Windows 10 Start Menu Management 1803

[Tech13]

Hi all,

 

Can anybody please share their experiences with Windows 10 Start Menu management on Windows 10 Education 1803.

 

We have configured the 'Start Layout' but having issues managing the visibility of Apps and items such as 'Administrative Tools' & 'Windows System' for limited users i.e. pupils.

 

Can this be configured through GP? Does it have to be done pre image?

 

Looking forward to your responses?

 

Kind regards,

Tech13

[BOOT]

Random, inconsistent and unfinished are how I would describe mine.

[Oaktech]

The old-school way of doing it is to use GP to change permissions on the folders in the default profile... I've got a couple of machines with 1803 where I've moved from redirected start menu to a vanilla start menu because the startmenu redirection was adding too much time to the logon. Those machines seem to be respecting those settings... Your mileage may vary but I'm using a custom start screen XML, a vanilla start menu and those folder property customisations and it seems pretty good. I remove all the unwanted apps at build time with a script.

[Tech13]

Hi,

 

Thanks for this.

 

What script did you use to remove the Apps? Any chance of a copy?

 

Did this remove for all users or did it have to be run per user?

[Oaktech]

Hi,

 

Thanks for this.

 

What script did you use to remove the Apps? Any chance of a copy?

 

Did this remove for all users or did it have to be run per user?

 

Two scripts and a PS module. I run it at build time as part of an SCCM task sequence and then as a startup task applied by GPO to ensure nothing sneaks back in as an update.

 

https://1drv.ms/f/s!AkzDYVebVuvGihkIK_hV9P7djXmj

 

You need to put them somewhere accessible - I stick them in netlogon because I'm lazy. Then you need to decide which apps you want to remove, I remove pretty much everything except photos and store, although I GPO block access to the store for pupils. The second script removes edge and a few other stubborn things, you can remove cortana with it too, but removing cortana breaks the ability to search from the start menu. You need to edit the second script to tell it where to find the PSM1 take-own module.

[Tech13]

Thanks for this. Looks really useful. I have some time this PM to look into this.

[Tech13]

Just had a look at this and it has removed the Apps perfect! Thank you.

 

One last question, we are still having trouble removing access for Administrative Tools. Any pointers?

 

We have run the script then created a new user. They are still visible.

 

Thanks again it's been really helpful.

 

[Oaktech]

Just had a look at this and it has removed the Apps perfect! Thank you.

 

One last question, we are still having trouble removing access for Administrative Tools. Any pointers?

 

We have run the script then created a new user. They are still visible.

 

Thanks again it's been really helpful.

 

Yeah, admin tools is a folder not an app. I'm dealing with those by creating a permissions GPO (Computer Configuration\Policies\Windows Settings\Security Settings\File System) that changes the permissions on.

 

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell

%SystemRoot%\System32\control.exe

%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe

 

 

to the following:

 

Allow APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Read and Execute This folder, subfolders and files 
Allow NT AUTHORITY\SYSTEM Full Control This folder, subfolders and files 
Allow BUILTIN\Administrators Full Control This folder, subfolders and files

 

and disables inheritance from parent.

 

This removes the 'everyone - read' capability and with that removed in our testing it doesn't create the folders in the new user.

 

The stuff above bans everyone except admin users from accessing control panel. If you need to allow access to control panel items, except certain items, then you might want to see if the option below helps you...

 

https://www.maketecheasier.com/restrict-administrative-tools-access-windows/

Edited May 22, 2018 by Oaktech