson for me, better to fix the issue at source. Mandatory profiles would be the ideal I guess but i can't find a definitive answer about long term support of those in Win10? And I think they suffer with the same issue as roaming profiles in terms of start layout XML not reliably applying?

[Arthur]

I'm wondering if there is another way to force temporary profiles without being a member of guests - that would solve the one drive issue which we may use in the future.

Change the profile state registry value on logoff? With the method described below users could logon with a local profile but when it comes time to logoff, Windows thinks they have a guest or temporary profile.

 

https://www.htguk.com/profile-state-emulation

 

The Registry key we are interested in is at HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\SID (where SID equals the user SID) and is a DWORD value called State. It has various different hex settings, summarized below

 

[b]Hex Mask   Description[/b]
0001       Profile is mandatory.
0002       Update the locally cached profile.
0004       New local profile.
0008       New central profile.
0010       Update the central profile.
0020       Delete the cached profile.
0040       Upgrade the profile.
0080       [color="#FF0000"]Using Guest user profile[/color].
0100       Using Administrator profile.
0200       Default net profile is available and ready.
0400       Slow network link identified.
0800       [color="#FF0000"]Temporary profile loaded[/color].

 

Now to set them you’ll need to convert the hex value to decimal (a quick use of calc.exe or even regedit.exe can help you with this, if you can’t do it in your head), so for the script we are using we’ve gone for 128 (which gives us Guest) but you could equally use 1 for Mandatory. However, I’ve never had any issues with Guest so I guess I’ve just stuck to what I trust to work

 

Btw, have you come across any issues with users in the guest group connecting to network shares?

 

Guest access in SMB2 disabled by default in Windows 10 Fall Creators Update and Windows Server v1709

Edited April 13, 2018 by Arthur

[smarties11]

Change the profile state registry value on logoff? With the method described below users could logon with a local profile, but when it comes time to logoff Windows thinks they have a guest profile.

 

https://www.htguk.com/profile-state-emulation

 

 

 

Btw, have you come across any issues with users in the guest group connecting to network shares?

 

Guest access in SMB2 disabled by default in Windows 10 Fall Creators Update and Windows Server v1709

 

That's interesting - will try that on Monday - thanks!

 

No issues with accessing remote shares - however our servers are 2008R2 and I've not disabled SMBv1 so perhaps it is falling back to that during handshake. Reading the article though I wonder if this applies to the actual guest account, that is disabled by default - rather than accounts that are part of the guest group? Win10 guest group description implies they have identical rights to normal users (but the disabled guest account itself has further restrictions applied). Will have to investigate in a bit more detail, as if accounts belonging to the guest group cannot support encryption then this is a non starter. Being able to force a temporary profile without belonging to the guests group is s cleaner solution, I feel!

[Patrick]

I have Windows 10 1709 with Server 2016 and my pupil (local) accounts are members of guests and have no issues with mapped drives or network shares that I've noticed yet. I did have an issue where new local accounts at logon were not creating the my docs folder server side, any idea what this could be? Recreating the account seems to fix it. Seems to be a bit random as it doesn't always happen.

[smarties11]

I have Windows 10 1709 with Server 2016 and my pupil (local) accounts are members of guests and have no issues with mapped drives or network shares that I've noticed yet. I did have an issue where new local accounts at logon were not creating the my docs folder server side, any idea what this could be? Recreating the account seems to fix it. Seems to be a bit random as it doesn't always happen.

 

That's very interesting, thanks for confirming. I suspect that the article linked is talking about the actual guest account (which is disabled by default) rather than accounts that are members of the guest group. Out of interest, how are you getting on with your student accounts being member of guests? I'd be interested to hear your feedback as it certainly appears to work OK in my limited testing, but we've not rolled Win10 out yet.

 

Not sure about your my docs issue. We redirect directly into the user area i.e. \\server\usershare$\%USERNAME% rather than \\server\usershare$\%USERNAME%\Documents, so the folder is created automatically when the user account is created anyway. The new 'microsoft way' is to redirect into %USERNAME%\Documents but as we've had ours setup the way it is since XP, I've not bothered to change it. The only issue we get is the user folders all showing up as 'Documents' when browsing the user share, but that's an easy fix and easier than restructuring the user areas. Perhaps we'll change it the next time we build the user file server.

[flyinghaggis]

If you don't want to combine the redirected with local start menu, enable the group policy option 'Remove common program groups from Start Menu' at 'User Configuration/Policies/Administrative Templates/Start Menu and Taskbar'. This will hide all start menu items in the all users profile, effectively showing only your redirected menus plus any installed UWP apps. That's what I have done here and it works well. For machines that have ad-hoc software installed that isn't installed site wide, you just need to ensure you have a shortcut in the public desktop folder so your users can access.

 

I've tried enabling that GPO setting for "Remove common program groups from Start Menu" but all the crud from the all users areas still seems to be appearing combined with our redirected start menus?

 

Also, the default UWP apps like "Windows Store", "Groove Music", "Cortana", etc are still appearing listed even though there's no Start Menu shortcuts for them in the all users folders. Does this have to be removed elsewhere or literally uninstalled to get rid of it?

 

I've also been experimenting with custom StartMenu.xls tile layouts but this doesn't seem to affect the redirected start menu.

Edited April 18, 2018 by flyinghaggis

[smarties11]

I've tried enabling that GPO setting for "Remove common program groups from Start Menu" but all the crud from the all users areas still seems to be appearing combined with our redirected start menus?

 

Also, the default UWP apps like "Windows Store", "Groove Music", "Cortana", etc are still appearing listed even though there's no Start Menu shortcuts for them in the all users folders. Does this have to be removed elsewhere or literally uninstalled to get rid of it?

 

I've also been experimenting with custom StartMenu.xls tile layouts but this doesn't seem to affect the redirected start menu.

 

Hi,

 

That's odd. Enabling the remove common program groups works for us. Are you on 1709? Can you verify the setting on the client with gpresult?

 

The UWP apps need uninstalling, as they don't have shortcuts in the traditional sense.

 

The start menu xml layouts won't affect the redirected start menu itself. They are for controlling the pinned icons that show on the right hand side of the start menu. The shortcuts already have to reside in your redirected start menu, and you reference the shortcut that is in that redirected menu. Here's my example (not finished yet as still in our testing phase but you get the idea)

 

Edited April 18, 2018 by smarties11

[flyinghaggis]

Odd, I've checked the GPResult and remove common program groups is definitely enabled for the account so I'm not sure why they're still appearing?

 

I've seen a few threads on here about scripting uninstalling the UWP apps so I'll check it out.

 

That's useful to know you can actually point the start menu shortcuts at the redirected start menu. I'd initially tried running the "export-startlayout –path .xml" powershell command on an account with the redirected start menu but it always seemed to generate an error so I'd assumed the links had to reside locally on the computer. That's far more flexible if they can be network shortcuts on a UNC path.

Edited April 18, 2018 by flyinghaggis

[smarties11]

Very odd. I've only got one demo machine set up at the moment, so will be interesting to see what happens when we roll out to further machines, to see if the setting "sticks".

 

Yeah, I also ran intro trouble exporting the layout for a user. Think it might be a bug in 1709. I found a patch for it but it made no difference for me. In the end I just exported the default administrator layout (which worked) and edited manually. It's fairly easy once you understand how the positioning and size parameters work.

 

Little tip - if you create pinned tiles to websites (like we have with parentmail for example), you don't point the tile to the .url file - that doesn't work. You make the .url file in the redirected start menu, choosing the icon you want etc. And then in the layout file, use the DesktopApplicationID parameter instead of DesktopApplicationLinkPath, specifying the URL exactly as you typed it in the .url shortcut. As long as the URL is the same in the layout file as it is in the .url shortcut, the pinned tile then uses the description and the icon from the .url file.

[Patrick]

That's very interesting, thanks for confirming. I suspect that the article linked is talking about the actual guest account (which is disabled by default) rather than accounts that are members of the guest group. Out of interest, how are you getting on with your student accounts being member of guests? I'd be interested to hear your feedback as it certainly appears to work OK in my limited testing, but we've not rolled Win10 out yet.

 

Not sure about your my docs issue. We redirect directly into the user area i.e. \\server\usershare$\%USERNAME% rather than \\server\usershare$\%USERNAME%\Documents, so the folder is created automatically when the user account is created anyway. The new 'microsoft way' is to redirect into %USERNAME%\Documents but as we've had ours setup the way it is since XP, I've not bothered to change it. The only issue we get is the user folders all showing up as 'Documents' when browsing the user share, but that's an easy fix and easier than restructuring the user areas. Perhaps we'll change it the next time we build the user file server.

 

Still in testing so far. But i've had no issues with Guests group. Seems to work well!

[smarties11]

Still in testing so far. But i've had no issues with Guests group. Seems to work well!

 

That's great to hear! I've had no issues either yet....fingers crossed. Of course this will all change in the coming days when 1803 is released!