Start Menu - Roaming Profiles Fix

[victory2015]

Hi, so ive been struggling best part of week trying get my start menu working with roaming profiles.

 

The issue ive been having which is quite common is the TileDataLayer folder issue, as soon as a user logs on a second computer the start menu tiles disappear or the start menu is broken completely.

 

I have come up with a solution which i hope helps others. It involves roaming part of the local appdata. What we are going to do is let windows itself roam the TileDataLayer folder.

 

The first step is to delete the roaming profile of your test user so when they logon they get a brand new profile.

 

Next step is to set StartLayout xml in group policy with your desired template ( this is optional as you may use local default modified too or decide to leave as default so they may modify their own.)

 

Next we need to modify to ExcludeProfileDirs for the user when they logon, so we need to set the following modification in a user GPO under preferences.

You will need modify this for your own environment excluding any directories in appdata/local that you do not what to roam, ideally we only want to end up with TileDataLayer folder roaming.

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ExcludeProfileDirs"="AppData\\Local\\Application Data;AppData\\Local\\ConnectedDevicesPlatform;AppData\\Local\\History;AppData\\Local\\Microsoft;AppData\\Local\\Microsoft Help;AppData\\Local\\Temp;AppData\\Local\\Publishers;;AppData\\Local\\Packages;AppData\\Local\\Comms;AppData\\Local\\HP;AppData\\Local\\Temporary Internet Files;AppData\\Local\\VirtualStore;AppData\\Local\\Winternals;AppData\\LocalLow;$Recycle.Bin;OneDrive;Work Folders"

 

This should now allow the start menu to roam, if you logon as the user they will get a perfect start menu the first time. Then when they logon another computer the second time they will also get their start menu in tact.

 

If you get what i did and the images of the tiles were missing in the start menu on second login you will need to run a powershell script on logon.

I haven't got this working by adding it to the logon scripts in GPO so i have had to execute it from a login vbs script configured under User Configuration\Administrative Templates\System\Run These Programs at User Logon

 

Vbs Script to Launch Powershell script. RebuildTileCache.vbs

set WSHShell = createObject("wscript.shell")
WSHShell.Run "powershell -file \\server\netlogon\RebuildTileCache.ps1", 0, False
WScript.Quit

 

This is RebuildTileCache.ps1

 

Get-AppXPackage | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

 

You may have to Set the PowerShell execution policy via Group Policy

Within Group Policy, navigate to Computer Configuration | Administrative Templates | Windows Components | Windows PowerShell and configure the Turn On Script Execution setting

 

 

Hope this helps others in my position, this nearly stopped my windows 10 rollout.

 

I currently have 5 members of staff test this all this week and its been working perfect and roaming profiles are very small in size.

[victory2015]

Just an update that weve had all 100 staff in last two days and all is running well. Hope this helps others!

[jdizzle]

This is great. I am not having such luck so far..

 

I am wondering why you put local folder paths in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Roaming profiles only copy the Roaming folder. They don't copy anything in the Local folder.

[victory2015]

Roaming profiles have a default

ExcludeProfileDirs list, in that is AppData\Local\ whcih prevents local roaming. what i am doing is removing this entry and declaring every folder in the local appdata i do not want to roam except the TileDataLayer folder.

[Arthur]

Didn't Microsoft fix the TileDataLayer issue in the 9th August update?

 

Windows 10 mandatory profiles are not deleted as expected at logoff

[victory2015]

Didn't Microsoft fix the TileDataLayer issue in the 9th August update?

 

Windows 10 mandatory profiles are not deleted as expected at logoff

 

No this is in relation to mandatory profiles, i am using roaming profiles for staff here and issue is there start menu tiles does not roam because it is stored in the local area of appdata. I also do not Delete cached copies of roaming profiles on log off as this gives a 5 second logon speed on computers they have used before.

 

symptoms would be logon first machine you get nice start menu with all the tiles, log off. Logon second machine boom no more tiles broken start menu.. the TileDataLayer folder needs to roam.

[jdizzle]

Fantastic. I did not realize that you could change that key so it would include the Local folders! Works great! Thank you!!!! Thank you!!!! Thank you!!!! Thank you!!!!

[dhallam]

We have been trying to resolved this all week, and you fix works spot on. Thanks so much we were starting to give up all hope. You never know microsoft might actuall put this fix into GPO polices :-)

[Javik]

Note, to anyone implementing this, you will want to adjust the Local exclusions for your environment. If you expand the exclusions string in the first post, it contains:

 

"ExcludeProfileDirs"="

AppData\\Local\\Application Data;

AppData\\Local\\ConnectedDevicesPlatform;

AppData\\Local\\History;

AppData\\Local\\Microsoft;

AppData\\Local\\Microsoft Help;

AppData\\Local\\Temp;

AppData\\Local\\Publishers;

AppData\\Local\\Packages;

AppData\\Local\\Comms;

AppData\\Local\\HP;

AppData\\Local\\Temporary Internet Files;

AppData\\Local\\VirtualStore;

AppData\\Local\\Winternals;

AppData\\LocalLow;

$Recycle.Bin;

OneDrive;

Work Folders

"

 

Wow, you run a pretty barebone Windows environment. Nothing for Mozilla or Google? If you want to avoid gigs of cache data from web browsers in your roaming profile, then you need to exclude Chrome and Firefox also. May I suggest including:

 

AppData\\Local\\Adobe;

AppData\\Local\\Apple;

AppData\\Local\\Apple Computer;

AppData\\Local\\Autodesk;

AppData\\Local\\Chromium;

AppData\\Local\\CrashDumps;

AppData\\Local\\Fusion 360 CAM;

AppData\\Local\\gegl-0.2;

AppData\\Local\\Google;

AppData\\Local\\gtk-2.0;

AppData\\Local\\Mozilla;

AppData\\Local\\NVIDIA;

AppData\\Local\\NVIDIA Corporation;

AppData\\Local\\Skype;

AppData\\Local\\WebEx;

 

(Also the first post includes an extra semicolon in the exclusion list... "AppData\\Local\\Publishers;;....." fortunately Windows doesn't treat that as exclude everything.)

[jaminben]

Have been playing with Windows 10 and had the same issue with X64 1607 EDU and the above fixed it for me when using a roaming profile.... can't believe we have to resort to this sort of stuff to get start menus working

 

Thanks to the OP

[victory2015]

Note, to anyone implementing this, you will want to adjust the Local exclusions for your environment. If you expand the exclusions string in the first post, it contains:

 

"ExcludeProfileDirs"="

AppData\\Local\\Application Data;

AppData\\Local\\ConnectedDevicesPlatform;

AppData\\Local\\History;

AppData\\Local\\Microsoft;

AppData\\Local\\Microsoft Help;

AppData\\Local\\Temp;

AppData\\Local\\Publishers;

AppData\\Local\\Packages;

AppData\\Local\\Comms;

AppData\\Local\\HP;

AppData\\Local\\Temporary Internet Files;

AppData\\Local\\VirtualStore;

AppData\\Local\\Winternals;

AppData\\LocalLow;

$Recycle.Bin;

OneDrive;

Work Folders

"

 

Wow, you run a pretty barebone Windows environment. Nothing for Mozilla or Google? If you want to avoid gigs of cache data from web browsers in your roaming profile, then you need to exclude Chrome and Firefox also. May I suggest including:

 

AppData\\Local\\Adobe;

AppData\\Local\\Apple;

AppData\\Local\\Apple Computer;

AppData\\Local\\Autodesk;

AppData\\Local\\Chromium;

AppData\\Local\\CrashDumps;

AppData\\Local\\Fusion 360 CAM;

AppData\\Local\\gegl-0.2;

AppData\\Local\\Google;

AppData\\Local\\gtk-2.0;

AppData\\Local\\Mozilla;

AppData\\Local\\NVIDIA;

AppData\\Local\\NVIDIA Corporation;

AppData\\Local\\Skype;

AppData\\Local\\WebEx;

 

(Also the first post includes an extra semicolon in the exclusion list... "AppData\\Local\\Publishers;;....." fortunately Windows doesn't treat that as exclude everything.)

 

thanks for this, i have Chrome and others redirected to appdata on their home directorys so not needed for me

[timbo343]

So I've excluded the following:

 

AppData\Local\ConnectedDevicesPlatform;AppData\Local\Microsoft;AppData\Local\Microsoft Help;AppData\Local\Packages;AppData\Local\Temp;AppData\LocalLow;$Recycle.Bin;OneDrive;Work Folders

 

i found that putting the \\ copied all folders from Local and Locallow hence the single \.

 

In the profile im now seeing only TileDataLayer but when i log the test user back on to the same machine the profile does allow logon with the error...

 

The User Profile Service service failed with sign-in. User profile cannot be loaded.

 

Taking out the TileDataLayer folder doesn't solve the issue. The only way im finding to get this user to log back on is to delete the profile and let it populate a new one.

[victory2015]

So I've excluded the following:

 

AppData\Local\ConnectedDevicesPlatform;AppData\Local\Microsoft;AppData\Local\Microsoft Help;AppData\Local\Packages;AppData\Local\Temp;AppData\LocalLow;$Recycle.Bin;OneDrive;Work Folders

 

i found that putting the \\ copied all folders from Local and Locallow hence the single \.

 

In the profile im now seeing only TileDataLayer but when i log the test user back on to the same machine the profile does allow logon with the error...

 

The User Profile Service service failed with sign-in. User profile cannot be loaded.

 

Taking out the TileDataLayer folder doesn't solve the issue. The only way im finding to get this user to log back on is to delete the profile and let it populate a new one.

 

strange, what is the event log telling you?

[timbo343]

Ive got the profile working however im getting blank tiles where icons should be and i cannot get the script to run. If i put it in the share i have to use the unblock-file command. Using the VBS script gives an error and ive tried to use a bat file, that too gives an error as its calling the ps1 file from a network location.

 

My bad, ive just put the vbs on the desktop of a test user and run it and it brings back the icons but the script still isnt running when placed in a GPO that i know has works that calls papercut.

Edited February 28, 2017 by timbo343

[victory2015]

Ive got the profile working however im getting blank tiles where icons should be and i cannot get the script to run. If i put it in the share i have to use the unblock-file command. Using the VBS script gives an error and ive tried to use a bat file, that too gives an error as its calling the ps1 file from a network location.

 

My bad, ive just put the vbs on the desktop of a test user and run it and it brings back the icons but the script still isnt running when placed in a GPO that i know has works that calls papercut.

 

what errors did u get?

 

did you do

 

You may have to Set the PowerShell execution policy via Group PolicyWithin Group Policy, navigate to Computer Configuration | Administrative Templates | Windows Components | Windows PowerShell and configure the Turn On Script Execution setting

 

are you putting script in User Configuration\Administrative Templates\System\Run These Programs at User Logon

Edited February 28, 2017 by victory2015

[timbo343]

Initially i got a few errors about the profile not been able to accessible. I found out this was due to "authenticated users" wasnt listed in the security tab of the users profile. Once this was set to full access the profile loaded on the machine.

 

I'll check out the errors tomorrow but its puzzling how the vbs script doesnt work when the papercut vbs works fine.

 

I also tested "run these files at logon" under user > system > logon and the vbs runs but needs user intervention to click on run the vbs.

 

I've set the powershell "turn on script execution" to enabled too.

[victory2015]

it needs run under "run these files at logon" i never worked out ẃhy, ill check tomorrow as im sure there was a setting to suppress the intervention

[timbo343]

it needs run under "run these files at logon" i never worked out ẃhy, ill check tomorrow as im sure there was a setting to suppress the intervention

Ive just had a thought, does the vbs or the ps1 file need to be in "run these programs at user login"? I initially had the vbs in there, thinking of putting the ps1 in there instead. Also got the vbs in "Scripts" > "logon".

[victory2015]

I think its because you have UAC enabled so its prompting for elevation.

 

try to create a shortcut to powershell.exe and modify the shortcut and add "PATH TO SCRIPT PS1" after powershell.exe

 

then drop it in the startup folder of the start menu.

[timbo343]

UAC isnt enabled. Heres what i get if i put the path to ps1 in USER CONFIG > SYSTEM > LOGON > Run these programs at logon ...

 

And the same with the vbs...

 

Clicking open on the VBS calls the ps1 file and the icons on the start menu appear.

 

As mentioned, the vbs is placed on the desktop too which calls the ps1 from the netlogon share - this works so god knows why when the vbs is placed in USER CONFIG > WINDOWS SETTINGS > SCRIPTS > Logon it doesnt run.

Edited March 1, 2017 by timbo343

[timbo343]

Update.. ive added a wscript.echo to the VBS to see if its actually running at logon when placed in scripts, and the vbs gives the output as expected but the icons on the tiles dont show.

 

Edit... putting the vbs in the startup folder of the local machine seems to have worked.. just need to do more tests.

Edited March 1, 2017 by timbo343

[timbo343]

@victory2015 Just want to say thanks for instructions on how to get this working, ive managed to get the start menu to follow the user round however there are a few caveats with this..

 

1. If the xml start menu from the share ever changes, the user requires a new profile. Deleting the TileLayer folder from the roaming profile only breaks the start menu, therefore the user needs a complete new one. This isn't ideal if the users use Outlook Client as their mail app.

 

2. The machine i tested this on didnt have SIMS installed and the staff XML here has the link to SIMS as a tile. Logging on as a test user onto a machine that had SIMS installed, doesn't add SIMS to the already created start menu so the start menu needs to be created on a machine that has all these apps so the tiles can be created. I need to test to see what happens when a start menu is created with apps that are different to other machines. Ie, if a machine has SIMS or Outlook installed and the tiles are populated with these icons, what happens when a user jumps on a machine that doesnt have these apps.

 

3. When a new profile is created on the server share, i found that Authenticated Users needed to be added to the security tab with FULL permissions as windows 10 now needs to write to the profile for some reason.

 

4. I had to add our local domain into the trusted sites lists. This is done at USER CONFIG > Admin Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List. Add in the local domain and set the value to 2. This added the local domain as a trusted domain for internet settings.

 

5. I had to put the vbs file in the Startup folder of the local machine under C:\Program Data\Microsoft\Windows\Start Menu\Programs\Startup. This was the only way i could get the VBS to run.After many tests of putting the vbs in Scripts > Logon in Group Policy the script would not call the ps1 file even though i knew the script was running. The icons on the tiles are missing for a short while, whilst the session finishes running all the other scripts we have during logon.

 

Update.. As a test, i used a test user with a machine that had SIMS installed. The XML start menu was copied from the server to the profile with the SIMS tile listed. Once logged off, i moved to a machine that didnt have SIMS installed. The tile disappeared from the start menu - logged off this session. Went back to the initial machine and tested again, the start menu populated with the SIMS tile. Just logged back in to the machine that doesnt have SIMS on it and the SIMS tile is there but no icon is shown.

Edited March 1, 2017 by timbo343

[victory2015]

@victory2015 Just want to say thanks for instructions on how to get this working, ive managed to get the start menu to follow the user round however there are a few caveats with this..

 

1. If the xml start menu from the share ever changes, the user requires a new profile. Deleting the TileLayer folder from the roaming profile only breaks the start menu, therefore the user needs a complete new one. This isn't ideal if the users use Outlook Client as their mail app.

This is true for windows 10 in general, you have reset the profile, do you not have outlook on all machines??? do you not auto config outlook when they sign in a new profile, if you use exchange this is easy to do.

2. The machine i tested this on didnt have SIMS installed and the staff XML here has the link to SIMS as a tile. Logging on as a test user onto a machine that had SIMS installed, doesn't add SIMS to the already created start menu so the start menu needs to be created on a machine that has all these apps so the tiles can be created. I need to test to see what happens when a start menu is created with apps that are different to other machines. Ie, if a machine has SIMS or Outlook installed and the tiles are populated with these icons, what happens when a user jumps on a machine that doesnt have these apps.

i have to admit ive not seen this issue, i have the same image for all machines so sims is installed on all computers in the school.

3. When a new profile is created on the server share, i found that Authenticated Users needed to be added to the security tab with FULL permissions as windows 10 now needs to write to the profile for some reason.

this is right with roaming profiles, user needs permission to write back the profile.

4. I had to add our local domain into the trusted sites lists. This is done at USER CONFIG > Admin Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List. Add in the local domain and set the value to 2. This added the local domain as a trusted domain for internet settings.

this "should" have resolved the vbs running from USER CONFIG > SYSTEM > LOGON > Run these programs at logon. if you had used the server name in the path rather than the domain it would work.

5. I had to put the vbs file in the Startup folder of the local machine under C:\Program Data\Microsoft\Windows\Start Menu\Programs\Startup. This was the only way i could get the VBS to run.After many tests of putting the vbs in Scripts > Logon in Group Policy the script would not call the ps1 file even though i knew the script was running. The icons on the tiles are missing for a short while, whilst the session finishes running all the other scripts we have during logon.

Update.. As a test, i used a test user with a machine that had SIMS installed. The XML start menu was copied from the server to the profile with the SIMS tile listed. Once logged off, i moved to a machine that didnt have SIMS installed. The tile disappeared from the start menu - logged off this session. Went back to the initial machine and tested again, the start menu populated with the SIMS tile.

 

NICE!

[timbo343]

Just to update this...

 

O've had to add a bit more to the VBS as when students were logging into the machine they were getting an error running WSHShell. Not sure why but they don'thave the problem that staff have with the start icons.

 

Anyway, here's the VB script that's placed in the startup folder of each machine via Group Policy - basically saying that if the user is a member of "staff" group run the powershell script.

 

On Error Resume Next

 

set WSHShell = createObject("wscript.shell")

Set ADSysInfo = CreateObject("ADSystemInfo")

Set CurrentUser = GetObject("LDAP://" & ADSysInfo.Username)

strGroups = LCase(CurrentUser.MemberOf)

 

Const Staff = "cn=staff"

 

If Instr(strGroups,"staff") then

 

WSHShell.Run "powershell -file \\*server*\netlogon\RebuildTileCache\RebuildTileCache.ps1", 0, False

WScript.Quit

 

End If

 

So far, we have 5 users with working v6 roaming profiles. Setting the machines to delete cache copies of roaming profiles.

 

Next i will be add a script into users logon so that the profile on the server share has authenticated users added with full permissions

icacls \\server\profile\%username%.v6 /grant "authenticated users":(OI)(CI)F

.

Edited March 16, 2017 by timbo343

[timbo343]

I think I'm going to give our staff that don't use outlook, Mandatory profiles with the custom start menu.

 

Yesterday afternoon i logged in to a 1607 laptop with a test user configured with the above that didn't have all the programs installed that are on the base image and the start menu only had 2 tiles listed. I've logged this user into a machine that has all the apps installed and the start menu still only shows 2 tiles, therefore the profile would need to be deleted and started again.

 

I've since tested the student mandatory profile with a staff account and found this is working as it should - staff have read access on this mandatory profile.