Start Menu customisation causing Access Denied errors

[KK20]

An odd one. We have used our start menu customisation as long as I can remember. Ive even contributed the the giant thread on the subject with our working XML. However, this all stopped this week and I have no idea why. Nothing has changed on our end but I do have a fix.

 

This is the current working bare bones XML we use:

 

 

Pretty simple and has worked for years. Since the middle of this week though, if a user tries to log on with this layout, then they lose access to the start button (doesnt work at all) and the event log shows:

 

StartMenuExperienceHost (8600,R,98) TILEREPOSITORYS-1-5-21-2426946757-487645087-819906884-12318: An attempt to open the file "C:\Users\\AppData\Local\TileDataLayer\Database\EDB.chk" for read / write access failed with system error 5 (0x00000005): "Access is denied. ". The open file operation will fail with error -1032 (0xfffffbf8).

 

StartMenuExperienceHost (8600,R,98) TILEREPOSITORYS-1-5-21-2426946757-487645087-819906884-12318: An attempt to open the file "C:\Users\\AppData\Local\TileDataLayer\Database\EDB.log" for read / write access failed with system error 5 (0x00000005): "Access is denied. ". The open file operation will fail with error -1032 (0xfffffbf8).

 

StartMenuExperienceHost (8600,P,98) TILEREPOSITORYS-1-5-21-2426946757-487645087-819906884-12318: An attempt to open the device with name "\\.\C:" containing "C:" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).

 

After a lot of wrangling, checking GPO, checking permissions, killing profiles, recreating start menu customisation I narrowed it down to the setting LayoutCustomizationRestrictionType="OnlySpecifiedGroups" , if I remove that line then all is well but users can no longer pin their own customisations to their start menus. Machines are 1909, ADMX is 1909, local policies up to date. The GPO actually copies this XML on bootup to a local folder and the GPO uses the local copy (stops the server copy being locked for editing) so I can change this really easily. It is reproduce-able on all our machines.

 

Has anyone else had similar issues? Any idea on how to get LayoutCustomizationRestrictionType="OnlySpecifiedGroups" working again?

Edited February 28, 2020 by KK20