Shared Start Menu based on what's installed!

[AlexB]

That's the theory I am going to work on.

 

On a server - StaffStart folder and StudentStart folder full of shortcuts that could potentially be in the start menus (this may get amalgamated into one.)

 

Locally - StaffStart & StudentStart folders on C:\ that a gpp will copy the shortcuts into if the target exists.

 

GPO - will redirect the start menu to the correct folder dependant on user.

 

This way it shouldn't matter if the machine is 64 or 32 bit, if the program exists and a rule has been created the user will get the programs that are available on that machine. Not quite as automated as I would like, someone will still have to copy the shortcuts into the server share and create the GPP rule, but better than nothing. My only worry would be do I bother with grouping shortcuts into folders and have to manage them too and if you get too many GPPs will logon or boot be slow.

 

You could go seriously advanced with WMI filtering to detect machine type(32bit/64bit/server/etc...) and validation of shortcut before copying the shortcuts. I did post a script for deletion of shortcuts if the target didn't exist and this could be adapted to check before copying. This would allow the shortcuts to be deployed automatically.

 

The main reason I did a machine policy to copy the shortcuts and then just a symbolic link at user login was to reduce the login times by not copying shortcuts at login

Edited May 16, 2012 by AlexB

[Davit2005]

Not wanting to create more work for myself, I've just got a folder in the redirected start menu called "_Local Apps (Limited Machines) the shortcuts detail where they are installed on. Had this setup since summer when rolled out Windows 7 and seems to work ok.

 

In Windows 7 users can just start typing the Program name in the search box in the start menu which makes launching apps much quicker than wading thru menus. The whole start menu is redirected, nothing from the local machine.

[morganw]

I realise this thread is a bit old and morganw's post above dates back to April last year, but.....

 

I'm trying to deliver customised start menus to my Windows 7 clients using Group Policy Preferences. Each shortcut preference is set to 'Replace' mode and has 'Item Level Targeting' enabled to check if the target executable exists. This works fine.

 

However, if a user logs onto a PC that has 'Application A' installed and receives a shortcut for 'Application A', and then logs off and logs onto another PC which doesn't have 'Application A' installed, the shortcut doesn't get removed from the user's start menu. This is the case even when the preference item has 'Remove this item when it is no longer applied' selected.

 

Am I missing something?

 

This will be down to profile management. Super mandatory or local profiles make this approach work well.

[TechMonkey]

You could go seriously advanced with WMI filtering to detect machine type(32bit/64bit/server/etc...) and validation of shortcut before copying the shortcuts. I did post a script for deletion of shortcuts if the target didn't exist and this could be adapted to check before copying. This would allow the shortcuts to be deployed automatically.

 

The main reason I did a machine policy to copy the shortcuts and then just a symbolic link at user login was to reduce the login times by not copying shortcuts at login

 

That's kinda where my thinking is going now. Originally was going to have it all server side but we get machines to start up ready for the morning, so if they take a little longer to start it is less annoying then waiting to log in.

[AlexB]

That's kinda where my thinking is going now. Originally was going to have it all server side but we get machines to start up ready for the morning, so if they take a little longer to start it is less annoying then waiting to log in.

 

Exact same reasoning here, machines come on at 8am, I'm not worried if they take longer then

[enjay]

In Windows 7 users can just start typing the Program name in the search box in the start menu which makes launching apps much quicker than wading thru menus. The whole start menu is redirected, nothing from the local machine.

 

Except no-one seems to use that method here...

[sted]

In Windows 7 users can just start typing the Program name in the search box in the start menu which makes launching apps much quicker than wading thru menus.

 

best feature in windows 7

[Davit2005]

Except no-one seems to use that method here...

 

The students found and got used to the method quicker than the staff, lol.

[5tu]

This will be down to profile management. Super mandatory or local profiles make this approach work well.

 

I was originally hoping to use mandatory profiles but have since found that Adobe CS apps such as Dreamweaver store user settings in the HKCU registry hive in addition to Roaming AppData. Therefore students will lose site settings with mandatory profiles.

 

Never simple is it!

[enjay]

The students found and got used to the method quicker than the staff, lol.

 

Same here, unfortunately since the teachers talk the pupils through how to find applications (especially in the primary school), the pupils quickly forget what they know and just learn the teachers' methods.

[linkazoid]

I'm trying to get the scripts from page 2 to work with our new windows 7 laptops, but when the first script is run, it copies the folders from the share but not any of the icons within.

 

Can someone hopefully point me in the right direction or tell me what permissions they have on the shared resources share.

 

Thanks,

 

Michael

[AlexB]

I'm trying to get the scripts from page 2 to work with our new windows 7 laptops, but when the first script is run, it copies the folders from the share but not any of the icons within.

 

Can someone hopefully point me in the right direction or tell me what permissions they have on the shared resources share.

 

Thanks,

 

Michael

 

At a guess I'd say the shortcuts aren't .lnk files.

[linkazoid]

Hi Alex,

 

I can get the script to work if I change the copy switches to /COPY:DT and remove /SECFIX from the robocopy command. But this removes any security permissions from the shortcuts.

 

Also what configuration do I need to specify for the redirection? Basic or advanced and which Target folder location.

 

Thanks,

 

Michael

[AlexB]

Hi Linkazoid

 

I'm sure about redirection, we don't use it here, but I'm sure lots are and will answer soon!

 

For the shortcut copying, I've never tried to use permissions and I think my shortcuts just pickup the permissions from the parent folder of the destination.

[FN-GM]

Hi Alex,

 

I can get the script to work if I change the copy switches to /COPY:DT and remove /SECFIX from the robocopy command. But this removes any security permissions from the shortcuts.

 

Also what configuration do I need to specify for the redirection? Basic or advanced and which Target folder location.

 

Thanks,

 

Michael

 

Basic and the and the terget folder as the location on the C drive. We use the same scripts.

 

Z

[psydii]

If this has already been suggested and dismissed - I appologise, consider it another vote for an alternative method.

 

Why not let the individual machine build its start menu based on what it has installed. Use Transforms to control the location of the installed shortcuts. If there are apps that run from network locations you can use GPP to populate the shortcuts.

 

If you are trying to restrict who can run what apps then either NTFS permissions or AppLocker could be employed.

[FN-GM]

If this has already been suggested and dismissed - I appologise, consider it another vote for an alternative method.

 

Why not let the individual machine build its start menu based on what it has installed. Use Transforms to control the location of the installed shortcuts. If there are apps that run from network locations you can use GPP to populate the shortcuts.

 

If you are trying to restrict who can run what apps then either NTFS permissions or AppLocker could be employed.

 

Do you mean using the all users start menu?

[linkazoid]

Will the All users start menu clear when I used MDT or WDS? If not maybe i'm over complicating things and should just stick with that.

[psydii]

I don't think it clears. We put office 2010 into my image and all the shortcuts just work.

 

Everything else is deployed either via a script or msi+transform so the baseline image hardly ever gets fiddled with.

[edie209]

I have been looking at this script for the last couple of days but I just can't get the shortcuts to populate, the folder is created on the c: drive of the desktop but thats as far as it goes. The network share has Read write and execute. I must be doing something wrong.

 

 

 

We are in the process of moving from RM to a vanilla solution and wanted something that work ins in the same way as the RM method, check to see if the Target and Icon can be found, if they can show the shortcut. If all the shortcuts within a folder a hidden also hide the folder.

 

I have come up with a script based solution and execution time at logon on a Virtual PC running on an i5, 4gb RAM, 2008R2 (base OS) takes approx: 5-8 seconds (according to event log).

 

It works in the following way:

Startup Script: to copy the start menu to a local folder on the workstation using robocopy and some extra params to also copy secyuirty settings so you can restrict folders by security group (for example out MIS folder is staff only)

 

Logon Script: At logon the script accesses the local folder and hides/unhides folders/files depending on what can be accessed (icon path and target).

 

Folder Redirection: All users have their start menu redirected to the local path on the machine.

 

StartUp Script - Placed in the NetLogon Folder

[edie209]

I have been trying to get this to work for quite some time now in between other things, but it just will not work. I can't get redirected menus to work for students no matter what I do I have tried sharing from a folder share and netlogon yet nothing works.

 

I must be missing something but what.

 

In the redirection GPO it seems the desktop and start menu don't work yet in the group policy modelling wizard it passes.

 

So anyone have an idea?

 

Servers are 2008R2 clients are Windows 7

[Roberto]

Edie, have you checked RSOP for your test user & machine to see if the policy is applied?

Are there any group policy processing errors logged? Check the system log for general issues and applications & services\Microsoft\Windows\GroupPolicy log for a detailed report on what policies are applied and if any errors are generated?

 

Can the test user access the start menu location on the C:\ drive?

[edie209]

I ran RSOP and got an error

Error Can not create folder "\\sccm-01\redirection$\Student\Desktop\Programs" 
 ErrorDetails This security ID may not be assigned as the owner of this object

 

I tried all the solutions suggested by Microsoft yet nothing worked. So I stripped out folder redirection and still I have no start menu (maybe a clue here) Anyway I created a separate GPO just for the redirection and started with a folder in the netlogon directory,and it worked, But as so as I try this script I get nothing, I have noticed that the icons are not being copied to the local folder, but the folder is created.

[Roberto]

I ran RSOP and got an error

Error Can not create folder "\\sccm-01\redirection$\Student\Desktop\Programs" 
 ErrorDetails This security ID may not be assigned as the owner of this object

 

I tried all the solutions suggested by Microsoft yet nothing worked. So I stripped out folder redirection and still I have no start menu (maybe a clue here) Anyway I created a separate GPO just for the redirection and started with a folder in the netlogon directory,and it worked, But as so as I try this script I get nothing, I have noticed that the icons are not being copied to the local folder, but the folder is created.

 

Sounds like a permissions or NTFS owner problem. As an experiment, see if you can look at permissions on the target start menu folder; the file/folder owner needs to be set to something sensible and the machine needs to be able to create and copy folders as the startup script is run in the machine's context, and the user needs to be able to edit file object attributes as the login script is run in the user context. What happens if you set "everyone - full control" on the parent (local start menu) folder and under advanced permissions set objects created inside that folder to inherit from it. I'm not suggesting that's an actual solution, but if it works you know where the permissions issue is hiding.

 

Oh yes - can't remember if this applies to start menu re-direction offhand or not, but worth checking - on folder re-direction GPO settings there's a tickbox on some of them to grant the user exclusive access to the re-directed folder. A Reasonable setting for private folders, of course, but not a good idea for a shared start menu...

Edited September 9, 2012 by Roberto

[nm_media]

If I use the script mentioned here but I hide/restrict C drive within GPO for users, does the user still get access to the local shortcut folder created on the C drive?