Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
contact@evotec.pl

Prepare Windows 10 Start Menu for all computers in Active Directory

Prepare Windows 10 Start Menu for all computers in Active Directory
Windows Start Menu
0
By Przemyslaw Klys Active Directory PowerShell Windows January 26, 2018

Windows 10 in my humble opinion is very good system. It has it's pros and cons but so does each system. It's not perfect but it never will be. One of those things that bother me a lot is Windows Start Menu with all those apps there. Fortunately there is a way to prepare Windows 10 Start Menu for all computers in Active Directory so that it always looks the same (support will thank you for this) and will contain necessary elements for users to work on.

How to apply start menu settings via GPO

This is how the start menu looks like when Windows 10 was installed…

Now that one is ugly thing. Lots of apps, that shouldn't be there. The way to go forward is to make sure the Start Menu looks like you want it to look like

Then simply export the start menu layout to .xml  via powershell (if you will get error check bottom of the this post) 

PS C:\Users\test.dlp2> Export-StartLayout -path "test.xml"
PS C:\Users\test.dlp2> cd .\Desktop\
PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path "test.xml"
PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path "startmenu.xml"
PS C:\Users\test.dlp2\Desktop>

Put exported file in a place that is always available to the users. In my case I usually use NETLOGON folder for that kind of setup: \\domain.name\NETLOGON\Configs\startmenu.xml

And finally create Group Policy that will force it thru to the users. 

Remember that this is purely Users GPO so it has to be applied to Users, and not Computers. The GPO is available under: User Configuration -> Policies -> Administrative Templates

After creating GPO run gpupdate /force on the test computer and confirm with gpresult /R that policy is actually applied to this user.

Finally logout  to enjoy the nice and prepare Start Menu (although in my case the layout was a bit different)

How to make start menu editable by users

While above method is great and you can personalize start menu for all users in your company it may impact users productivity because user may use special software or other things that he wants to have pinned to his start menu. It's actually quite easy.

Now that we have the startmenu.xml file exported, all we have to do edit it and change one line

<LayoutModificationTemplate xmlns:defaultlayout="https://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="https://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="https://schemas.microsoft.com/Start/2014/LayoutModification">
  <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride>
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6">
        <start:Group Name="Internet">
          <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
        </start:Group>
        <start:Group Name="Tools">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FortiClient\FortiClient.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\TeamViewer 12 Host.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft System Center\Configuration Manager\Software Center.lnk" />
        </start:Group>
        <start:Group Name="Productivity">
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

Has to be changed to into this:

<LayoutModificationTemplate xmlns:defaultlayout="https://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="https://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="https://schemas.microsoft.com/Start/2014/LayoutModification">
  <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6">
        <start:Group Name="Internet">
          <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
        </start:Group>
        <start:Group Name="Tools">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FortiClient\FortiClient.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\TeamViewer 12 Host.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft System Center\Configuration Manager\Software Center.lnk" />
        </start:Group>
        <start:Group Name="Productivity">
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

Just by adding LayoutCustomizationRestrictionType=”OnlySpecifiedGroups” into DefaultLayoutOverride you will make Start Menu with your changes static, but still allow user to modify other parts of it (or rearrange it). The only difference would be padlocks on sections users can't modify. Otherwise they can add their icons and modify start menu.

Or even rearrange it if that's what they want (in limited way)

How to revert start menu settings to defaults after applying them via GPO

To revert start menu setup by Group Policy (GPO) one just have to remove assignment of the GPO from the users, run gpupdate /force and finally relogin.

Notes

If you're hitting problems with exporting the start layout like this one:

PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path 'start.xml'
Export-StartLayout : The parameter is incorrect.
Thrown exception in StartTileData.dll
At line:1 char:1
+ Export-StartLayout -path 'start.xml'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Export-StartLayout], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.Windows.StartLayout.Commands.ExportStartLayoutCommand

You can try one of those 4 solutions (or all of them):

Rename “Office” to “Productivity” – in my case I've created group named Office and after renaming it to something different it helped

Make sure you have at least 1 tile – you simply can't have empty start menu

Make sure your first tile is Edge tile – you may want to avoid putting IE as first

Logout after fixing StartMenu – sometimes the changes you did may look a bit different after relogin

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Related Posts

PowerShellBlack
PowerShell Modules I worked on in 2019
It’s year 2020 and 365 days passed since my last year blog post about PowerShell modules I worked on in 2018. I thought it would be a good occasion to review what happened and how things changed during that time. When I wrote the last blog post in the first days of 2019, my PowerShell modules were downloaded just a bit over 15000 times. Fast Forward today, and the counter is at 280000 times spread over 40 modules. Of course, not all those modules are equal. In 2019 I created multiple new PowerShell modules, but some modules were archived, while others were migrated back to their “parents”. Just to see how my community road was going in the last years I decided to check some statistics.
06 Jan 2020
Office 365 Org Settings
Configuring Office 365 settings using PowerShell – The non-supported way
Office 365 is a huge beast. It has so many services that it’s hard to track all of them. It’s even harder if you want to manage Office 365 using PowerShell. Microsoft makes many different PowerShell modules available for you, such as AzureAD, AzureADPreview, ExchangeOnline, MicrosoftTeams, and recently, Microsoft.Graph. But even with so many different modules, there are still tasks that Microsoft won’t let you do from PowerShell. But it doesn’t mean that it’s not possible to do it. I’ve spent some time tracking how Microsoft does things while you click thru the interface and created an O365Essentials PowerShell module that can do it in an automated way.
26 Sep 2021
Sending as Alias in Office 365
Sending email as an alias (proxy address) with Office 365
Sending emails in Microsoft Exchange world using an alias for an account has always been a pain. It required working with workarounds such as setting up Shared Mailbox or Distribution Groups and using SendAs permissions. For years admins around the world were asking Microsoft to change this, and finally, in April 2021, they did! It’s a new feature of Office 365, and it requires action from Office 365 Administrator.
20 Apr 2021
PSBlackListChecker Discord
PSBlackListChecker – Added Discord support
It’s been less than 24 hours since I’ve released PSBlackListChecker with support, among other improvements, for Microsoft Teams and Slack and I’m now adding Discord to the mix. Discord was a popular request (well not really, just one person asked, but let’s pretend everyone loves PSBlackListChecker so much that they are too shy to ask for feature requests!).
03 Nov 2018
Get-RSSFeed in action
Submitting blogs to web.archive.org using PowerShell
Since my website went down in fire with OVH SBG2, I used this occasion to publish my restored website via Cloudflare. It allows me to have to cache, minimization, and some additional security. One thing that caught my attention while browsing through Cloudflare settings was the Always Online feature based on web.archive.org. Basically, the concept is – whenever the website is down, Cloudflare would go and fetch content from web.archive.org.
19 Mar 2021
Windows 10 Anniversary Update
Install Windows 10 Anniversary Update on Parallels Desktop for Mac
0
08 Aug 2016
EvntAgnt Error 3007
Windows 10 – High CPU Usage with EvntAgnt Warning Event ID 3007 in Event Log
24 Jul 2018
Advanced HTML reporting using PowerShell
I’ve been using HTML reporting in PowerShell for a while. Initially, I would usually build HTML by hand, but the time spent trying to figure out what works and what doesn’t drive me mad. With the PSWriteHTML module, a lot has changed. With just a few PowerShell lines, I can create feature-rich reports that change how I show data to my Clients. Today I wanted to show you some advanced HTML reporting without actually complicating PowerShell code. In the last few months, I’ve added many features that create advanced reports without sacrificing readability.
16 Mar 2021
Office 365 – Limiting license to minimum apps required
Office 365 has a lot of options and applications to choose from. Enabling one E1, E3, or any other license gives the user a lot of features, including Exchange, SharePoint, and Teams. But what if you want to make sure that the user can access only Microsoft Teams? By default, you can do it manually during the assignment of the license. Simply choose only Apps you want to assign to a user.
07 Apr 2020
Windows 10 – Microsoft Store, Edge, Windows Updates, Microsoft Outlook not able to connect with error 0x80072EE7, 0x80070005
04 Oct 2018
Missing Permissions Authenticated Users
Finding GPOs missing permissions that may prevent GPOs from working correctly
I’ve been in IT for a longer time now. I’ve made my fair share of mistakes and misconfigurations. One of those misconfigurations was removing Authenticated Users from Security filtering in Group Policy Objects. While it worked fine at some point Microsoft rolled out a Hotfix MS16-07 on June 14th 2016.
19 Feb 2020
Pester V5
Converting Pester V4 to Pester V5 basics
Now that Pester V5 is out, I decided that I need to make sure that my Pester tests for all my modules keep on running correctly. Some substantial changes in Pester add new features, changing some things, but that also means all the tests that you have defined most likely will need a small push to get it up and running again on Pester V5. Starting this blog post, I wanted to mention that I am by no means an expert on Pester, but I do use it for some time now for most of my projects.  I am using basic functionality, but even that basic functionality stops working once you upgrade from PesterV4 to PesterV5, so I thought I would save you some time and give you a small overview of how you can quickly fix it. It works for me, but you may have to find your way to fix things.
28 May 2020
CodeADSI
Removing user from local administrator group based on data stored in Active Directory
We need to deal with a group names through SID’s rather than names because each group name is different in different languages. The second problem is to distinguish whether a user is a local or domain user. Finally, I need to connect to Active Directory to verify if the user I am about to remove has ExtensionAttribute10 (or any other field in AD) filled in or not.
17 Nov 2019
Office 365 Health Service
Office 365 Health Service using PowerShell
Two years ago, I wrote a PowerShell module called PSWinDocumentation.O365HealthService. The idea was simple – replicate Health Service data Microsoft offers in Office Portal so you can do with data whatever you want and display it however you like. I’ve written about it in this blog post. A few weeks back, someone reported that the module stopped working, and  I’ve confirmed it indeed no longer works! Initially, I thought that maybe some data format changed, as it changed multiple times, or perhaps the date format was wrong again, but no. Microsoft has deprecated Office 365 Service Communications API reference and instead tells us that Service Health is now only available via Microsoft Graph API. Is it only me who didn’t get the memo about this?
14 Feb 2022
Adding user to local Administrators group in multiple languages
Everyone now and then, there comes a moment you need to add a user into Administrators group on each computer…
0
12 Sep 2015

Leave a comment

You must be logged in to post a comment.