[1903, au] Help Working Out Start Menu Configuration?

[JRA]

Hello everybody,

 

Working on the start menu config for students specifically and it doesn't look too friendly...

 

In short, I don't know a "universal" student start menu will be favourite across the network as some suites and PCs have software some other suites don't, so I don't want to have a single set start menu that might be showing programs a PC might not have. I'm thinking maybe set group policies somewhere to just remove things I don't want from student start menus. The list of these would be:

 

Feedback Hub

Films and TV

Game Bar

Groove Music

Mail

Maps

Messaging

Microsoft Store

Mixed Reality Portal

Mobile Plans

People

Skype

Settings (or severely restrict)

Windows accessories - Print 3D, Quick Assist, Remote Desktop, Windows Admin Tools and System subfolders

Xbox

Your Phone

 

Is anyone else managing their start menus to achieve/disable the same? Indeed, can anyone think of any better ways to try and do what I'm doing?

 

Thanks all for having a read.

[DJ-1701]

At our Secondary, we deploy shortcuts to a path on the PC and as part of the script hide items that are not installed.

https://github.com/DJ-1701/ShortcutDeploy

 

Although @Arcolite has a different method which you also might be interested in, he deploys out shortcuts via Group Policy Preference for the user based on if the target file exists.

[DJ-1701]

As I notice some of the items you have mentioned are Windows apps, some of us use Applocker (which I believe is a product that only works with Education and Enterprise version of Windows 10). Others use a script to remove all the programs they don't want installed, but that affects all new users that logon after the running of the script.

 

This is an example of a script I use after the build process to remove the Windows Apps I don't want others using.

 

# Remove Useless Apps.
Get-ProvisionedAppxPackage -online `
   | where-object {$_.DisplayName -like "*alarms*" `
       -or $_.DisplayName -like "*communications*" `
       -or $_.DisplayName -like "*feedback*" `
       -or $_.DisplayName -like "*gethelp*" `
       -or $_.DisplayName -like "*office*" `
       -or $_.DisplayName -like "*messaging*" `
       -or $_.DisplayName -like "*mixedreality*" `
       -or $_.DisplayName -like "*started*" `
       -or $_.DisplayName -like "*solitaire*" `
       -or $_.DisplayName -like "*onecon*" `
       -or $_.DisplayName -like "*people*" `
       -or $_.DisplayName -like "*skype*" `
       -or $_.DisplayName -like "*xbox*" `
       -or $_.DisplayName -like "*yourphone*" `
       -or $_.DisplayName -like "*zune*"} `
   | Remove-ProvisionedAppxPackage -online

[CHiLL]

I've encountered issues where removing built-in apps has lead to system instability or issues with other built-in apps. I just decided to leave them in the OS and use AppLocker to deny access to them because it saved so much time. Sure, it doesn't look great but it still prevents the users from accessing the apps. I used to remove built-in apps using Powershell scripts during OSD deployment but I encountered issues with either broken/unstable apps because a dependency was removed and they'd come back with an in-place feature upgrade. This was most noticeable with the Store app and I wanted to deploy an AppX package site-wide. I couldn't because a Store app dependency was missing and it cannot be added again once removed and I ended up having to re-image the machines. Now I just just compare the AppX packages on the old and new versions of Windows and add additional apps to AppLocker.

[DJ-1701]

Settings (or severely restrict)

 

With regard to Settings...

https://www.thewindowsclub.com/configure-windows-10-settings-visibility-hide-select-settings

[JRA]

Well thanks both enormously for those! AppLocker looked especially good, although it doesn't seem to be applying anything to PCs when tested. I have W10 Pro Education, so lord knows if they've seen fit to apply it to that version or not.

 

Cheers muchly though, will keep trying with it.

[JRA]

Okay, so it looks like you can run AppLocker on Education editions on W10, but not Pro Education editions.

 

What on EARTH Microsoft??

 

Reeling from that one as I am, is my only real solution to find the executable names and block them old-school as with: https://www.sevenforums.com/tutorials/80605-applications-prevent-running-specified-programs.html ?

 

Also thanks again @DJ-1701 that settings thing worked lovely.

[DJ-1701]

Okay, so it looks like you can run AppLocker on Education editions on W10, but not Pro Education editions.

 

What on EARTH Microsoft??

 

Reeling from that one as I am, is my only real solution to find the executable names and block them old-school as with: https://www.sevenforums.com/tutorials/80605-applications-prevent-running-specified-programs.html ?

 

Also thanks again @DJ-1701 that settings thing worked lovely.

 

Yeah, if you can find it out the programs name, some I am not sure if they are even are exes any more. I know @mavhc has been working with Windows 10 Professional, maybe he can share a few ideas?

 

I am rather surprised and annoyed that Microsoft have shifted a lot of items over to the Enterprise level OSes only, doesn't help smaller places. Personally I have only ever had an issue with removing the Windows Store app, as sometimes other apps may wish to use this to repair a broken app.

[howartp]

Okay, so it looks like you can run AppLocker on Education editions on W10, but not Pro Education editions.

 

What on EARTH Microsoft??

You can change OS by just sending new license key via VAMT.

 

We had to do it last week for similar reasons.

 

Peter

[DJ-1701]

You can change OS by just sending new license key via VAMT.

 

We had to do it last week for similar reasons.

 

Peter

 

Certainly would recommend for the features if the licenses are available.

 

VAMT? ADBA surely.

[JRA]

VAMT and ADBA sound like magic words from the start of a spell not things I routinely use! Hehe.

 

Thanks hugely you two, I'll have a google around those things and start shipping out new product keys.

 

Innovation is lovely indeed. But Microsoft leaving things alone would be so much lovelier. My brain hurts...

[howartp]

VAMT? ADBA surely.

Definitely ABDA, but you need VAMT to inject the new license key don't you?

 

Or could/should i somehow remove the Pro key from AD and add the Edu key, which somehow causes the PC to reactivate itself as Edu?

 

Peter

[DJ-1701]

VAMT and ADBA sound like magic words from the start of a spell not things I routinely use! Hehe.

 

Thanks hugely you two, I'll have a google around those things and start shipping out new product keys.

 

Innovation is lovely indeed. But Microsoft leaving things alone would be so much lovelier. My brain hurts...

 

Ah, just a quick heads up then VAMT, Volume Activation Management Tool and ADBA, Active Directory-Based Activation. Publishing a product key to ADBA means that if a machine is on the domain it will get that product key, which I find is simpler, but that's me.

[DJ-1701]

Definitely ABDA, but you need VAMT to inject the new license key don't you?

 

Or could/should i somehow remove the Pro key from AD and add the Edu key, which somehow causes the PC to reactivate itself as Edu?

 

Peter

 

In theory that *should* work, since it would be distributing the key in Active Directory to the devices. Last I remember you needed to install a server feature, it could have been VAMT, but I always thought that was a separate tool. I blame too many years and different product key versions.

[JRA]

Might just be that I have a go at ADBA.

 

Can you do the key swap by OU? I have wariness about pushing this out domain-wide and then suddenly all my servers run W10 now and everything's broke...

[DJ-1701]

IIRC, with the VAMT you should be able to push the product key out to selected remote computers if you need or wish to.

 

Adding the product key to ADBA it will be identified as a Windows 10 license, the device will be sensible and if it's not a Windows 10 device it will not be converted to one, so no sudden 'Why is my Server running Windows 10' for you to worry about.

[mavhc]

SRP is the Pro version of AppLocker, works well here

[JRA]

You're all gents thanks so much for all this help with it.

 

Right, ADBA will be Plan B for now. SRP I'm keen on tinkering with, just playing atm and blocked ALL .exes which I'll admit is monster secure, but needs a bit more of a tinker.

@mavhc have you managed to block eg the Xbox thingmy and the MS Store with it? Or have you used something else for those?

 

Could probably figure it all out but it's the specific exe and the non-exe apps parts I'm not quite at yet. I'll carry on but if you reply before I figure those bits out I'll enjoy reading.

 

I'll owe you all beer next BETT or something.

[JRA]

Dug this out. Heavenly https://community.spiceworks.com/topic/2010771-windows-10-bloat-apps

 

Thanks again everybody and happy Friday!

[JRA]

@mavhc Thanks for this - I'm not having a lot of luck with it just yet. I've allowed .exes globally for starters in SRP. Otherwise ofc it blocks the world from working. Have you done it this way or gone with whitelist?

 

Second of all I'm trying things out with the messenger app first of all but gotten nowhere. I've put in a path-based rule to restrict %programfiles%\WindowsApps\Microsoft.Messaging* but still getting the messaging thingy as test student.

 

Any ideas where I'm going wrong? Thanks hugely if you're able to steer me right.

[CHiLL]

@mavhc Thanks for this - I'm not having a lot of luck with it just yet. I've allowed .exes globally for starters in SRP. Otherwise ofc it blocks the world from working. Have you done it this way or gone with whitelist?

 

Second of all I'm trying things out with the messenger app first of all but gotten nowhere. I've put in a path-based rule to restrict %programfiles%\WindowsApps\Microsoft.Messaging* but still getting the messaging thingy as test student.

 

Any ideas where I'm going wrong? Thanks hugely if you're able to steer me right.

If you're looking to block Windows Apps from running, use AppLocker. It won't remove them from the Start Menu, but it'll stop users opening them by displaying an access denied message.

Edited August 25, 2020 by CHiLL

[JRA]

Thanks CHiLL - I would do but got W10 Pro Education, which doesn't use it. Honestly I am too chicken to try VAMT and ADBA at this stage I can just see that going completely wrong in my mind...

 

Other alternative is rebuild the base image and redeploy but that'd take time ofc.

 

If it's at all possible to achieve through SRP I'd love to. And a big middle finger to Microsoft stripping that out of Pro too. Heaven's sake...

[CHiLL]

Thanks CHiLL - I would do but got W10 Pro Education, which doesn't use it. Honestly I am too chicken to try VAMT and ADBA at this stage I can just see that going completely wrong in my mind...

 

Other alternative is rebuild the base image and redeploy but that'd take time ofc.

 

If it's at all possible to achieve through SRP I'd love to. And a big middle finger to Microsoft stripping that out of Pro too. Heaven's sake...

Ohh, I didn't realise there were two Education skews of Windows 10, based on Pro and Enterprise. That makes sense then. In that case, can you not just use SRA to block the exe name as a wildcard? Or have a block all and operate a whitelist for allowed Windows apps?

 

As for VAMT/ADBA. I had originally been using VAMT and migrated to ADBA a couple of years ago. It's a fairly straightforward process and clients just activate themselves for both Windows and Office Professional Plus (but not ProPlus as that's subscription/O365 licensing based).

[JRA]

Ohh, I didn't realise there were two Education skews of Windows 10, based on Pro and Enterprise. That makes sense then. In that case, can you not just use SRA to block the exe name as a wildcard? Or have a block all and operate a whitelist for allowed Windows apps?

 

As for VAMT/ADBA. I had originally been using VAMT and migrated to ADBA a couple of years ago. It's a fairly straightforward process and clients just activate themselves for both Windows and Office Professional Plus (but not ProPlus as that's subscription/O365 licensing based).

 

Ta CHill. I would do for sure, but it seems like in SRP you can do everything bar that specific thing. There are also two "versions" of eg Microsoft.Messenger in the apps folder itself, implying maybe that a further update might bring in yet another one and stop my restrictions, so in my "tryout" one above I've put in the wildcard path to try and cover each "version" by folder but it still runs for the kids.

 

If you've got a way of blocking a particular .exe by name running globally then I'll happily steal that idea off you! Hehehe.

[simpsonj]

I've put in a GPO to disable Windows Store Apps from 'installing' for new users on all student PCs. Haven't tested it in anger yet, put my testing is proving hopeful, and it definitely removes the apps from the start menu!

 

Computer Config - Admin Templates - Windows Components - Store - Disable all apps from Microsoft Store - Disabled*

 

*The wording on this is a classic Microsoft double negative, by disabling you are, in fact, disabling them from being installed.

 

One word of warning, do not set this GPO on PCs as they are being built, as it will kick the machine into a reboot cycle and won't build. I build my machine into one ou, then move it into the classroom ous that have this GPO applied.

 

- - - Updated - - -

 

Oh, and it does mean tha Edge isn't available for students. YMMV as to whether this a good or bad thing! In it's place, I've left Internet Explorer and install Chrome.