Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
contact@evotec.pl

Prepare Windows 10 Start Menu for all computers in Active Directory

Prepare Windows 10 Start Menu for all computers in Active Directory
Windows Start Menu
0
By Przemyslaw Klys Active Directory PowerShell Windows January 26, 2018

Windows 10 in my humble opinion is very good system. It has it's pros and cons but so does each system. It's not perfect but it never will be. One of those things that bother me a lot is Windows Start Menu with all those apps there. Fortunately there is a way to prepare Windows 10 Start Menu for all computers in Active Directory so that it always looks the same (support will thank you for this) and will contain necessary elements for users to work on.

How to apply start menu settings via GPO

This is how the start menu looks like when Windows 10 was installed…

Now that one is ugly thing. Lots of apps, that shouldn't be there. The way to go forward is to make sure the Start Menu looks like you want it to look like

Then simply export the start menu layout to .xml  via powershell (if you will get error check bottom of the this post) 

PS C:\Users\test.dlp2> Export-StartLayout -path "test.xml"
PS C:\Users\test.dlp2> cd .\Desktop\
PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path "test.xml"
PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path "startmenu.xml"
PS C:\Users\test.dlp2\Desktop>

Put exported file in a place that is always available to the users. In my case I usually use NETLOGON folder for that kind of setup: \\domain.name\NETLOGON\Configs\startmenu.xml

And finally create Group Policy that will force it thru to the users. 

Remember that this is purely Users GPO so it has to be applied to Users, and not Computers. The GPO is available under: User Configuration -> Policies -> Administrative Templates

After creating GPO run gpupdate /force on the test computer and confirm with gpresult /R that policy is actually applied to this user.

Finally logout  to enjoy the nice and prepare Start Menu (although in my case the layout was a bit different)

How to make start menu editable by users

While above method is great and you can personalize start menu for all users in your company it may impact users productivity because user may use special software or other things that he wants to have pinned to his start menu. It's actually quite easy.

Now that we have the startmenu.xml file exported, all we have to do edit it and change one line

<LayoutModificationTemplate xmlns:defaultlayout="https://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="https://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="https://schemas.microsoft.com/Start/2014/LayoutModification">
  <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride>
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6">
        <start:Group Name="Internet">
          <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
        </start:Group>
        <start:Group Name="Tools">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FortiClient\FortiClient.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\TeamViewer 12 Host.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft System Center\Configuration Manager\Software Center.lnk" />
        </start:Group>
        <start:Group Name="Productivity">
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

Has to be changed to into this:

<LayoutModificationTemplate xmlns:defaultlayout="https://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="https://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="https://schemas.microsoft.com/Start/2014/LayoutModification">
  <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6">
        <start:Group Name="Internet">
          <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
        </start:Group>
        <start:Group Name="Tools">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FortiClient\FortiClient.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\TeamViewer 12 Host.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft System Center\Configuration Manager\Software Center.lnk" />
        </start:Group>
        <start:Group Name="Productivity">
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

Just by adding LayoutCustomizationRestrictionType=”OnlySpecifiedGroups” into DefaultLayoutOverride you will make Start Menu with your changes static, but still allow user to modify other parts of it (or rearrange it). The only difference would be padlocks on sections users can't modify. Otherwise they can add their icons and modify start menu.

Or even rearrange it if that's what they want (in limited way)

How to revert start menu settings to defaults after applying them via GPO

To revert start menu setup by Group Policy (GPO) one just have to remove assignment of the GPO from the users, run gpupdate /force and finally relogin.

Notes

If you're hitting problems with exporting the start layout like this one:

PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path 'start.xml'
Export-StartLayout : The parameter is incorrect.
Thrown exception in StartTileData.dll
At line:1 char:1
+ Export-StartLayout -path 'start.xml'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Export-StartLayout], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.Windows.StartLayout.Commands.ExportStartLayoutCommand

You can try one of those 4 solutions (or all of them):

Rename “Office” to “Productivity” – in my case I've created group named Office and after renaming it to something different it helped

Make sure you have at least 1 tile – you simply can't have empty start menu

Make sure your first tile is Edge tile – you may want to avoid putting IE as first

Logout after fixing StartMenu – sometimes the changes you did may look a bit different after relogin

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Related Posts

Microsoft Azure
Azure ADConnect Export Failed – Permission-issue error
0
08 Oct 2017
Active Directory – The directory service was unable to allocate a relative identifier
I’ve been testing Disaster Recovery scenario restoring Active Directory. One of the servers was restored, and it worked for a moment after restore. If you can regain your Primary DC, it’s best to do so. If you can’t, a standard thing to do during DR is to move all FSMO roles to the restored server so that it can become a master server. You can find out your FSMO holders by using those commands below:
27 Mar 2019
Monitoring User, Groups Changes in Active Directory – version 0.8
17 Apr 2018
Monitoring LDAPS connectivity/certificate with PowerShell
Some time ago, I wrote a blog post on checking for LDAP, LDAPS, LDAP GC, and LDAPS GC ports with PowerShell. It mostly works, but it requires a tad bit of effort, and it doesn’t cover the full scope that I wanted. Recently (well over 3 years ago), Chris Dent shared some code that verifies the LDAP certificate, and I thought this would be good to update my cmdlets to support just that with a bit of my own magic on top.
02 Mar 2021
Missing Permissions Authenticated Users
Finding GPOs missing permissions that may prevent GPOs from working correctly
I’ve been in IT for a longer time now. I’ve made my fair share of mistakes and misconfigurations. One of those misconfigurations was removing Authenticated Users from Security filtering in Group Policy Objects. While it worked fine at some point Microsoft rolled out a Hotfix MS16-07 on June 14th 2016.
19 Feb 2020
Active Directory
Synchronizing Active Directory with External Time Source
0
24 Jan 2018
PSBlackListChecker Discord
PSBlackListChecker – Added Discord support
It’s been less than 24 hours since I’ve released PSBlackListChecker with support, among other improvements, for Microsoft Teams and Slack and I’m now adding Discord to the mix. Discord was a popular request (well not really, just one person asked, but let’s pretend everyone loves PSBlackListChecker so much that they are too shy to ask for feature requests!).
03 Nov 2018
PSWinDocumentation.AD
What do we say to writing Active Directory documentation?
It’s no secret that nobody likes creating documentation. I don’t like it, and you don’t like it, even documentation lovers don’t like it. But while you can live without documentation, you really shouldn’t. And I am not talking here only about documentation that is only useful in the onboarding process of new employees or documentation concerning introducing someone to some concepts to get them easily start. I’m talking about documentation for your live environment where you know what you have, how you have set it up, but is still the same after one week, one month, or one year? Usually, not so much. And one of the worst mistakes admin can do is assume that his environment doesn’t change, things are as they were when they were set up.
12 May 2019
Getting Windows 10 build version from Active Directory
Today I saw an article on how to get Windows Version Report from Active Directory and thought that this is a cool idea. Something handy for migration scenarios or information on how up to date is your infrastructure. Since there are many ways to do the same thing I decided to tackle this myself and further include it into PSWinDocumentation.AD project. By default Active Directory stores Operating System and Operating System Version but it doesn’t really show versions one may expect.
14 Jun 2019
Sending HTML emails with PowerShell and zero HTML knowledge required
I saw this article by Altaro tweeted Building PowerShell Tools for MSPs: HTML Tables for Reporting, and it describes how you can create HTML emails with just a few lines of code. Luke created that article in 2018 (tweets from the archive I guess), but I just saw it now so thought I would make a slight comparison. In 2018 I would probably go the same way as shown by Luke Orellana, who takes a simple example of querying WMI to get disk drive sizes and send them over, formatted via Email.
11 Jul 2019
Testing LDAP and LDAPS connectivity with PowerShell
One of the common ways to connect to Active Directory is thru LDAP protocol. There are a lot of applications that talk to AD via LDAP. By default Active Directory has LDAP enabled but that’s a bit insecure in today’s world. That’s where LDAPS comes in. It’s not easy to set up, but when you get it done, it works. The problem I had recently is that while setting up LDAPS on DC’s I only did this on some of the DC’s, and not all of them as I should.
04 Aug 2019
PSWinReporting Legacy Edition
PSWinReporting 1.8 – Split of branches (Legacy vs. New Hope)
A new branch of PSWinReporting is slowly coming, and I thought it would be the best time to have a final article about it with all configuration options available for those that will want to stay using PSWinReporting from Legacy branch. The idea is that you may have it working in your systems and it’s good enough for you. You may not want to change it, and with New Hope, the changes are so big it’s a rewrite.
10 Mar 2019
OneDrive
Sync any folder in Windows to OneDrive
0
16 Feb 2018
PowerShell Plus Active Directory Plus Microsoft Graph Equals Love
Report Active Directory Accounts that are Synchronized with Azure AD
I was scrolling X (aka Twitter) today and saw this blog post, “PowerShell: Report On-Premises Active Directory Accounts that are Synchronized with Azure AD Connect” by Kevin Trent. I like reading blog posts as I tend to learn some new things and see how people tend to solve their problems.
07 Aug 2023
Track Ubiquiti Unifi Stock, and get notified of changes
I am a pretty big fan of Ubiquiti and their Unifi products line. Whether it’s network equipment or their camera systems, Unifi Protect, I have it all, and I’m pretty happy with how it works. However, over the last two years, some of their stocks in the store were very hard to find. For example, I’ve searched for Unifi Protect G4 Doorbell Pro for over six months. I’ve tried local shops all around Europe, even in the Ubiquiti Europe store, to never found any of them.
16 Apr 2023

Leave a comment

You must be logged in to post a comment.