ADMaster

I tested this earlier in the week. I was not able to get the device level GPO to work. I'm thinking I had multiple / conflicting settings when I tested the first time. I've simply added the apply once to my json and it appears to be working. My own start menu hasn't reverted on me yet. Here is my script again. You can also set this with GP Registry Preferences $json = '{"applyOnce":true,"pinnedList":[{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"},{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"},{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},{"packagedAppId":"windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"},{"packagedAppId":"Microsoft.ScreenSketch_8wekyb3d8bbwe!App"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\VLC media player.lnk"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Configuration Manager\\Configuration Manager\\Software Center.lnk"},{"packagedAppId":"Microsoft.CompanyPortal_8wekyb3d8bbwe!App"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\lenovo\\System Update.lnk"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Dell\\Command Update\\Dell Command Update.lnk"},{"packagedAppId":"E046963F.LenovoSettingsforEnterprise_k1h2ywk1493x8!App"}]}' if (!(Test-Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start" } New-itemproperty "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start" -Name ConfigureStartPins -Value $json -PropertyType String -Force

Ok I've broken my start menu and fixed it a few times today. Here is what I know so far. The GPO for device level json works The GPO for users level json breaks the start menu as you describe. The reg key I gave you does not appear to like the apply once I got pulled away to work on other tickets so can't be 100% sure, but I'm thinking when I had the apply once value it just ignored the whole thing.

So I'm getting back to this today. 1. What do you have in the GPO? the intune / CSP method are both json. The GPO method recently support is a path to the JSON file. Do you have a path and is it reachable? I just configured the device version of this policy on my local GPO, not had any issues yet. Also added the apply once as previously discussed. 2. I found the version information I was looking for. It is in the what's new in 25H2 article for IP pros. The task bar has a pin generation feature to allow you to repin an item based on its version. This is what I was mixing up with the apply once key. https://learn.microsoft.com/en-us/windows/configuration/taskbar/pinned-apps?tabs=intune&pivots=windows-11#pingeneration The reg key I shared appears to be a direct way of using the CSP option. I still need to do some testing , what happens if this GPO gets deployed to a machine that is not updated yet. Will that break the start menu, or it just won't apply?

That was something I found on a blog a few years ago. I don't think MS had a GPO back then, they wanted it all via Intune. This was the trick to set the policy once for default start menu during OSD. I never wanted to set it via GPO / Intune because I wanted users to be allowed to change it, just get my cleaned up defaults. I rolled 25H2 out to a test group last week, no complaints on the start menu yet, but maybe they didn't have additional pins. Most people live in the browser.

I have a related but different issue. I use PowerShell to set my start pins as part of OSD. It has worked fine for the last several versions. Here is a snip from my code $json = '{"pinnedList":[{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"},{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"},{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},{"packagedAppId":"windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"},{"packagedAppId":"Microsoft.ScreenSketch_8wekyb3d8bbwe!App"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\VLC media player.lnk"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Configuration Manager\\Configuration Manager\\Software Center.lnk"},{"packagedAppId":"Microsoft.CompanyPortal_8wekyb3d8bbwe!App"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\lenovo\\System Update.lnk"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Dell\\Command Update\\Dell Command Update.lnk"},{"packagedAppId":"E046963F.LenovoSettingsforEnterprise_k1h2ywk1493x8!App"}]}' if (!(Test-Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start")){ New-Item -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start" } New-itemproperty "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start" -Name ConfigureStartPins -Value $json -PropertyType String -Force On 24H2 and lower this would apply as the default start layout but not effect user changes later on. Now I've updated my machine to 25H2 my own pins keep disappearing. This was one of the first posts I found when starting to look into it this afternoon. I suspect I need to update my json with the apply once true field. I'll report back when I've had a chance to test, but I think you have pointed me in the right direction.

This does appear to be fixed in the November update both 22H2 and 23H2. Only tested on one machine so far.

Hello, I'm testing the win 10 to win 11 upgrade path. If I upgrade W10 22h2 to W11 22H2 the start menu upgrades and gets the pinned items I need it to have. I have a little script the applies the pinned apps reg key and deletes the shell folder from appdata. On the 22h2 upgrade I think this was needed to to pull in a fresh start menu layout. Now on the 23H2 upgrade it creates a Windows 10 apps folder that has my previously pined apps, then just pins edge, office, settings and file explorer. It ignores what I want it to pin. A fresh install pins these items correctly. Here is my script for reference. I'm guessing there is some other file / folder that needs removed / changed. I just haven't found it yet. [color=#6a9955]#===Start Script===[/color] [color=#9cdcfe]$drives[/color] [color=#d4d4d4]=[/color] [color=#569cd6]@[/color]([color=#ce9178]"C"[/color][color=#d4d4d4],[/color][color=#ce9178]"D"[/color][color=#d4d4d4],[/color][color=#ce9178]"E"[/color][color=#d4d4d4],[/color][color=#ce9178]"F"[/color][color=#d4d4d4],[/color][color=#ce9178]"G"[/color][color=#d4d4d4],[/color][color=#ce9178]"H"[/color][color=#d4d4d4],[/color][color=#ce9178]"I"[/color][color=#d4d4d4],[/color][color=#ce9178]"J"[/color][color=#d4d4d4],[/color][color=#ce9178]"K"[/color][color=#d4d4d4],[/color][color=#ce9178]"L"[/color][color=#d4d4d4],[/color][color=#ce9178]"M"[/color][color=#d4d4d4],[/color][color=#ce9178]"N"[/color][color=#d4d4d4],[/color][color=#ce9178]"O"[/color][color=#d4d4d4],[/color][color=#ce9178]"P"[/color][color=#d4d4d4],[/color][color=#ce9178]"Q"[/color][color=#d4d4d4],[/color][color=#ce9178]"R"[/color][color=#d4d4d4],[/color][color=#ce9178]"S"[/color][color=#d4d4d4],[/color][color=#ce9178]"T"[/color][color=#d4d4d4],[/color][color=#ce9178]"U"[/color][color=#d4d4d4],[/color][color=#ce9178]"V"[/color][color=#d4d4d4],[/color][color=#ce9178]"W"[/color][color=#d4d4d4],[/color][color=#ce9178]"X"[/color][color=#d4d4d4],[/color][color=#ce9178]"Y"[/color][color=#d4d4d4],[/color][color=#ce9178]"Z"[/color]) [color=#c586c0]foreach[/color] ([color=#9cdcfe]$drive[/color] [color=#c586c0]in[/color] [color=#9cdcfe]$drives[/color]) { [color=#9cdcfe]$drive[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$drive[/color] [color=#d4d4d4]+[/color] [color=#ce9178]":"[/color] [color=#c586c0]if[/color]( [color=#dcdcaa]Test-Path[/color] [color=#ce9178]"[/color][color=#9cdcfe]$drive[/color][color=#ce9178]\Users\administrator\NTUSER.DAT"[/color]) { [color=#9cdcfe]$OSDISK[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$drive[/color] [color=#9cdcfe]$logfile[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"[/color][color=#9cdcfe]$OSDISK[/color][color=#ce9178]\w11startupgrade.log"[/color] [color=#dcdcaa]Start-Transcript[/color] [color=#d4d4d4]-[/color]Path [color=#9cdcfe]$logfile[/color] [color=#d4d4d4]-[/color]Verbose [color=#dcdcaa]Import-StartLayout[/color] [color=#d4d4d4]-[/color]LayoutPath [color=#9cdcfe]$PSScriptRoot[/color]\taskbar.xml [color=#d4d4d4]-[/color]MountPath [color=#9cdcfe]$env:SystemDrive[/color]\ [color=#9cdcfe]$json[/color] [color=#d4d4d4]=[/color] [color=#ce9178]'{"pinnedList":[{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"},{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"},{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},{"packagedAppId":"windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"},{"packagedAppId":"Microsoft.ScreenSketch_8wekyb3d8bbwe!App"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\VLC media player.lnk"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Configuration Manager\\Configuration Manager\\Software Center.lnk"},{"packagedAppId":"Microsoft.CompanyPortal_8wekyb3d8bbwe!App"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\lenovo\\System Update.lnk"},{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Dell\\Command Update\\Dell Command Update.lnk"}]}'[/color] [color=#c586c0]if[/color] ([color=#d4d4d4]![/color]([color=#dcdcaa]Test-Path[/color] [color=#ce9178]"HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start"[/color])){ [color=#dcdcaa]New-Item[/color] [color=#d4d4d4]-[/color]Path [color=#ce9178]"HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start"[/color] } [color=#dcdcaa]New-itemproperty[/color] [color=#ce9178]"HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start"[/color] [color=#d4d4d4]-[/color]Name ConfigureStartPins [color=#d4d4d4]-[/color]Value [color=#9cdcfe]$json[/color] [color=#d4d4d4]-[/color]PropertyType String [color=#d4d4d4]-[/color]Force [color=#9cdcfe]$users[/color] [color=#d4d4d4]=[/color] [color=#dcdcaa]Get-ChildItem[/color] [color=#9cdcfe]$OSDISK[/color]\Users [color=#d4d4d4]-[/color]Exclude [color=#ce9178]"Default"[/color][color=#d4d4d4],[/color] [color=#ce9178]"public"[/color][color=#d4d4d4],[/color] [color=#ce9178]"Default.migrated"[/color][color=#d4d4d4],[/color][color=#ce9178]"TEMP"[/color] [color=#c586c0]foreach[/color] ([color=#9cdcfe]$user[/color] [color=#c586c0]in[/color] [color=#9cdcfe]$users[/color]){ [color=#9cdcfe]$profile[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$user[/color][color=#dcdcaa].FullName[/color] [color=#DCDCAA]Copy-Item[/color] [color=#D4D4D4]-[/color]Path [color=#CE9178]"[/color][color=#9CDCFE]$OSDISK[/color][color=#CE9178]\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk"[/color] [color=#D4D4D4]-[/color]Destination [color=#CE9178]"[/color][color=#9CDCFE]$profile[/color][color=#CE9178]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar"[/color] [color=#D4D4D4]-[/color]force [color=#dcdcaa]Copy-Item[/color] [color=#d4d4d4]-[/color]Path [color=#ce9178]"[/color][color=#9cdcfe]$OSDISK[/color][color=#ce9178]\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk"[/color] [color=#d4d4d4]-[/color]Destination [color=#ce9178]"[/color][color=#9cdcfe]$profile[/color][color=#ce9178]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar"[/color] [color=#d4d4d4]-[/color]force [color=#dcdcaa]remove-item[/color] [color=#d4d4d4]-[/color]path [color=#ce9178]"[/color][color=#9cdcfe]$profile[/color][color=#ce9178]\AppData\Local\Microsoft\Windows\Shell"[/color] [color=#d4d4d4]-[/color]Force [color=#d4d4d4]-[/color]Recurse } [color=#dcdcaa]Stop-Transcript[/color] }}

Yes, I have the same issue. Looking into it today because a teacher could not change her display settings. Duplicate / extend. I also had the simplify quick settings on. I like the idea of hiding all the extra stuff they don't need. However this also disabled the win+p menu. I reverted the simplify quick settings to fix her issue. I'm glad to know its not just me.

I've been using Google so long going back to step 1 to cover everything will be difficult. Here are a few high level things to get you started. Let the sync tool handle user creation. A combination of Google Cloud Directory Sync and Google Apps password sync. GCDS just goes on one server and works similar to Azure AD connect. It will sync Users, Groups and OUs based on your rules. GAPS will need to go on all domain controllers as it is a password filter dll. Then I'd just spend some time in the admin console getting the settings the way you want them. Create a few test users for this if need be. I have a user I move from OU to OU for varies testing scenarios. The few areas you will want to cover are Google apps and services.. Turn off what you don't want students using. Maybe GMail if you use O365 for mail. Go through the chrome settings and secure them. No incognito, task manager, set the home page etc. If you will use GMail, look at all the safety / spam settings and restricted delivery. In general just skim through everything most items are intuitive enough and or have good help linked. Then as said above you can use GAM for bulk actions and some items you cannot do in the web interface.

It's really not been too bad. If I recall password write backs are not on the same sync schedule as the other Syncs and happen in almost immediately. The two numbers I recall reading somewhere are 2 minutes and 5 minutes. I've had a few cases they say the reset doesn't work, but usually within a minute it does. One thing I wish it did better is show if the password has already been reset? If a password has already been reset, Azure gives a generic warning about on prem policy. I don't have it in front of me to get exact wording. However in all the users I've checked, the mush change password at next logon box is checked. Overall it is working well.

I’m at a loss on how to fix this print nightmare stuff and stay secure. I thought I dodged it with GPP deployments, but my users just hadn’t rebooted from the patches yet. Now I’m getting the issue somewhat randomly. I’ve had less than half a dozen reports so far. Most are the smaller HP LaserJet’s but one was the follow me queue / copiers. The most reliable method I’ve come up with is a series of PDQ steps. Run as logged in user delete all shared Run as admin set RestrictDriverInstallationToAdministrators to 0 Run as logged in user gpupdate force Run as admin set RestrictDriverInstallationToAdministrators to 1 I’ve setup a VM, removed all printer drivers and deleted the profile of a test user. I’ve added this machine to all the printer deployment security groups. If I make no changes one or two printers install. If I try to preload the drivers with rundll32 printui.dll PrintUIEntry /in /n \\printserver\printer and rundll32 printui.dll PrintUIEntry /dn /n \\printserver\printer I can see the drivers loaded in print management MMC, but I still get driver missing errors in the GPP event log. However about half of the printers install this way. Running the PDQ steps above gets me all but 1 or 2 printers. I’ve not really looked into those yet, it may be a simple permissions issue as I didn’t add the user to the group, just the computer. I have 1 computer / user who nothing appears to be working. I ran the steps above yesterday to clear up the trust / driver dialog. Then the user got a message that said failed to print. After a reboot printing worked. Today the computer is prompting for trust / driver again. Running the fix got us back to failed to print. I did not ask for reboot. Another user who I ran the method above was able to print without a reboot. I checked this user is running 1909 with September's patch. For good measure I set RpcAuthnLevelPrivacyEnabled to 0 on the printer server and restarted the spooler. The user got the same error. Do I need to leave RestrictDriverInstallationToAdministrators to 0? I’m deploying GPP with the action create. If I change to update, will it break more users? I'm also using point and print restrictions. The GPO has the full FQDN. I tested and could not connect to another print server. The GPP deployments all use the hostname only. Thanks

I went through that confusion when we retired our Cisco gear. What helped me was to match the T's Trunk = Tagged.

A few staff resets. Students will start Tuesday. I've delegated password resets via Azure with password writeback. We'll see how that goes this year.

This is how I do it. Create a user GPP policy Do not check run in logged on user context. This will allow it to process as the computer. So far this has avoided the admin prompts for me. Under ITL set rules for the computer to belong to a specific OU, Security group or netbios name. There is two options on the OU and group rules. User belongs to or computer belongs to. In this case you want computer. When it is the follow me queue or a lab, it is easy to target the OU. If it is a shared office printer, I put the users and computers in a group called print-queuename This serves two purposes, one gives a group to target for deployment and two security of who can access the printer. Weather that is windows built in permissions or via papercut. Finally for a one off single office and / or the teacher laptop for a lab. Netbios name. Although I think I got rid of most during a clean up this summer. I had a single user printer user change for this school year. I took the time to remove the netbios name and just create a security group. It only has one computer and one user in it, but if the new person doesn’t stay, I’ve got one place to change it. The problem with netbios names is you have to update the GPO when the user or computer changes vs just adding to a security group. Also if you rename the computer for whatever reason, the name in a security group is automatically updated, GPP not so.

I've rarely had sync issues. Once or twice in 10 years an update broke things and I had to stay a version back for a while. Overall it works quite well. Do you have your LDAP query set to look for only active users? If so you can choose to delete or suspend them when they are disabled. If you have special accounts in one system or the other, write exclusions. Here is the LDAP query I use. The user account control section tells it to exclude disabled accounts. The mail section tells it to exclude anyone that does not have a school email listed. This rule is repeated a few times to get just the user OUs I sync. (&(objectCategory=person)(objectClass=user)(|(mail=*@school.org)(mail=*@school.us)) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))