Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
contact@evotec.pl

Prepare Windows 10 Start Menu for all computers in Active Directory

Prepare Windows 10 Start Menu for all computers in Active Directory
Windows Start Menu
0
By Przemyslaw Klys Active Directory PowerShell Windows January 26, 2018

Windows 10 in my humble opinion is very good system. It has it's pros and cons but so does each system. It's not perfect but it never will be. One of those things that bother me a lot is Windows Start Menu with all those apps there. Fortunately there is a way to prepare Windows 10 Start Menu for all computers in Active Directory so that it always looks the same (support will thank you for this) and will contain necessary elements for users to work on.

How to apply start menu settings via GPO

This is how the start menu looks like when Windows 10 was installed…

Now that one is ugly thing. Lots of apps, that shouldn't be there. The way to go forward is to make sure the Start Menu looks like you want it to look like

Then simply export the start menu layout to .xml  via powershell (if you will get error check bottom of the this post) 

PS C:\Users\test.dlp2> Export-StartLayout -path "test.xml"
PS C:\Users\test.dlp2> cd .\Desktop\
PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path "test.xml"
PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path "startmenu.xml"
PS C:\Users\test.dlp2\Desktop>

Put exported file in a place that is always available to the users. In my case I usually use NETLOGON folder for that kind of setup: \\domain.name\NETLOGON\Configs\startmenu.xml

And finally create Group Policy that will force it thru to the users. 

Remember that this is purely Users GPO so it has to be applied to Users, and not Computers. The GPO is available under: User Configuration -> Policies -> Administrative Templates

After creating GPO run gpupdate /force on the test computer and confirm with gpresult /R that policy is actually applied to this user.

Finally logout  to enjoy the nice and prepare Start Menu (although in my case the layout was a bit different)

How to make start menu editable by users

While above method is great and you can personalize start menu for all users in your company it may impact users productivity because user may use special software or other things that he wants to have pinned to his start menu. It's actually quite easy.

Now that we have the startmenu.xml file exported, all we have to do edit it and change one line

<LayoutModificationTemplate xmlns:defaultlayout="https://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="https://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="https://schemas.microsoft.com/Start/2014/LayoutModification">
  <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride>
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6">
        <start:Group Name="Internet">
          <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
        </start:Group>
        <start:Group Name="Tools">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FortiClient\FortiClient.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\TeamViewer 12 Host.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft System Center\Configuration Manager\Software Center.lnk" />
        </start:Group>
        <start:Group Name="Productivity">
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

Has to be changed to into this:

<LayoutModificationTemplate xmlns:defaultlayout="https://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="https://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="https://schemas.microsoft.com/Start/2014/LayoutModification">
  <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6">
        <start:Group Name="Internet">
          <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
        </start:Group>
        <start:Group Name="Tools">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FortiClient\FortiClient.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\TeamViewer 12 Host.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft System Center\Configuration Manager\Software Center.lnk" />
        </start:Group>
        <start:Group Name="Productivity">
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

Just by adding LayoutCustomizationRestrictionType=”OnlySpecifiedGroups” into DefaultLayoutOverride you will make Start Menu with your changes static, but still allow user to modify other parts of it (or rearrange it). The only difference would be padlocks on sections users can't modify. Otherwise they can add their icons and modify start menu.

Or even rearrange it if that's what they want (in limited way)

How to revert start menu settings to defaults after applying them via GPO

To revert start menu setup by Group Policy (GPO) one just have to remove assignment of the GPO from the users, run gpupdate /force and finally relogin.

Notes

If you're hitting problems with exporting the start layout like this one:

PS C:\Users\test.dlp2\Desktop> Export-StartLayout -path 'start.xml'
Export-StartLayout : The parameter is incorrect.
Thrown exception in StartTileData.dll
At line:1 char:1
+ Export-StartLayout -path 'start.xml'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Export-StartLayout], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.Windows.StartLayout.Commands.ExportStartLayoutCommand

You can try one of those 4 solutions (or all of them):

Rename “Office” to “Productivity” – in my case I've created group named Office and after renaming it to something different it helped

Make sure you have at least 1 tile – you simply can't have empty start menu

Make sure your first tile is Edge tile – you may want to avoid putting IE as first

Logout after fixing StartMenu – sometimes the changes you did may look a bit different after relogin

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Related Posts

Hyper-V Backing Up
Hyper-V – Can’t start Virtual Machine because it’s backing up
Working as a small business often brings you little tasks here and there. Today I’ve decided to shut down the Hyper-V machine to expand its disks. Unfortunately for me, while extending of HDD went great, I couldn’t start Virtual Machine any longer.
25 Feb 2019
Windows 10 – You’ll need the internet for this 0xCAA7004 or 0xCAA30194 or 0x80072EFD
08 Aug 2018
Four commands to help you track down insecure LDAP Bindings before March 2020
In March 2020, Microsoft will release its monthly updates. With those updates, Microsoft will disable insecure LDAP Bindings, which is going to break a lot of your systems (hopefully not). But this was already communicated, and you know all about it, right? If not, you should read those two articles that can help you with understanding what is happening and when.
19 Jan 2020
Import-PSSession
Office 365 – Using dynamic variable as prefix for Office 365 commands
29 Oct 2018
Sending HTML emails with PowerShell and zero HTML knowledge required
I saw this article by Altaro tweeted Building PowerShell Tools for MSPs: HTML Tables for Reporting, and it describes how you can create HTML emails with just a few lines of code. Luke created that article in 2018 (tweets from the archive I guess), but I just saw it now so thought I would make a slight comparison. In 2018 I would probably go the same way as shown by Luke Orellana, who takes a simple example of querying WMI to get disk drive sizes and send them over, formatted via Email.
11 Jul 2019
Windows 10 – Microsoft Store, Edge, Windows Updates, Microsoft Outlook not able to connect with error 0x80072EE7, 0x80070005
04 Oct 2018
PSBlackListChecker Discord
PSBlackListChecker – Added Discord support
It’s been less than 24 hours since I’ve released PSBlackListChecker with support, among other improvements, for Microsoft Teams and Slack and I’m now adding Discord to the mix. Discord was a popular request (well not really, just one person asked, but let’s pretend everyone loves PSBlackListChecker so much that they are too shy to ask for feature requests!).
03 Nov 2018
Preparing Azure App Registrations permissions for Office 365 Service Health
As you may have seen in my other post, there’s a simple, PowerShell way to get Office 365 Health Service data for you to use any way you like it. But before you can use that, you need to register granular permissions on your Office  365 tenant so that that data is provided to you. Here’s a step by step way to do it.
22 Apr 2019
Fixing Active Directory PasswordNotRequired with PowerShell
There was I, deploying PSPasswordExpiryNotifications for one of my Clients when I started getting complaints that some users are not getting their Password Expiry Notifications. Well, that’s a new one. I’ve tested this script multiple times, and it worked just fine. So I dive into the details of my script to see what I did in there (I don’t even remember anymore – it just works) to find out this little line:
25 Jun 2019
Unifi PowerShell
Using PowerShell to fix Ubiquiti Unifi requirement for MongoDB 3.6 on Ubuntu 18
I’ve been using Ubiquiti Unifi for some years now, for both home and work usage. It’s great hardware at a great price, and the best thing for a software maniac like me is that it’s continuously updated. Some time ago I upgraded Ubuntu to 18.04, and things went a bit sideways. You see Unifi started to add to their DEB packages that Mongo 3.6 is not supported and therefore blocking any installation. The idea is, it works perfectly fine on MongoDB 3.6 but migration between 3.4 to 3.6 is just not straightforward. Long story short when I upgraded Ubuntu I was suddenly greeted with not working Unifi.  I’ve fixed that, and blogged about it how you can do so using manual steps – Ubuntu 18.04 – Fixing Unifi .deb package to run with 3.6 MongoDB. The thing is with each new version out I have to do multiple steps to fix every single package from Unifi (you see where I’m going right?). While a few years ago I would be stuck to use bash or some other workaround which would be a pain for me, this is 2019, and PowerShell Core works excellent on Linux systems! I know that installing PowerShell Core for hardcore Linux fans may not be as fun as it is for me, but you do get a lot of benefits from it.
11 Mar 2019
AzureAD – Enable Password Expiration with Password Hash Synchronization
Azure AD Connect allows three ways to make sure the user password is the same in Active Directory and Office 365. Those are Password Hash Sync, Pass-Thru Authentication, and ADFS. While my preferred option to go with would be Pass-Thru Authentication, only Password Hash Synchronization is the easiest and least resource-intensive. It synchronizes user password to Office 365, and even if your Active Directory is down, you can still log in to Office 365. It’s perfect for small and even more significant companies that don’t have resources or can’t guarantee that their infrastructure will stay 100% time online so users can authenticate based on their Active Directory.
24 Feb 2020
Export-CliXML and Import-CliXML serialization woes
I’ve been working today trying to deliver to one of my Clients Active Directory documentation. To my surprise, something that worked fine for a very long time has started to provide weird results. So, after spending about 8 hours taking apart a few of my PowerShell modules trying to find out what is wrong finally, I’ve found it: Export-CliXML / Import-CliXML. Those two commands are great. I’ve used them multiple times with great success (or so I thought).
23 Jun 2019
The type initializer for Gdip threw an exception
PowerShell Core – The type initializer for Gdip threw an exception.
22 Sep 2018
PowerShell – How to check response code from a website
0
28 Oct 2015
All your HTML Tables are belong to us
Last few days, I’ve fulfilled my little dream related to building HTML tables. You know I’ve been using HTML based scripts for a long while for Microsoft Exchange from multiple people like Steve Goodman or Paul Cunningham (and others) and when I was going thru their PowerShell building code on how they create an HTML table with multi-row titles I thought Those guys are crazy. The effort to build an HTML table for a report for a person who has no clue how to do it is not something one can easily digest and understand. Sure I’ve learned how to build HTML tables at some point, but there was one final piece that I was missing – multi-row headers. If you don’t know what I mean, and how they look like the below image from Steve’s Goodman script should give you a hint.
28 Jun 2019

Leave a comment

You must be logged in to post a comment.