[1803, Spring Update] Cortana, applocker and that start menu

[Warwick_Tech]

Dear All,

 

We still have students on 1607 as this is the latest 'stable build' we have, but as I'm keen to push them to other versions MS seem to have cracked it with 1803 (My staff PC is broken after the upgrade, but fresh installs seem to work better)

 

But there's still one big bug, they have to open the start menu twice -

 

The first time it's all greyed out, the second time works fine with no issues (this is on every login)

 

I've discovered the culprit is Cortana (we've blocked her via applocker) as when she is unlocked the start menu opens first time; the kicker? Unlocking Cortana also unlocks the run commands and full access to system32 etc. by simply typing something in the start menu.

 

Has anyone solved the issue of Cortana blocking without this wired applocker start menu glitch?

 

I've contemplated locking everything Cortana can access (powershell, CMD, regedit etc.) but that's a long list for a simple bug.

 

Thoughts are welcome.

 

*Additional*

This bug does not happen on 1607 - 1703 was the first release to feature this glitch and each release subsequently

Edited May 8, 2018 by Warwick_Tech

[smarties11]

Surely if Cortana can access these programs then they are available through other routes too? I.e. student uploading a shortcut to cmd into their user area etc. Therefore it's not a cortana issue but a lockdown issue?

[Wubbalubbadub]

Surely if Cortana can access these programs then they are available through other routes too? I.e. student uploading a shortcut to cmd into their user area etc. Therefore it's not a cortana issue but a lockdown issue?

 

I’m with this.. cortana only shows students here what they have access too..

[Warwick_Tech]

Hi Both,

 

We have software restriction polices set for drives that apply to batch files, links, powershell scripts, exe's etc. so this covers most bases - those that don't are locked via file server resource manager.

 

We could go through and disable every .exe cortana can access on the local PC, but we're talking the entire system32 folder + more and I've found this can affect things like login/logoff scripts and office programs from running correctly.

 

Regards,

[jthompson]

We've encountered this and have tried a logon script for students that does a couple of Ctrl+Esc keystrokes to try and get through that initial error before the user first clicks on the Start menu. Not very reliable though, as the timing of the scripted keystrokes is a bit unpredictable, so doesn't always happen late/early enough.

 

I'm with you in that I'd rather limit the students' ability to invoke anything that looks like a CMD prompt, because I know that even if it's harmless, it'll generate tickets about students mucking around with systems.

[grahamd22]

So if we work on the basis of not locking Cortana through Applocker what is best practice to lockdown the computer missuse? Is there any simple way of doing this that you have found which we might be able to trial instead?

[jmak]

So if we work on the basis of not locking Cortana through Applocker what is best practice to lockdown the computer missuse? Is there any simple way of doing this that you have found which we might be able to trial instead?

Could be worth looking through the set of GPOs in this thread: https://www.edugeek.net/showthread.php?t=190996

 

From the responses, it seemed close to what a lot of people are doing...