Startmenu after first user login building up very slow with UEM 9.4 and Win1709 and 1803

[system32AUT]

Hi Guys,

my Startmenu after first user login is building up very slow with UEM 9.4 and Win1709 and 1803. We trigger UEM Startup over GPO "Run FlexEngine as Group Policy Extension", not with FlexEngine.exe -r at Startup.

I test this with 6 User, 4 without and 2 with local Admin.

We  use a fix layout.xml for the startmenu so the user cant customize his start layout. Sometimes it works, sometimes not. If I try it on Clients without installed UEM 9.4 it works 100%, if I try it on Clients with installed UEM 9.4 it depends… 50/50 Chance...

Here is our *.XML:

<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">

  <LayoutOptions StartTileGroupCellWidth="6" />

  <DefaultLayoutOverride>

    <StartLayoutCollection>

      <defaultlayout:StartLayout GroupCellWidth="6">

        <start:Group Name="Standard Programme">

          <start:Tile Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />

          <start:Tile Size="1x1" Column="4" Row="0" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Maintenance\VMWare UEM Self-Support 9.4.0.lnk" />

          <start:DesktopApplicationTile Size="1x1" Column="4" Row="1" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Firefox.lnk" />

        </start:Group>

        <start:Group Name="Office">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Outlook 2016 (Email).lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Project 2016 Pro.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Word 2016.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Excel 2016.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="4" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Visio 2016 Pro.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Powerpoint 2016.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Access 2016.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Publisher 2016.lnk" />

        </start:Group>

      </defaultlayout:StartLayout>

    </StartLayoutCollection>

  </DefaultLayoutOverride>

</LayoutModificationTemplate>

We use local profiles.

The Symptomes, if the startmenu is not correct working, are every time the same... we have to wait around 20 seconds to see Windows building up all Apps one by one in the Startmenu and then no Windows tiles are Building up because we think UEM Service is Blocking something ?

Anything else with this Problem? UEMdev​ do you have any idea ?

[system32AUT]

Update: I testet now to deactivate the "Run FlexEngine as Group Policy Extension" and start the Flexenginer over FlexEngine.exe -r .

And now every Startmenu on the first Startup works 100%.

BUT... now I have issues with Drive Mapping. Some Drives are mapped, some not. It says i.e.:

2018-08-02 07:31:06.187 [INFO ] Successfully mapped drive 'I:' …. but there is no drive I:\ 

I´m Pretty sure this is a Timing Problem, after Refreshing again with -r the Network drives are here…. Is there a flag for only update the mapped drives? like FlexEngine -drive  or something ?

[system32AUT]

Well ok guys… I see two Options by now

1) I activate the GPO Option "Run FlexEngine as Group Policy Extension" and have a not working fixed startmenu for users who first login

2) I deactive the GPO Option "Run FlexEngine as Group Policy Extension" and run a Login script with FlexEngine.exe -r and have no mapped drives.

What are you thinking? For me this is a bug - please help

Thanks guys

[DEMdev]

Hi Dominik,

What settings do you have configured for personalization? I imagine that something in there conflicts with Windows' handling of the start menu; if you run FlexEngine as a logon script, those settings will be imported a bit later, which then maybe does not affect the start menu? Anyway, just a guess – we'll be better able to assess that when we know which settings you are roaming.

As a test, do you see any issues if you log on with a user without any profile archives? Or if you log on with UEM installed and configured, but without having any configuration files apply for this user?

The "invisible" drive mapping from the logon script might be caused by UAC split token issues – did this maybe happen for one of your admin users? Either way, let's try to get everything to work in the Group Policy client-side extension scenario, as running as a logon script has other limitations.

[system32AUT]

Hi Dev, thank you for the quick Response!

As a test, do you see any issues if you log on with a user without any profile Archives?

     ==> I deleted the Archive from 3 Testuser and YES … now it works 100% on a first Windows login

Or if you log on with UEM installed and configured, but without having any configuration files apply for this user?

     ==> I deactivate the hole UEM GPO for 3 user and YES... this works 100% fine

So your hint with a setting is Maybe the right one But which… Maybe it is the personal certification Redirect and/or not Redirect which I activated:

[IncludeRegistryTrees]
HKCU\Software\Microsoft\Cryptography
HKCU\Software\Microsoft\Identities
HKCU\Software\Microsoft\SystemCertificates
HKCU\Software\Microsoft\Windows NT\CurrentVersion\EFS

[ExcludeRegistryTrees]
HKCU\Software\Microsoft\SystemCertificates\Root\ProtectedRoots

[IncludeFolderTrees]
<UserProfile>\AppData\Local\Microsoft\Credentials
<UserProfile>\AppData\Roaming\Microsoft\CLR Security Config
<UserProfile>\AppData\Roaming\Microsoft\Credentials
<UserProfile>\AppData\Roaming\Microsoft\CryptnetUrlCache
<UserProfile>\AppData\Roaming\Microsoft\Crypto
<UserProfile>\AppData\Roaming\Microsoft\Protect
<UserProfile>\AppData\Roaming\Microsoft\SystemCertificates

[IncludeRegistryTrees]
HKCU\Software\Microsoft\Cryptography
HKCU\Software\Microsoft\Identities
HKCU\Software\Microsoft\SystemCertificates
HKCU\Software\Microsoft\Windows NT\CurrentVersion\EFS

[ExcludeRegistryTrees]
HKCU\Software\Microsoft\SystemCertificates\Root\ProtectedRoots

[IncludeFolderTrees]
<AppData>\Microsoft\CLR Security Config
<AppData>\Microsoft\Credentials
<AppData>\Microsoft\CryptnetUrlCache
<AppData>\Microsoft\Crypto
<AppData>\Microsoft\Protect
<AppData>\Microsoft\SystemCertificates
<LocalAppData>\Microsoft\Credentials

I will check this.

Or it is the Win Explorer view Settings...

[IncludeRegistryTrees]

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideMyComputerIcons

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\Order

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings\Sizer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop

HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU

HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags

[DEMdev]

Hi Dominik,

I'm expecting it's something in Win Explorer view Settings. Pim_van_de_Vis, any thoughts?

[system32AUT]

Hi again

I can confirme now that the issue which we see is somewhere in the inbuild explorer view settings and/or personal certification Redirect and/or not Redirect

I disable it and know no issues, 100% Startmenu as we like to have it for our 7000 users

Any idea how to exactly get to the point of failure? Thanks!

[Justin_Y]

Just checking if I am seeing something similar in 1703 we have high CPU until I wipe out

[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU]

"MRUListEx"

In the Explorer UEM entry

This is intermittent and after we clear the explorer config file it clears up

[system32AUT]

Hi guys, anything new on that topic ? Thanks

[system32AUT]

Good morning guys, I can report now that this issue is the same with UEM 9.5 with Windows 1803 SAC Enterprise. At this time I can say that the problem must be located in the

     Taskbar and list of recent items

settings.

Something from that causes the extreme slow and then broken Starmenu with locale profiles:

#

# Expanded settings for Windows Common Setting 'Taskbar and list of recent items':

#

[IncludeRegistryTrees]

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\StartMenu2\Programs

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

[IncludeIndividualRegistryValues]

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarSizeMove

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\EnableAutoTray

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\Settings

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3\Settings

[IncludeFolderTrees]

<AppData>\Microsoft\Internet Explorer\Quick Launch

<RecentFiles>

Cheers,

Dominik

[EricNichols · Accepted solution]

Try excluding the StartMenuInit registry setting

In the Explorer config:

[ExcludeIndividualRegistryValues]

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuInit

[system32AUT]

Thanks EricNichols! This seems to work

[EricNichols]

Maybe uemdev or pim can comment on this key and why it works?