Windows 11 Gotchas?

[Disease]

Hi all, moving to Windows 11 24H2  this summer from Windows 10, anyone care to share any gotchas I need to plan for, especially when it comes to Group Policy. Are there any quirks I need to plan for or set or will most of my current GPO settings still be applicable in Win 11.

 

Thanks in Advance.

[mavhc]

I had to add a load of exceptions to the proxy for onedrive to work, but I guess that's fixed now as it worked when we changed M365 tenants

[mavhc]

Most of the problems with 24H2 seem to be driver related, so plan on moving to IPP based printing with Printer Support Apps automatically installing, also eliminates entire classes of security holes as well as entire classes of BSOD

[itskdog]

Following for my own info. Have used it at home, but 24H2 only came through for me in May, and still kept failing to install. I'm hoping all the issues they had when it first released last year are largely fixed by September. At least hotpatching is becoming a thing now on Ent/Edu editions managed through Intune, so nagging staff to restart might be less frequent.

[STK91]

1 hour ago, Disease said:

Hi all, moving to Windows 11 24H2  this summer from Windows 10, anyone care to share any gotchas I need to plan for, especially when it comes to Group Policy. Are there any quirks I need to plan for or set or will most of my current GPO settings still be applicable in Win 11.

 

Thanks in Advance.

In the exact same boat as you, particularly GPO's. Any tips or things you have set for machine wide or users? 

[Julian]

Windows 11 breaking changes;

 

Group policy not backward compatable.

(This sounds worse that it actually is, your old policies will mostly work).

 

Start Menu changed again.

(Has been extensivly discussed in the forums)

 

Windows 11 needs Server 2022, or Server 2025.

(it can work with earlier versions, but fetures like SMB3 need both ends of the connection to be able to do SMB3)

[jthompson]

I can't remember how these differ between W10 and W11, but take a look at the quick toggles (in the same panel as the volume slider) and decide whether you want to prevent your end users from toggling Flight mode and Mobile hotspot.

 

Defunctioning the Flight mode toggle is done by using Group Policy to set the Radio Management Service Windows service to disabled.

 

Defunctioning the Mobile hotspot toggle is done in Group Policy using Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Prohibit use of Internet Connection Sharing on your DNS domain network.

 

[PotNoodleTech]

Couldnt resist a memegenerator

 

[timbo343]

Completely disable / remove the widgets menu from the bottom left of the taskbar

 

Add HKLM\Software\Policies\Microsoft\DSH

> AllowNewsAndInterests

DWORD = 0

 

If you want to allow access to settings > sounds or display, you have to allow access to control panel and then hide all control panel items. Then set what areas in settings the users are able to access.

 

I couldn't get the StartLayout working so using and copying a bin file to Start2.bin of the users profile during logon.

[timbo343]

8 hours ago, jthompson said:

I can't remember how these differ between W10 and W11, but take a look at the quick toggles (in the same panel as the volume slider) and decide whether you want to prevent your end users from toggling Flight mode and Mobile hotspot.

 

Defunctioning the Flight mode toggle is done by using Group Policy to set the Radio Management Service Windows service to disabled.

 

Defunctioning the Mobile hotspot toggle is done in Group Policy using Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Prohibit use of Internet Connection Sharing on your DNS domain network.

 

Some how i completely removed the quick access menu from the right of the desktop.

[mikes]

With our upgrade to Win 11 from Win 10 most of our stuff continued working (printing, file shares etc) and our servers are still 2019.

 

Most of our GPO's worked but we needed new restrictions for Control Panel/Settings as the Win 10 ones don't fully apply (Win 11 has new GPO's so you can allow accessibility but deny screen resolution as needed etc).

 

 

The big problems I've had are with Win 11's poor usability e.g. a lot of users can't find out how to open network drives, find relevant programs in the start menu, I even had calls where users couldn't find the start button (no joke). Once users have used it for more than a day or two they are usually fine though.

So I will likely have to customize the Start Menu which I don't really want to do as it seems very fragile and might cause problems down the road not leaving it as default.

 

Also our Win 11 image had a lot of junk built in, e.g. xbox, bing news, sync stuff, stuff we didn't want on classroom PC's, so I had to make a powershell script to remove it.

 

[itskdog]

2 minutes ago, mikes said:

Also our Win 11 image had a lot of junk built in, e.g. xbox, bing news, sync stuff, stuff we didn't want on classroom PC's, so I had to make a powershell script to remove it.

 

Good news, 25H2 is expected to have a group policy setting to uninstall various inbox apps, no more PowerShell scripts!

[STK91]

Is the best way to sort the start menu out by copying the Start2.bin? Has anyone had any issues with this method?

 

Thanks

[J-14P]

24 minutes ago, STK91 said:

Is the best way to sort the start menu out by copying the Start2.bin? Has anyone had any issues with this method?

 

Thanks

We use it. Is it ideal? No. Does it work. Yes. No issues so far.
 

I just have it re-apply on logon. It does mean users cant customise it themselves, but we never have allowed that.

 

Officially the correct way is using Intune, but I'd rather resist putting these sort of policies in Intune.

Edited July 11, 2025 by J-14P

[Julian]

The Start2.bin method works, but you do have to have the referanced programs in the "All Programs" list first.

[mikes]

Actually I've just figured out, I've deployed some software (OpenShot video editor being one, but I'm told it happens in GameMaker as well) - the default Save location is not the Redirected user My Documents - instead it is prompting them to save to their userprofile location  C:\Users\25UserM    they can pick the documents folder but if they just type and save it'll save to the machines HDD.  I could restrict the filesystem permission but it would still bring up that location and just error upon save instead.

Is there a setting to change this globally? I've done folder redirection, a lot of the old settings I don't think apply since Windows 7

[Hoyt]

I'm sorry I can't remember the specific GPO setting but years ago we hid drive C from Windows Explorer and prevented typing in paths in explorer Windows.  It's worked well so far.  If a program tries to save to the HDD it just throws an access denied error then they can select their Documents folder which is redirected to our file servers.

 

Just a quick look shows that we have User Configuration > Policies > Administrative Templates > Windows Components > File Explorer set to "Hide these specified drives in My Computer" and the option set to enabled and have the option selected "Restrict C drive only".  We also have the same option selected in that GPO under "Prevent access to drives from My Computer".

 

Our Desktops are redirected and read only so they can't save stuff there.

 

 

 

 

[Tefters]

Spent weeks refining my Windows 11 build and all is good to go; however, I do have a few quirks to iron out or ignore:

 

- New M365 Copilot App (aka OfficeHub) - When trying to update wants to download an .EXE to execute with the Windows Store which gets blocked due to our AppLocker policies. - Spent days investigating and probably going to force users through the normal Copilot app which then opens the web browser to the secure version.

 

- Newer Windows print interface showing all our printers with WFD which is rather annoying. Debating the best way to work with this but might just be visiting all my printers and turning off WFD on each one.

 

- My image seems to install on any machine well below the requirements, both TPM and CPU. I have heavily doctored my image but I didn't touch any of the system requirement hacks you can disable them with so not a scooby how its installing on lower spec machines. I did have a Windows 10 image I spent ages updating for machines that didn't meet the spec however now its installing on lower spec machines and I haven't deviated from official Microsoft methods I might just shove 11 everywhere as overall it runs better than Windows 10. Enterprise ISO's don't have the checks maybe? 🤷

Edited July 21, 2025 by Tefters

[mavhc]

Did a test install of win11 a few years ago via wds (using win10 wpe wim) and yes, it seemed to bypass any checks. However it never did a feature update

[Tefters]

51 minutes ago, mavhc said:

Did a test install of win11 a few years ago via wds (using win10 wpe wim) and yes, it seemed to bypass any checks. However it never did a feature update

I don't mind that, as I wouldn't let feature updates roll out natively. Cumulative updates are fine, but I just update my image every year or two and rebuild everything for a fresh start, the lifecycle was supposed to be 2 feature updates a year but nowadays seems closer to 1 so meh! 🤷

[mavhc]

1 minute ago, Tefters said:

I don't mind that, as I wouldn't let feature updates roll out natively. Cumulative updates are fine, but I just update my image every year or two and rebuild everything for a fresh start, the lifecycle was supposed to be 2 feature updates a year but nowadays seems closer to 1 so meh! 🤷

I've never bothered to reimage for a version update, that's some old school thinking, most feature updates are just the same as a monthly update, it's only releases like 24h2 that change a lot

[Tefters]

2 minutes ago, mavhc said:

I've never bothered to reimage for a version update, that's some old school thinking, most feature updates are just the same as a monthly update, it's only releases like 24h2 that change a lot

Aren't feature updates the release versions or has the terminology of that changed now?

 

I'm referring to the 24H2, 23H1 etc... The reason I also update the image and rebuild is due to refreshing everything, app updates etc... Adobe suite being a shining example as each year they release a new version of the suite at around 30GB which need 60 GB by the time your account for install before it self deletes again and a lot of our computers are still only 256GB with a 70GB OS and APP footprint and then user profiles to boot not to mention not having the time to constantly sit their downloading new versions of apps and updating them in SCCM and then deploying them.

 

If I had the time to sit on SCCM more nowadays and focus on just App and OS deployment, then yeah sure but unfortunately, it's usually an Easter to Summer thing to then make the rest of the year a simple F12 process if anything goes wrong.

 

 

[mavhc]

Feature updates are the 24h1 24h2 etc, but a) the h1 updates are no more, and b) most of them are super minor.

 

So if you installed 21H2 the 22H2 and 23H2 updates were super minor, time and kernel update wise, but lots of new user features. Then you'd only have a week between 24h2 coming out and 21h2 Enterprise EOL'ing.

 

Not had the pleasure of Adobe Suite luckily, does sound terrible.

 

When Win10 was being announced I spent time making sure I could use thin deployment, so just swap in the latest WIM file and everything else was installed via the network, no more making my own images as they were going to change every 4, then 6, then 12 months

[Tefters]

6 minutes ago, mavhc said:

Feature updates are the 24h1 24h2 etc, but a) the h1 updates are no more, and b) most of them are super minor.

 

So if you installed 21H2 the 22H2 and 23H2 updates were super minor, time and kernel update wise, but lots of new user features. Then you'd only have a week between 24h2 coming out and 21h2 Enterprise EOL'ing.

 

Not had the pleasure of Adobe Suite luckily, does sound terrible.

 

When Win10 was being announced I spent time making sure I could use thin deployment, so just swap in the latest WIM file and everything else was installed via the network, no more making my own images as they were going to change every 4, then 6, then 12 months

Probably my terminology there, when I say image I'm just taking the ISO and then deploying it but afterwards hacking and slashing things like APPX provisioned packages and other things like that then installing apps, I'm not actually deploying an image installing stuff and recapturing for deployment, gave that up years ago.

 

Hopefully with the new round of GPO's coming the APPX work may be easier but I'll believe that when I see it!