Windows 11 Gpo settings and REG settings that might be useful

[Jaan]

I thought that maybe i had to add a custom start menu layout as documented here:

 

https://learn.microsoft.com/en-us/windows/configuration/start/layout?tabs=intune-10%2Cintune-11&pivots=windows-11

However it suggests that the pins defined in the file are always reapplied at login, removing any pins the user has applied;

 

User experience

After the settings are applied, sign in to the device. The Start layout that you configured is applied to the Start menu.

 

When you configure the Start layout with policy settings, you overwrite the entire layout. Users can change the order of the pinned elements, pin, or unpin items. When a user signs in again, the Start layout specified in the policy setting is reapplied, without retaining any user changes.

 

EDIT: think i'd be happy with this section just showing recently opened apps and docs..... but i can't seem to get that working also:

 

 

i'm at this point at the mo:

 

Edited October 16, 2024 by Jaan

[jthompson]

Okay, I think I've cracked the custom Start and Taskbar thing using Group Policy.

 

Ditching the XML method of configuring the taskbar, as this prevents users from modifying Start menu pins.

 

For the Start menu, I'm copying a reference start2.bin file into place in the user's profile. In GPO, that's "User Configuration -> Preferences -> Windows Settings -> Files". The reference start2.bin file is stored in a suitable network share and copied down to "%LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin".

Use Apply once and do not reapply to allow end-user changes to the Start menu pins to persist.

 

For the taskbar, export a reference setup from registry. From the reference user, export "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband". Using a text editor, edit the reg file to extract only the value of the "Favourites" item. Strip off the "hex:" from the front of it and remove all commas, slashes and line breaks.

In the GPO, in "User Configuration -> Preferences -> Windows Settings -> Registry" create the following:

Kay path: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband"

Value name: Favourites

Type: REG_BINARY

Value: (the value previously extracted from the reference taskbar setup)

Use Apply once and do not reapply to allow end-user changes to the taskbar to persist.

 

If any taskbar pins are missing icons, you'll also need to grab the relevent shortcuts from the reference user profile from "%userprofile%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar".

Use "User Configuration -> Preferences -> Windows Settings -> Files" to copy down reference shortcuts from a suitable network share to "%userprofile%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" (e.g. for a Chrome shortcut, we'd need to use "%userprofile%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk" as the destination file).

[Jaan]

I'm gonna needs a coffee and a day away from this before i even attempt to get my head around that!...... it shouldn't be this difficult.

[Olliedawg]

I'm gonna needs a coffee and a day away from this before i even attempt to get my head around that!...... it shouldn't be this difficult.

 

They want you to use Intune..

[jthompson]

They also want you to use Edge. Edge keeps pinning itself to student taskbars somehow. At this point I'm ready to give up, since at least Chrome is also being pinned to start and taskbar now.

[Jaan]

@jthompson Do you have a redirected start menu?

 

cheers

[jthompson]

@jthompson Do you have a redirected start menu?

 

cheers

 

No. Local profiles with no Start menu redirection.

[Jaan]

No. Local profiles with no Start menu redirection.

 

hmmm... i removed my start menu redirection, any pinning of the taskbar and allowed right click on the start menu....... i still can't right click the start menu...... even logged in as a local admin

[jthompson]

Have you checked for any other GPO options that might be being applied (Computer or User Config > Administative Templates > Start Menu and Taskbar)?

[Jaan]

Have you checked for any other GPO options that might be being applied (Computer or User Config > Administative Templates > Start Menu and Taskbar)?

 

Yeah, i must have a conflicting GPO somewhere

[jthompson]

I remember reading somewhere that changes don't take effect until after explorer has restarted, so if you're just trying after a gpupdate rather than after cycling your login, that might be it, too.

[Jaan]

I remember reading somewhere that changes don't take effect until after explorer has restarted, so if you're just trying after a gpupdate rather than after cycling your login, that might be it, too.

 

i've been deleting profiles to make sure. Something is testing me lol

[Shaun_Dark_Lord]

They also want you to use Edge. Edge keeps pinning itself to student taskbars somehow. At this point I'm ready to give up, since at least Chrome is also being pinned to start and taskbar now.

 

C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.89\Installer\setup --uninstall --force-uninstall --system-level

 

[jthompson]

Quite happy to have Edge on the system still (in fact we need it for a couple of legacy IE mode things) but it'd be nice if it just knew it's place a bit more.

 

All glory to the Hypnotoad!

[GeneMoody-Action1]

Just in case people did not know these are out there.

https://www.microsoft.com/en-us/download/details.aspx?id=106255

And https://admx.help/

 

Both great resources for better understanding all the minute configuration points in windows.

[Sephiroth]

C:\Program Files (x86)\Microsoft\Edge\Application\129.0.2792.89\Installer\setup --uninstall --force-uninstall --system-level

 

[ATTACH=CONFIG]72426[/ATTACH]

 

As I'm now looking at various options for our W11 builds, have you seen any quirks or issues in removing Edge? does it have to be updated for each edge version?

[thimon]

What’s everyone got against Edge? I’ve made it our school default browser, meets all of our needs.

[3s-gtech]

Nowt. It’s our default and I don’t install Chrome.

[Tefters]

Nowt. It’s our default and I don’t install Chrome.

This ^^^

[LeMarchand]

Wish I could get rid of Chrome*, but "it's faster".

 

*Nothing wrong with Chrome; just don't see the need for it.

[Sephiroth]

What’s everyone got against Edge? I’ve made it our school default browser, meets all of our needs.

 

We're a google school. A lot of issues stem from people trying to sign into google services in edge and wondering why they have to authenticate so many times for everything. Also, as others have said, a single browser is cleaner.

[Sephiroth]

Wish I could get rid of Chrome*, but "it's faster".

 

*Nothing wrong with Chrome; just don't see the need for it.

 

I'd actually argue the opposite these days... but google's marketing department are very efficient.

[J-14P]

Not sure if anyone else has to do this but we're testing disabling the Snipping Tool autosave feature (Mostly due to worries of it potentially autosaving confidential data into their redirected home area). Currently overwriting settings.dat in "%LOCALAPPDATA%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings" using a GPO, if anyone knows of a more "official" way that would be good .